/    Sign up×
Community /Pin to ProfileBookmark

File uploads… Unix permissions.

Copy linkTweet thisAlerts:
Jul 13.2006

On a Unix box, in order to upload files to a certain directory it must have at least 707 permissions. In that state what stops other parties that share the server writing to that directory. The server is not running any open_base_directory restrictions (according to phpinfo).

to post a comment
PHP

10 Comments(s) ↴

Copy linkTweet thisAlerts:
@NogDogJul 13.2006 — I would think the best way would be by setting up an access control list (ACL) on the user's root directory. However, I don't think ACL is implemented on all flavors of UNIX, so it might not be applicable in your case.
Copy linkTweet thisAlerts:
@bokehauthorJul 13.2006 — Thanks! There is something wrong with the server config anyway because it gets hacked every few months. This was even happening with the old html only site with read only permissions throughout. But the client has decided against changing servers because "[I]the company is just across the road and they are very nice people[/I]".
Copy linkTweet thisAlerts:
@NogDogJul 13.2006 — On second thought, I'm not sure ACL would make a difference, since you would have to give access to whatever account the webserver uses to process your scripts. It would, however, make it harder for other users on the server to find out what your directory names are. Hmm...interesting question that I might have to do more research on. And of course, if someone hacks into the system as a root user, you're screwed no matter what you do.

In case it's an FTP attack, you might check to see if there's a way to limit FTP access via IP address or such. I know there's some file you can set in a user's directory to control FTP access, but I don't recall exaclty which one (something like .ftprc I think?).

Sorry for rambling...it's been a few years since I dealt with these things in any detail.
Copy linkTweet thisAlerts:
@bokehauthorJul 13.2006 — Well it is hacked at root because all sites on the server are affected but that's not really what I was worried about. What I am really asking is if PHP can write to this directory what is stopping any other user on the server using PHP to write to my 0777 directory?
Copy linkTweet thisAlerts:
@NogDogJul 13.2006 — Nothing that I'm aware of, which has me curious and doing some Googling, because that seems like a security hole that should be addressed somewhere....
Copy linkTweet thisAlerts:
@bokehauthorJul 14.2006 — Well on my server which is running under windows I have an open base directory restriction in each virtual host which only allows PHP to access [I]document root - 1 [/I]. This means (I believe) if one domain gets hacked the damage will be limited to the directories specified in the virtual host for that domain.
Copy linkTweet thisAlerts:
@NogDogJul 14.2006 — Yeah, it's looking to me like open_basedir is the most obvious solution I can see.
Copy linkTweet thisAlerts:
@bokehauthorJul 14.2006 — Well that would mean asking them to modify every virtual host on the server and it would just be stopping PHP being naughty but it still leaves PERL etc. with free reign over my directory. Surely there must be another mechanism in place to stop this... or maybe not.
Copy linkTweet thisAlerts:
@NogDogJul 14.2006 — I think the open_basedir is an Apache thing, not just a PHP thing, so hopefully it applies to CGI scripts and such, but I'm not 100% positive about that.
Copy linkTweet thisAlerts:
@bokehauthorJul 14.2006 — No, it's as PHP value as can be seen here:[CODE]<VirtualHost *:80>
ServerName bokehman.com
DocumentRoot C:/apache/htdocs/bokehman.com/web
ServerAlias www.bokehman.com
php_admin_value open_basedir C:/apache/htdocs/bokehman.com;C:/php/pear;C:/WINDOWS/TEMP
php_admin_value display_errors Off
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_HOST} !^bokehman.com$ [NC]
RewriteRule ^(.*)$ http://bokehman.com$1 [R=301,L,QSA]
</IfModule>
</VirtualHost>[/CODE]
×

Success!

Help @bokeh spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 — BETA 6.17,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @nearjob,
tipped: article
amount: 1000 SATS,

tipper: @meenaratha,
tipped: article
amount: 1000 SATS,

tipper: @meenaratha,
tipped: article
amount: 1000 SATS,
)...