Home / server / Questions / 757445
In Process
Viktor Joras
Asked: 2016-02-16 23:26:33 +0800 CST

Prevent apache user from viewing server root directory

  • 772

This is not a question related to Indexes or folder browsing. It is about permissions.

If I execute:

if ($handle = opendir('/')) {

    while (false !== ($entry = readdir($handle))) {

        if ($entry != "." && $entry != "..") {

            echo "$entry\n";
        }
    }

    closedir($handle);
}

I can see /etc, /proc, /dev, /home, /root, /usr, /lib/, /bin, /sbin directories. This means that if a website is hacked, the hacker can see all my tree files from root on.

How can I limit the apache user to be able to see only the apache root document directory, for example /var/www/ and all the files inside it but not the /var/www parent directory?

apache-2.4

1 Answers

  1. You have to setup chroot environment for apache. There's a good tutorial here: http://www.tldp.org/LDP/solrhe/Securing-Optimizing-Linux-RH-Edition-v1.3/chap29sec254.html

    • 1