Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have a webserver with Apache ITK, configured for a specific vhost to use a specific username within it's folder. Now, this user is an owner of the files, but has no write permissions in the folder in question, however yesterday, the site has been compromised and two files with write permission have just appeared in the folder.

My question is: How?

I understand that if a website is compromised, a lot can happen, but the website is still running from within the context of that username, which simply did not have permission to write any files to that folder. Or am I understanding permissions incorrectly?

share|improve this question

1 Answer 1

You're forgetting the key flaw with ITK... The main process (that handles all the child processes) is running as root.

If you can attack Apache early on in the process, (rather than than an exploited php script), the hacker has root. Kansas is going bye-bye.

I'm not a security expert but ITK seems like a giant liability in exchange for slightly more simple configuration.

share|improve this answer
    
Well asuming of course ITK itself has a vulenrability, which is relatively unlikely (the PHP script in question is significantly more vulenrable). However, I am unaware of an alternative to ITK that allows each vhost to run it's own username? You seem to know what it is? –  DustWolf Aug 23 '13 at 10:43
    
There are a few techniques but I think my favourite is a reverse proxy. For each user you start up independent servers, either on a socket or local predetermined port. And then you have a have a server on port 80 running as nobody that connects the domain request to users' servers. Here is a very simple example with Apache. How you manage that is up to you but it offers complete separation, securely. If you want to see a real world example, create an account with djangoeurope.com (no relation) and see how they do it. –  Oli Aug 23 '13 at 11:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.