preventing users from browsing filesystem

pernest · 11-05-2010, 04:19 PM

Hi

What methods exits to restrict which directories a user may browse on the filesystem. I want to prevent php scripts from being able to view system files. I've seen two solutions, but neither are satisfactory:

Chrooting a directory that the script is in, but this requires that all the necessary php libraries/files are moved/copied into the right place relative to the chroot directory. I don't feel that I have the technical ability to achieve this.
Putting php into safe mode and disabling *nasty* php functions. But this is ineffective if just one obscure *bad* php function is missed.

CoffeeKing!!! · 11-05-2010, 04:48 PM

Use the chmod command. Here's a breif consise tutorial. http://catcode.com/teachmod/

Chmod is very easy to use. Although there are othe methods like access control lists that you can use as well, chmod is the best place to start.

pernest · 11-05-2010, 05:22 PM

Hi, and thanks for the response. Are you suggesting that I chomod the whole file system "chmod -R o-rwx"? Wouldn't this break stuff?

Basically if you created a new user, could you deny the whole filesystem to that users, everything under / accept for one specific location, say /var/www/http_docs

Like I said in my original post, I'm not confident to set up a chroot gaol with all the nessesary php files inside.

Quote:

Originally Posted by CoffeeKing!!!

Use the chmod command. Here's a breif consise tutorial. http://catcode.com/teachmod/

Chmod is very easy to use. Although there are othe methods like access control lists that you can use as well, chmod is the best place to start.

Web31337 · 11-05-2010, 05:32 PM

method 1(hard, though effective): chrooting PHP. described here and here.
method 2(easy): use open_basedir restriction.
method 3(easiest): chmod. To prevent other users from BROWSING(reading contents of directory) use chmod o-r. man chmod is a way to go.

pernest · 11-05-2010, 06:09 PM

Obviously its possible set the global read bit to 0 for every single file on the filessystem, but will this leave the machine in a working state? I would have thought that there are various bits and bobs that need the global read bit set on filesytem files in order to do their jobs properly.

Quote:

Originally Posted by Web31337

method 3(easiest): chmod. To prevent other users from BROWSING(reading contents of directory) use chmod o-r. man chmod is a way to go.

anomie · 11-09-2010, 10:48 AM

Quote:

Originally Posted by Web31337

method 2(easy): use open_basedir restriction.

+1

This is the purpose of open_basedir.