Apache php upload secutity

cybermatthieu · Tux's lil' helper Joined: 07 Jul 2004 Posts: 77

Hi everyone!
I'm just playing around with php's upload feature and i'm wondering if it's a good thing to have a temporary folder that can be executed by the users (777 rwxrwxrwx). What is the most secure way to have an upload folder.

Thanks,
Matthieu

andyjeffries · Posted: Mon Mar 14, 2005 7:58 am Post subject: Re: Apache php upload secutity

tukachinchila · Apprentice Joined: 11 Mar 2005 Posts: 274 Location: Oregon

Having the directory set as executable is fine, but it would be a terrible idea to allow both world write and world execute on any files. Setting the directory to 755 would be better than 777. I would be very careful about using php's upload functions. If you're going to do that, run apache inside a chroot jail and use "hardenedphp" in your USE flags. I would also put the upload directory on a seperate partition and mount it noexec, nosuid, nodev and use one of the hardened kernel sources so you get extra restrictions on the chroot jail from grsecurity.
Make sure there's no sensitive data on the webserver. The web server should also be on a seperate network from any other computers. There's probably some other things I would do, but that's all I can think of right now.

cybermatthieu · Tux's lil' helper Joined: 07 Jul 2004 Posts: 77

Thanks all!

I think that will do. My tmp folder is already on a seperate partition I'm i'll put the rights 754 for apache and root users.

Thanks for the quick post!

Matthieu