Security – Apache Uploads and Security

apache-2.2Securityupload

Recently it has become an issue that a user on one of our systems needs the ability to have the apache user have read and write capability to their site so that the upload portion of their site works correctly. How would you minimize the risk of somebody malicious going in and submitting a file that ends up being able to delete files in the web directory or worse yet taking over the apache daemon?

The only solution I have been able to come up with is to create a subfolder for the site that apache can read and write to but can only read parent directories. With sanity checks (like file foo.zip) and file checks being done on the uncompressed uploaded data and then having the file being renamed and meta data being added to the file to track it internally for the site before being moved into a folder that is not writable by apache and only readable.

Or am I just being paranoid?

Best Answer

Your paranoia is valid.

The security issues that come from uploading files in Apache are based on an uploaded .htaccess file that can change permissions or give the user access to the Apache config files.

Much of the prevention for this problem can be solved by first properly securing Apache and its config files. Ensure that Apache runs in an entirely different directory (I use a different hard drive just in case) than public files. Then secure the directory:

This S.O. question gives some insight into permissions to allow uploads to work: https://stackoverflow.com/questions/10990/what-are-the-proper-permissions-for-an-upload-folder-with-php-apache
This article gives some insight to Remote File Upload attacks: http://www.linuxforu.com/how-to/security/securing-apache%E2%80%94part-9/
I also recommend only allowing certain files to upload using a REGEX check, example: http://www.webdeveloper.com/forum/showthread.php?t=183015

If you program using PHP, I would also do some extra checks to make sure that scripts cannot be run from the upload folder. Basically, disable PHP (or other modules) from executing when accessed inside that folder.

There's plenty more resources across Google that I recommend checking out. I hope this helps.

Related Solutions

Security – Puppet Security and Network Topologies

Because i sometimes store passwords in variables in my modules, to be able to deploy applications without having to finish configuration manually, it means that i can not decently put my puppet repo on a public server. Doing so would mean that attacking the puppetmaster would permit to gain some app or db passwords of all our different applications on all our servers.

So my puppetmaster is in our office private network, and i do not run puppetd daemon on the servers. When i need to deploy, i use ssh from private net to servers, creating a tunnel and remotely calling puppetd.
The trick is not to set the remote tunnel and puppet client to connect to the puppetmaster, but to a proxy that accept http connect and can reach the puppetmaster server on private network. Otherwise puppet will refuse to pull because of hostname conflict with certificates

# From a machine inside privatenet.net :
ssh -R 3128:httpconnectproxy.privatenet.net:3128 \
    -t remoteclient.publicnetwork.net \
    sudo /usr/sbin/puppetd --server puppetmaster.privatenet.net \
    --http_proxy_host localhost --http_proxy_port 3128 \
    --waitforcert 60 --test –-verbose

It works for me, hopes it helps you

Security – Our security auditor is an idiot. How to give him the information he wants

First, DON'T capitulate. He is not only an idiot but DANGEROUSLY wrong. In fact, releasing this information would violate the PCI standard (which is what I'm assuming the audit is for since it's a payment processor) along with every other standard out there and just plain common sense. It would also expose your company to all sorts of liabilities.

The next thing I would do is send an email to your boss saying he needs to get corporate counsel involved to determine the legal exposure the company would be facing by proceeding with this action.

This last bit is up to you, but I would contact VISA with this information and get his PCI auditor status pulled.

Best Answer

Related Solutions

Security – Puppet Security and Network Topologies

Security – Our security auditor is an idiot. How to give him the information he wants

Related Topic