Apache configuration. How to forbid root folders viewing

apache

I've added VirtualHost

ServerAdmin root@localhost
DocumentRoot /var/www/html/blogovet.ru
ServerName www.blogovet.ru
ServerAlias blogovet.ru

But my script in this domain can see all server files /* not only in his directory /var/www/html/blogovet.ru

How to forbid viewing files except DocumentRoot ?

Best Answer

A script will be able to read all files that the user running the script can read. So you should make sure your web server does not run as root (it needs to be started as root to listen on port 80, but should swich user to e.g. "www" itself), and then make sure that that user can't read any sensible files.

You could also use SElinux for an extra layer of security.

Related Topic