1

I have created ftp-server using pure-ftpd following this wonderful tutorial. Everything works fine, except file access. Here is the problem.

Joe's home folder is /var/www/joe and Steve's home folder is /var/www/steve. When they log on to the ftp server they enter to their home folders and they cann't access folders of other users. But when Joe's writes a script in PHP in order to access Steve's file, he can access it. For instance, this script works fine for Joe:

$filename = "/var/www/steve/somefile";
$handle = fopen($filename, "r");
$contents = fread($handle, filesize($filename));
echo $contents;

Is it the problem of the ftp-server or the problem of apache's virtual-host file?

How can I solve this problem please? It is very urgent because it touches the security issue of the users.

Thank you beforehand!

Bakhtiyor
  • 12,804

1 Answers1

1

The problem is the HTTP server since (by default) scripts are run as the www-data user.

To continue your analogy, Steve likely has file permissions for /var/www/steve/somefile set to 755 - which grants read and execute permissions to any user. Because Apache executes PHP scripts as the www-data user, PHP scripts won't encounter any problems accessing the file.

Steve can prevent others from seeing his file by running the following command:

chmod 700 /var/www/steve/somefile

This will prevent other users (except for root of course) from being able to access the file. Note that the same problem applies to directories and because of this, other users may be able to see that the file exists (though they won't be able to read its contents).

Some FTP clients provides means of changing file permissions, so I would encourage you to consult the manual for your FTP client.

Tools such as Apache suEXEC will cause the PHP script to be executed under the user's actual account - but of course it won't protect against the vulnerability you're referring to.

Nathan Osman
  • 32,495