Set up directory traversal barrier

Question

I'm trying to make my web server more secure, right now i'm attempting to put up a sort of "barrier" against directory traversal so a malicious user could not pass this if they found a way to perform such an attack.

The way I'm trying to do this is by having a folder layout as such: ( www being the furthest apache is allowed to go.)

/www/public_html/ #public contents
    / #private contents

I've found a way to deny all access after the web root, but i need things like PHP to be able to access private files like this

include '../private_file.php';

This is what i have so far in apache2.conf:

<Directory />
   Order Deny,Allow
   Deny from all
   Options None
   AllowOverride None
</Directory>

<Directory /www/public_html>
   Order Allow,Deny
   Allow from all
</Directory>

Does anyone know how I could do this?

user149341 · Accepted Answer · 2014-07-23 21:17:34Z

1

<Directory> restrictions only control access over HTTP, not access by scripts running in the web server. They're not what you want here.

What you're looking for is the PHP open_basedir configuration option.

answered Jul 23, 2014 at 21:17

user149341

Sign up to request clarification or add additional context in comments.

1 Comment

Paradoxis Over a year ago

Thank you so much! Saved me from going insane after Googling it for 3 hours

Collectives™ on Stack Overflow

Set up directory traversal barrier

1 Answer 1

1 Comment

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Related