question on the symlinks vunerability

durangod

• July 20, 2014 18:39

It says that the symlinks vulnerability is when you have both followsymlinks and SymLinksIfOwnerMatch turned on (enabled). Well if i just turn SymLinksIfOwnerMatch off (disable) by in apache config, wont that take care of this without having to do all this other stuff im reading about? I certainly dont know it all but in my use i have only personally seen and used followsymlinks anyway and i dont think the average user would even know about SymLinksIfOwnerMatch or even use it. Would that work?

• 

  cPanelMichael

  • July 21, 2014 19:00

  Hello :) This is addressed on the following thread: Solutions for handling symlink attacks I've linked to the post where a list of solutions is available. Please direct any questions on the topic to that particular thread. Thank you.

  0
• 

  quizknows

  • July 21, 2014 20:22

  Definitely reference that other thread. However, what you WANT is symlinksifownermatch. Normal +followsymlinks is the issue; people can use apache to read other peoples config files without additional security precautions. Even if you disable +followsymlinks, normally users could just re-enable it in their own .htaccess, and many CMSes rely on that being on. If you use SuPHP, the "symlink race condition protection" in EasyApache is good enough IMO.

  0

Please sign in to leave a comment.