0

I run several systems with hundreds of home directories (a custom web hosting setup, where third parties can have control of certain accounts).

Currently any user could SSH in (or via a script) do "ls /home" and see all the accounts on the server. They can't do anything with that information of course, "ls /home/user" would fail, however I'm wondering how "ls /home" could just show the current user's folder.

I've seen a few exploit attempts in the past (clients with insecure code/bad passwords - another topic) where the attacker makes a folder in one account, and then makes an array of symlinks looking at other home folders and trying to guess for sensitive file locations and hoping permissions are weak somewhere. By hiding "ls /home" this would frustrate them and I don't think they usually try too many other techniques.

Just an additional safety net, ideally without going down the path of chroot or jails. It's mostly just to break automated scripts if someone did gain access. The permissions are secure so users only have read/write access inside their own home folder.

2 Answers 2

1

Currently any user could SSH in (or via a script) do "ls /home" and see all the accounts on the server. They can't do anything with that information of course, "ls /home/user" would fail, however I'm wondering how "ls /home" could just show the current user's folder.

Remove the 'read' permission from /home with chmod go-r.

(Make sure to keep the 'execute' permission, however, as it is needed to let users themselves access their home directories. That is, /home must be rwx --x --x at minimum.)

This is not very useful if you still give full interactive SSH access. It would be much more useful to limit your users to only SFTP and Git somehow.

By hiding "ls /home" this would frustrate them and I don't think they usually try too many other techniques

They'll just read /etc/passwd to get the list of users.

I've seen a few exploit attempts in the past (clients with insecure code/bad passwords - another topic) where the attacker makes a folder in one account, and then makes an array of symlinks looking at other home folders and trying to guess for sensitive file locations and hoping permissions are weak somewhere. By hiding "ls /home" this would frustrate them and I don't think they usually try too many other techniques.

Fix the actual problem by not letting all your webapps run under the same "www-data" account – if each webapp has its own UID (and e.g. its own php-fpm pool under that UID), then you'll be able to enforce that the website directories are not publicly accessible, via symlinks or not.

(I don't actually know how to do this with regular webservers for static files.)

2
  • You can do this quite easily with Apache and mpm-itk module - and in fact you can set it up so it all runs off userid's (and tie in a database driven FTP server) - even without users in a password file or otherwise enumerated. Of-course once you allow terminal access all bets are off.
    – davidgo
    Jul 20, 2021 at 9:36
  • Ah so the read permission on /home is what controls it, although that would prevent "ls /home" from working at all, not just making it return that user's home folder. I do already run each hosting account with different users, and each user is a member of the www-data group so Apache still has access across the different accounts.
    – Nick
    Jul 20, 2021 at 20:11
0

This is an uphill battle. The general solution is to use chroot jails and/or custom shells. Doing this does have limitations though.

IMHO, allowing shell access opens up a large can of security worms, and I wonder if you are undereatimating the risks of shell access.

1
  • Oh it's always an uphill battle between giving clients access they want vs keeping everything locked down. This is mostly an idea to explore as I've seen automated scripts that look at /home so if they can't see it any more then these automated scripts don't work as well - I know /etc/passwd and other methods would still show user info.
    – Nick
    Jul 20, 2021 at 20:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .