How to find and prevent symlink attack
Posted: Wed Apr 24, 2013 12:37 pm
How to find if there is a symlink attack :
Symlink attack can be prevented to an extend by editing the below lines in apache configuration file. Each server might have a different value depending on how apache was configured and you can change that to :ls /var/cpanel/users | grep -v "\`\|\.\|cpanel\|root\|mysql\|nobody" | while read CPUSER; do find /home/$CPUSER -type l -not \( -lname "/home/$CPUSER/*" -o -lname "*rvsitebuilder*" -o -lname "[^/]*" -o -lname "/usr/local/apache/domlogs/*" -o -lname "/usr/local/urchin/*" \) ; done
<Directory "/">
Options ExecCGI -FollowSymLinks Includes IncludesNOEXEC Indexes -MultiViews SymLinksIfOwnerMatch
AllowOverride AuthConfig FileInfo Limit Indexes Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,SymLinksIfOwnerMatch,MultiViews
</Directory>