{"id":2530,"date":"2014-08-12T09:53:44","date_gmt":"2014-08-12T13:53:44","guid":{"rendered":"http:\/\/blog.litespeedtech.com\/?p=2530"},"modified":"2014-08-12T09:53:44","modified_gmt":"2014-08-12T13:53:44","slug":"unique-litespeed-features-fight-symbolic-link-hacking","status":"publish","type":"post","link":"https:\/\/lswp.store\/index.php\/2014\/08\/12\/unique-litespeed-features-fight-symbolic-link-hacking\/","title":{"rendered":"Unique LiteSpeed Features Fight Symbolic Link Hacking"},"content":{"rendered":"

\"Broken<\/a><\/p>\n

LSWS boasts two unique features that block symlink hacks: a\u00a0Follow Symbolic Link setting that cannot be overridden in .htaccess files and strict ownership checking.<\/p>\n

The Dangers of Symlink Hacking<\/h3>\n

The ways that a hacker can get unwarranted access to a server through symbolic links have been thoroughly covered in articles<\/a> and forum threads<\/a> on many other sites. Hackers using symlinks escalate privileges\u00a0is a basic and widespread security issue.<\/p>\n

.htaccess Immune Ownership Checking<\/h3>\n

This is an old trick for Apache users. Setting our Follow Symbolic Link setting<\/a> to “If Owner Match” causes the server to only follow symlinks if the owner of the link and the target are the same. This is essentially the same as Apache’s SymLinksIfOwnerMatch option, but with one big difference: LSWS’s Follow Symbolic Link setting cannot be overridden in an .htaccess file.<\/strong> This means that, unlike with Apache, you can allow .htaccess overrides without worrying that users will bypass this basic symlink ownership checking.<\/p>\n

LiteSpeed recommends that all shared hosting providers set Follow Symbolic Link (WebAdmin console > Server > Security > Follow Symbolic Link) to “If Owner Match.”<\/strong><\/p>\n

Force Strict Ownership Checking<\/h3>\n

As noted in Apache’s documentation,\u00a0symlink testing is subject to race conditions that make it circumventable<\/a>. Specifically, this testing is vulnerable to\u00a0time-of-check-to-time-of-use (TOCTTOU) attacks<\/a>. A TOCTTOU attack involves changing the target location after it has been checked (by changing a symlink after the ownership check) but before a file has been opened. In order to prevent this kind of exploit, LiteSpeed has\u00a0the Force Strict Ownership Checking setting<\/a>. Force Strict Ownership Checking prevents TOCTTOU attacks by checking the owner of the file as\u00a0the file is opened <\/strong>(when there is no chance for substitution).\u00a0This feature is similar to CloudLinux’s SecureLinks functionality<\/a>.<\/p>\n

LiteSpeed also recommends that all shared hosting providers turn on Force Strict Ownership Checking\u00a0(WebAdmin console > Server > Security > Force Strict Ownership Checking<\/strong>)\u00a0<\/strong>unless you are using CloudLinux SecureLinks.<\/p>\n

These settings are just one facet of LiteSpeed Web Server’s top-of-the-line security features. If you wish to learn more about security with LSWS, see the security features section<\/a> of our site.<\/p>\n","protected":false},"excerpt":{"rendered":"

LSWS boasts two unique features that block symlink hacks: a\u00a0Follow Symbolic Link setting that cannot be overridden in .htaccess files and strict ownership checking.<\/p>\n","protected":false},"author":1,"featured_media":2542,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[27,23],"tags":[35],"class_list":["post-2530","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-web-server","category-security","tag-anti-hacking"],"jetpack_featured_media_url":"https:\/\/lswp.store\/wp-content\/uploads\/2014\/08\/brokenchain-hi.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/lswp.store\/index.php\/wp-json\/wp\/v2\/posts\/2530","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lswp.store\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lswp.store\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lswp.store\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lswp.store\/index.php\/wp-json\/wp\/v2\/comments?post=2530"}],"version-history":[{"count":0,"href":"https:\/\/lswp.store\/index.php\/wp-json\/wp\/v2\/posts\/2530\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lswp.store\/index.php\/wp-json\/wp\/v2\/media\/2542"}],"wp:attachment":[{"href":"https:\/\/lswp.store\/index.php\/wp-json\/wp\/v2\/media?parent=2530"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lswp.store\/index.php\/wp-json\/wp\/v2\/categories?post=2530"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lswp.store\/index.php\/wp-json\/wp\/v2\/tags?post=2530"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}