title: NGINX - Prevent directory traversal attack
body: <p>I am configuring my web server by my self first time. </p>
  
  <ul>
  <li>Ubuntu, NGINX, PHP, SASS etc. installed with latest updates</li>
  <li>Created own user account so i don't have to use root everywhere</li>
  <li>Checked that i don't have unneeded ports open</li>
  <li>Created own folders to every domain</li>
  <li>Every domain runs on own sock on PHP5-fpm pool, with own username</li>
  </ul>
  
  <p>My folder structure is like this:</p>
  
  <p>/var/www/sites/exampledomain1/public/</p>
  
  <p>/var/www/sites/exampledomain2/public/</p>
  
  <p>/var/www/sites/exampledomain2/public/</p>
  
  <p>I made "test.txt" files to every public folder and to /var/, /var/www/. Then i made simple php file that tries to include test.txt files from different places, and i also tried to include /etc/passwd. And it was my "pleasure" to notice that i could include all files in my public PHP file, even /etc/passwd file.</p>
  
  <p>I created "domain" users and put those only to www-data group. Everything but www/.. is untouched so /var/passwd etc is root:root. </p>
  
  <p>/var/www/  755  www-data:www-data</p>
  
  <p>/var/www/sites/  755  www-data:www-data</p>
  
  <p>/var/www/sites/exampledomain1/  711  exampledomain1:www-data</p>
  
  <p>/var/www/sites/exampledomain2/  711  exampledomain2:www-data</p>
  
  <p>/var/www/sites/exampledomain3/ 711 exampledomain3:www-data</p>
  
  <p>/var/www/sites/exampledomain1/public  711  exampledomain1:www-data</p>
  
  <p>/var/www/sites/exampledomain2/public  711  exampledomain2:www-data</p>
  
  <p>/var/www/sites/exampledomain3/public 711 exampledomain3:www-data</p>
  
  <p>At the moment all index.php files are with 701. Owner can read, write and execute, user on same group cant do anything, and public can execute. </p>
  
  <p>My goal is that you cannot include anything from other folders. So if one of my domain has exploit and hacked/cracker can run own code, so it cant include any files from other domains OR from deeper.</p>