Re: [gentoo-server] smart way to backup apache uploaded files.

[Zane W]

change the umask on your ftpd server to something like  133:022, and new 
files uploaded will have permissions of 644 with directories getting 
755.  this should allow your script to work without problems

z
Zhang Weiwu wrote:

> Hello. I am using a script tool to backup the apache uploaded files
> (through ssh) on the web server. These files resident in a folder that
> belongs to 'apache' user. Each time a user upload a file within the
> web application, the uploaded file stays in that folder with mod 700.
>
> Because only apache user could read that file (700 permission), it
> makes it difficult to receive the files through ssh. This is what I did:
> 1) on the backup box (not the web server), create user apache,
> generate dsa key pair for it.
> 2) on the web server, create /home/httpd, put the public key of
> apache@backup_box in ~apache/.ssh/authorized_keys
> 3) on the web server, allow apache user login (by changing its shell
> from /bin/false to /bin/bash)
> 4) run the backup script on the backup box as apache.
>
> This raises a security problem. apache user being to be able to login
> through ssh. I am not very experienced to tell how dangerous this
> could be. I think I am not going to suffer from ssh dictionary attack,
> very simple reason: user apache (should) have no password, and ssh
> password login is turned off on web server. However, is there any
> other risks that could be caused by setting apache user's login shell
> to bash?
>
> Another idea might be changing all the uploaded file permission to
> something like 740, but new files are uploaded every day, they are
> automatically given permission 700.
>
> Thank you!
>