| 1 |
Zane W wrote: |
| 2 |
|
| 3 |
> I just re-read your original post. You should be able to do a similar |
| 4 |
> thing with whatever web application you are using to set the umask for |
| 5 |
> uploaded files. |
| 6 |
|
| 7 |
But how? I don't find on the Internet how to change the default |
| 8 |
permission for apache uploaded file. |
| 9 |
|
| 10 |
Besides, I wish to know *how dangerous* it is to let user 'apache' login |
| 11 |
through ssh by using public/private key. If it is not dangerous, perhaps |
| 12 |
I could just keep my way as it is? |
| 13 |
|
| 14 |
> Zane W wrote: |
| 15 |
> |
| 16 |
>> change the umask on your ftpd server to something like 133:022, and |
| 17 |
>> new files uploaded will have permissions of 644 with directories |
| 18 |
>> getting 755. this should allow your script to work without problems |
| 19 |
>> |
| 20 |
>> z |
| 21 |
>> Zhang Weiwu wrote: |
| 22 |
>> |
| 23 |
>>> Hello. I am using a script tool to backup the apache uploaded files |
| 24 |
>>> (through ssh) on the web server. These files resident in a folder |
| 25 |
>>> that belongs to 'apache' user. Each time a user upload a file within |
| 26 |
>>> the web application, the uploaded file stays in that folder with mod |
| 27 |
>>> 700. |
| 28 |
>>> |
| 29 |
>>> Because only apache user could read that file (700 permission), it |
| 30 |
>>> makes it difficult to receive the files through ssh. This is what I |
| 31 |
>>> did: |
| 32 |
>>> 1) on the backup box (not the web server), create user apache, |
| 33 |
>>> generate dsa key pair for it. |
| 34 |
>>> 2) on the web server, create /home/httpd, put the public key of |
| 35 |
>>> apache@backup_box in ~apache/.ssh/authorized_keys |
| 36 |
>>> 3) on the web server, allow apache user login (by changing its shell |
| 37 |
>>> from /bin/false to /bin/bash) |
| 38 |
>>> 4) run the backup script on the backup box as apache. |
| 39 |
>>> |
| 40 |
>>> This raises a security problem. apache user being to be able to |
| 41 |
>>> login through ssh. I am not very experienced to tell how dangerous |
| 42 |
>>> this could be. I think I am not going to suffer from ssh dictionary |
| 43 |
>>> attack, very simple reason: user apache (should) have no password, |
| 44 |
>>> and ssh password login is turned off on web server. However, is |
| 45 |
>>> there any other risks that could be caused by setting apache user's |
| 46 |
>>> login shell to bash? |
| 47 |
>>> |
| 48 |
>>> Another idea might be changing all the uploaded file permission to |
| 49 |
>>> something like 740, but new files are uploaded every day, they are |
| 50 |
>>> automatically given permission 700. |
| 51 |
>>> |
| 52 |
>>> Thank you! |
| 53 |
>>> |
| 54 |
>> |
| 55 |
>> |
| 56 |
> |
Archives