Re: [gentoo-server] smart way to backup apache uploaded files.

[Zane W]

I just re-read your original post.  You should be able to do a similar 
thing with whatever web application you are using to set the umask for 
uploaded files. 

Zane W wrote:

> change the umask on your ftpd server to something like  133:022, and
> new files uploaded will have permissions of 644 with directories
> getting 755.  this should allow your script to work without problems
>
> z
> Zhang Weiwu wrote:
>
>> Hello. I am using a script tool to backup the apache uploaded files
>> (through ssh) on the web server. These files resident in a folder
>> that belongs to 'apache' user. Each time a user upload a file within
>> the web application, the uploaded file stays in that folder with mod
>> 700.
>>
>> Because only apache user could read that file (700 permission), it
>> makes it difficult to receive the files through ssh. This is what I did:
>> 1) on the backup box (not the web server), create user apache,
>> generate dsa key pair for it.
>> 2) on the web server, create /home/httpd, put the public key of
>> apache@backup_box in ~apache/.ssh/authorized_keys
>> 3) on the web server, allow apache user login (by changing its shell
>> from /bin/false to /bin/bash)
>> 4) run the backup script on the backup box as apache.
>>
>> This raises a security problem. apache user being to be able to login
>> through ssh. I am not very experienced to tell how dangerous this
>> could be. I think I am not going to suffer from ssh dictionary
>> attack, very simple reason: user apache (should) have no password,
>> and ssh password login is turned off on web server. However, is there
>> any other risks that could be caused by setting apache user's login
>> shell to bash?
>>
>> Another idea might be changing all the uploaded file permission to
>> something like 740, but new files are uploaded every day, they are
>> automatically given permission 700.
>>
>> Thank you!
>>
>
>