[gentoo-server] smart way to backup apache uploaded files.

[Zhang Weiwu]

Hello. I am using a script tool to backup the apache uploaded files 
(through ssh) on the web server. These files resident in a folder that 
belongs to 'apache' user. Each time a user upload a file within the web 
application, the uploaded file stays in that folder with mod 700.

Because only apache user could read that file (700 permission), it makes 
it difficult to receive the files through ssh. This is what I did:
1) on the backup box (not the web server), create user apache, generate 
dsa key pair for it.
2) on the web server, create /home/httpd, put the public key of 
apache@backup_box in ~apache/.ssh/authorized_keys
3) on the web server, allow apache user login (by changing its shell 
from /bin/false to /bin/bash)
4) run the backup script on the backup box as apache.

This raises a security problem. apache user being to be able to login 
through ssh. I am not very experienced to tell how dangerous this could 
be. I think I am not going to suffer from ssh dictionary attack, very 
simple reason: user apache (should) have no password, and ssh password 
login is turned off on web server. However, is there any other risks 
that could be caused by setting apache user's login shell to bash?

Another idea might be changing all the uploaded file permission to 
something like 740, but new files are uploaded every day, they are 
automatically given permission 700.

Thank you!