1 |
change the umask on your ftpd server to something like 133:022, and new |
2 |
files uploaded will have permissions of 644 with directories getting |
3 |
755. this should allow your script to work without problems |
4 |
|
5 |
z |
6 |
Zhang Weiwu wrote: |
7 |
|
8 |
> Hello. I am using a script tool to backup the apache uploaded files |
9 |
> (through ssh) on the web server. These files resident in a folder that |
10 |
> belongs to 'apache' user. Each time a user upload a file within the |
11 |
> web application, the uploaded file stays in that folder with mod 700. |
12 |
> |
13 |
> Because only apache user could read that file (700 permission), it |
14 |
> makes it difficult to receive the files through ssh. This is what I did: |
15 |
> 1) on the backup box (not the web server), create user apache, |
16 |
> generate dsa key pair for it. |
17 |
> 2) on the web server, create /home/httpd, put the public key of |
18 |
> apache@backup_box in ~apache/.ssh/authorized_keys |
19 |
> 3) on the web server, allow apache user login (by changing its shell |
20 |
> from /bin/false to /bin/bash) |
21 |
> 4) run the backup script on the backup box as apache. |
22 |
> |
23 |
> This raises a security problem. apache user being to be able to login |
24 |
> through ssh. I am not very experienced to tell how dangerous this |
25 |
> could be. I think I am not going to suffer from ssh dictionary attack, |
26 |
> very simple reason: user apache (should) have no password, and ssh |
27 |
> password login is turned off on web server. However, is there any |
28 |
> other risks that could be caused by setting apache user's login shell |
29 |
> to bash? |
30 |
> |
31 |
> Another idea might be changing all the uploaded file permission to |
32 |
> something like 740, but new files are uploaded every day, they are |
33 |
> automatically given permission 700. |
34 |
> |
35 |
> Thank you! |
36 |
> |