1 |
Zane W wrote: |
2 |
|
3 |
> I just re-read your original post. You should be able to do a similar |
4 |
> thing with whatever web application you are using to set the umask for |
5 |
> uploaded files. |
6 |
|
7 |
But how? I don't find on the Internet how to change the default |
8 |
permission for apache uploaded file. |
9 |
|
10 |
Besides, I wish to know *how dangerous* it is to let user 'apache' login |
11 |
through ssh by using public/private key. If it is not dangerous, perhaps |
12 |
I could just keep my way as it is? |
13 |
|
14 |
> Zane W wrote: |
15 |
> |
16 |
>> change the umask on your ftpd server to something like 133:022, and |
17 |
>> new files uploaded will have permissions of 644 with directories |
18 |
>> getting 755. this should allow your script to work without problems |
19 |
>> |
20 |
>> z |
21 |
>> Zhang Weiwu wrote: |
22 |
>> |
23 |
>>> Hello. I am using a script tool to backup the apache uploaded files |
24 |
>>> (through ssh) on the web server. These files resident in a folder |
25 |
>>> that belongs to 'apache' user. Each time a user upload a file within |
26 |
>>> the web application, the uploaded file stays in that folder with mod |
27 |
>>> 700. |
28 |
>>> |
29 |
>>> Because only apache user could read that file (700 permission), it |
30 |
>>> makes it difficult to receive the files through ssh. This is what I |
31 |
>>> did: |
32 |
>>> 1) on the backup box (not the web server), create user apache, |
33 |
>>> generate dsa key pair for it. |
34 |
>>> 2) on the web server, create /home/httpd, put the public key of |
35 |
>>> apache@backup_box in ~apache/.ssh/authorized_keys |
36 |
>>> 3) on the web server, allow apache user login (by changing its shell |
37 |
>>> from /bin/false to /bin/bash) |
38 |
>>> 4) run the backup script on the backup box as apache. |
39 |
>>> |
40 |
>>> This raises a security problem. apache user being to be able to |
41 |
>>> login through ssh. I am not very experienced to tell how dangerous |
42 |
>>> this could be. I think I am not going to suffer from ssh dictionary |
43 |
>>> attack, very simple reason: user apache (should) have no password, |
44 |
>>> and ssh password login is turned off on web server. However, is |
45 |
>>> there any other risks that could be caused by setting apache user's |
46 |
>>> login shell to bash? |
47 |
>>> |
48 |
>>> Another idea might be changing all the uploaded file permission to |
49 |
>>> something like 740, but new files are uploaded every day, they are |
50 |
>>> automatically given permission 700. |
51 |
>>> |
52 |
>>> Thank you! |
53 |
>>> |
54 |
>> |
55 |
>> |
56 |
> |