Re: scp permissions problem



stephen.mayer@xxxxxxxxx <stephen.mayer@xxxxxxxxx> wrote:
This really is a file permissions problem ... although I'm not sure how
to solve it. Any assistance would be greatly appreciated.

I'd call it a user identity problem rather than a file permissions problem.

1) User submits file to www1 server
2) www1 server saves file with permissions showing user "www" is the
owner, dir owner is the group for the file ("sg" in this case).
3) cron script on www1 scp's the file to www2 server.
3a) cron executes scp -p origfile sg@www2:destfile
3b) destfile appears on www2 with ownership sg/sg, same permissions as
origfile

What is your reason for having www own the incoming file and sg own the
copy?

All of this works great up until the following happens ...
4) User resubmits the file to www2 server
5) www2 attempts to update file located on www2 server with new
version, but cannot modify file (attempting to overwrite a file owned
by sg/sg with a file to be owned by www/sg).

Right, this won't work. You've set it up so that uploaded files are writable
by a different user than copied files, but both go to the same place. Fix the
design :)

Option 1: only allow uploads to www1. They'll all be owned by www, and the
mirrors will all be owned by sg, there's never a conflict.
Option 2: scp the file as "www" rather than "sg", so all the files are always
owned by "www".
Option 3: create a different upload area than the copy area - uploaded files
go to uploads/ owned by "www", and copies on all machines (including the
upload machine, scp'd to itself) can be owned by "sg".
--
Mark Rafn dagon@xxxxxxxxx <http://www.dagon.net/>
.



Relevant Pages

  • Re: File Upload - Security Issues
    ... You want to upload a file for what reason and ... these viruses have less chance of being able to execute (even if succeeded ... :> file and what pitfalls you see re: security might be helpful on this ... :>: files to an IIS server that doesn't have MS Office actually installed? ...
    (microsoft.public.scripting.vbscript)
  • Re: File Upload - Security Issues
    ... uploaded and the user could upload any or all of these in theory. ... There is no one product that can give you 100% security, ... > Code doesn't execute in local memory space unless remote user has rights ... > You don't have MS Office installed on the server. ...
    (microsoft.public.scripting.vbscript)
  • pure-ftp nologin
    ... I have a server running FreeBSD 6.3. ... # If you want to enable PAM authentication, ... AnonymousCanCreateDirs no ... # Disallow anonymous users to upload new files ...
    (comp.unix.bsd.freebsd.misc)
  • [NT] DeskNow Mail and Collaboration Server Directory Traversal Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Collaboration Server is "a full-featured and integrated mail and instant ... attachment upload feature that may be exploited to upload files to ... * DeskNow Mail and Collaboration Server version 2.5.12 and prior ...
    (Securiteam)
  • Re: [Full-disclosure] phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit.
    ... app that allows the user to upload an image of some type. ... Internet Explorer ignores the content type sent by the web server and ... > HTML code instead. ... > upload it as a phpBB avatar. ...
    (Full-Disclosure)