Newsgroup: it.comp.os.linux.iniziare
Titolo: Apache via SSH, problemi sicurezza?

Vorrei dare una password all'utente Apache per entrare 
via SSH e uploadare file.
Così questi file risulterebbero creati da apache. Questo 
mi faciliterebbe le cose perché ho applicazioni web che 
creano/modificano/cancellano file ovviamente girando con 
utente apache e incontrano problemi (non possono 
scrivere/cancellare) su file inviati via SSH da un altro 
utente.
Cosa ne dite? Ci sono problemi di sicurezza dietro 
questa ipotesi oppure posso fare?
Il sistema è gestito da me. Io mando i file via ssh. 
Nessun'altra persona ha account sul sistema.
Grazie.

 questa ipotesi oppure posso fare?
Non credo che ci siano problemi, ma perché non ti limiti a cambiare il
proprietario dei file con chown?
-- 
syaochan - 
syao...@hotmail.com
Fan #1 di Sakura
- dite anche voi NO allo yaoi >__< -

 proprietario dei file con chown?
Perché sono tanti e cambiano in continuazione visto che 
si tratta di upload continui.
Adesso sto lavorando sull'ipotesi di una umask per 
l'utente (non apache) che uploada i file via ssh.
Ma ho scoperto che è un casino pazzesco.

, 
tuli...@giallo.giallo says...

Le istruzioni su come cambiare l'umask ad una sessione 
sftp sotto ssh sono qua
http://larrykagan.com/blog/view/SFTP-umask
e qua
http://jeff.robbins.ws/articles/setting-the-umask-for-
sftp-transactions
e perché non si perda copioincollo
SFTP umask
4/23/2008 category: technology 
 What a pain in the butt it was to figure out how to set 
the default umask on new files sent via sftp. I was on a 
ghost hunt and found references to PermitUserEnvironment 
and the environment file but that didn't work as 
advertised. Setting umask in your shell configuration 
files (.profile, .bashrc, etc...) just doesn't work. 
The quick and sure fire way to get this working is 
creating a tiny wrapper around the sftp-server binary. 
This is a three-step process: 
The first step is to change your /etc/ssh/sshd_config 
(or equivalent) file to point to the new wrapper that 
you'll create: Subsystem sftp /usr/lib/openssh/sftp-
server.sh Notice that the name of the 'subsystem' is 
sftp-server.sh. It was sftp-server before the change. 
The second step is to write a three-line wrapper around 
sftp-server that will be called sftp-server.sh. 
#!/bin/bash
    umask 117
    /usr/lib/openssh/sftp-server 
Now just reload the sshd server: $ sudo /etc/init.d/ssh 
reload 
And that's it! 
This solution does not work for scp. 
Setting the umask for SFTP transactions
I ran into this problem when was setting up a web server 
for usage by a team setting up our company web site. 
There were two developers and they both would be 
uploading files to the machine, and they both were going 
to want to modify each others files if need-be. I made a 
common group and set the sgid bit on the parent 
directory. I didn?t want to open up straight FTP access 
to the box so I told them to use SFTP or SCP. This 
worked great until I found that each users umask was not 
being applied to new files and directories. The two 
developers could see each others files but not modify 
them. I found that the sftp process is spawned by the 
root user and its umask is applied to the transaction. I 
wasn?t in favor or modifying the root umask so I search 
for another solution.
The only thing I could find to work was to create a 
wrapper script around the sftp process that would 
temporarily set the umask for the transaction.
First I created the wrapper script:
#!/bin/bash
umask 0002
# The path to your sftp-server binary may differ
exec /usr/libexec/openssh/sftp-server 
Then I pointed the Subsystem directive in the 
sshd_config file to my script:
Subsystem sftp /opt/sftp-server-wrapper.sh 
A quick restart/reload of the sshd configuration and I 
was in business. Both users could see and edit each 
others files. Email or comment with questions.
 Joel Says: 
October 4th, 2008 at 8:28 pm 
This was a 3 hour pain for me on Ubuntu. But this helped 
a lot. 
For Ubuntu here is what I did(similar to above):
Create a shell file( note .sh extension) with your 
favourite editor(vi for me)
$ sudo vi /usr/lib/openssh/sftp-server.sh
Add the following lines:
#!/bin/bash
umask 0002
/usr/lib/openssh/sftp-server
Set the execute permissions
$ sudo chmod +x sftp-server.sh
Edit the sshd_config
$ sudo vi /etc/ssh/sshd_config
Add .sh to the end of the Subsystem line(near the bottom 
of the file):
Subsystem sftp /usr/lib/openssh/sftp-server
becomes:
Subsystem sftp /usr/lib/openssh/sftp-server.sh
Then restart sftp server
$ sudo /etc/init.d/ssh restart
And finally it worked:S
Reply to this comment 
 
 Setting the umask for SFTP transactions | csixty4 Says: 
October 13th, 2008 at 5:03 pm 
[...] turned up a link to Jeff Robbins? blog entry on 
Setting the umask for SFTP transactions. He shows how to 
modify your sshd_config file to call a script instead of 
invoking sftp-server [...]
Reply to this comment 
 
 joe Says: 
October 28th, 2008 at 7:30 am 
I tried this but it didn?t work fine for me, When a user 
upload files using scp or sftp it preserves the old 
permission the file had on the sending side, What may be 
dome?
Regards,
Reply to this comment 
 jeffro Says: 
October 28th, 2008 at 2:44 pm 
You need to double check if the Subsystem script is even 
being run. Add an echo statement before and after 
setting the umask and redirect it to a file. Check if 
the file is even being created.
And just to check, you did restart SSHD after you made 
these edits, correct?