Announcement

Collapse
No announcement yet.

Compressed Upload -- Ownership and Permissions

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

    Compressed Upload -- Ownership and Permissions

    Hi,

    what is the correct procedure for switching to Compressed uploading?

    One of our clients (we provide hosting) has Actinic installed, and wants to switch/try the compressed uploads.

    Whenever he attempts the upload it fails because the files in "acatalog" are owned by the user who does the FTP upload with permissions set to prevent other users writing to these files.

    Actinic support answer "Install Perl module and ensure permissions are 777" on acatalog about three times, despite the perl modules being in place, and then try and sell him their own hosting arrangements.

    I assume we just need to change all the files in "acatalog" to be owned by the webserver process. But Actinic seem unable to advise on the appropriate file permissions and ownership for running Actinic.

    In our environment all users files uploaded via FTP are owned by a Linux account associated with that user and not writable by any other user (or the webserver). The webserver has its own account. This is pretty standard shared hosting practice, since it provides a (very small) modicum of security to prevent other users of the service modifying the users files. Obviously the Compressed Upload will potentially allow any other users to overwrite the contents of "acatalog" if they have their own CGI access but this is an understood risk of the shared hosting config on that server.

    Server: Debian Lenny, vsftp, chrooted to users folder, Apache 2.2

    #2
    Hello Simon,

    Unfortunately, the compressed upload is not currently designed to work on servers where the ftp and cgi users are different. The problem occurs when you are switching to compressed upload for the first time (or disabling it) - files created by the scripts will not be able to replace the files uploaded by ftp (and vice versa).

    I know of one host who worked round the issue using suexec, but I wouldn't be able to advise you how to do this.
    Ben Popplestone
    Ecommerce website software

    Comment


      #3
      Thanks Ben.

      With that answer I can at least set the ownership the same between web server and FTP user.

      What I didn't want to do was change the ownership broadly, and break some assumption that Actinic developers had made about what constitutes a sensible security configuration.

      SUEXEC isn't really a clean solution in this sort of environment, as having the different ownership of files to web means that the web server couldn't overwrite the users web pages even if the CGI app was found to be insecure.

      Ideally Actinic would adopt the privileges required for the minimum amount of time, i.e. when unpacking the new files. So probably the right solution for Linux/Unix is a setuid wrapper around the relevant bit which root would have to install. Although I wouldn't fancy having to do the support side of that given how temperamental setuid is across different platforms and security solutions.

      Simon

      Comment

      Working...
      X