Solved

Web Servers - Directory Permissions

Posted on 1997-05-19
6
205 Views
Last Modified: 2010-04-21
I've got a bit of a dilemna... I am part of a website design
team for a new client, which wants us to setup a membership
system for them.

The membership system allows members to use an online
CGI-driven script to design their homepage. To do this I
setup a users directory where all member accounts will be
stored in, the users have ftponly access to the site. The
users directory and all member subdirectories are now group
owned by the web server group (www) with group write permissions so the CGI scripts can write to their directories.

However, now I find that users can ftp in, change directories to another users directory and also write
to those! Obviously not what I wanted.

Can anyone suggest a way to accomplish the following goals:

1) Allow the web server to write to all subdirectories of
the users directory via CGI.
2) Allow users to ftp into their accounts and have full
read/write access.
3) Prevent users from being able to write to other users
directories.

I would greatly appreciate your suggestions!
Thanks,
Andy
gmd@netmcr.com
0
Comment
Question by:icculus
  • 3
  • 3
6 Comments
 
LVL 5

Accepted Solution

by:
n0thing earned 100 total points
ID: 2006306
Hi,

  The user's home directory should be owned by the user himself.
The permission of the directory should be 2775 drwxrwsr-x, the
group maybe www, but the user should be in other groups else than
www, like wwwuser. This setup will allow:

  1) The owner have the right to write to their own directory and
no one else.
  2) The CGI script's group should be www so it could write to
that directory.

Example:
passwd file: joe:cryptedpasswd:100:200:Joe User:/bin/false
where group 200 would be "wwwuser".
directory's mode should be 2775 drwxrwsr-x joe.www with the SGID
bit on, so any CGI script with the group "www" could write to
that directory but no one else except for the owner himself.
Everyone else could look into that directory and execute CGI
scripts in that directory, but cannot write to it.

Regards,
n0thing
0
 
LVL 1

Author Comment

by:icculus
ID: 2006307
Excelent Answer! Right after receipt I rewrote our membership
system to implement your solution, my tests show it works
exactly as you proposed.

Thank you so much!
Andy
0
 
LVL 1

Author Comment

by:icculus
ID: 2006308
Well,, looks like I spoke a bit too soon...

It looks like the web server can write to files already
present in the directory, however it cannot create
new files...

How would I go about allowing the web server to create
new files in a user's directory?

Thanks much!
andy
0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 
LVL 5

Expert Comment

by:n0thing
ID: 2006309
Any scripts, process which want to write to that directory should
be in the group "www", by default, httpd deamon is own by
nobody.nobody. You'll have to change the group id in the
httpd.conf file to "www" and restart the server.

Regards,
n0thing
0
 
LVL 1

Author Comment

by:icculus
ID: 2006310
The web server is already user www and group www, but
it doesn't belong to the wwuser group, which owns the
directory...

-Andy
0
 
LVL 5

Expert Comment

by:n0thing
ID: 2006311
The user's directory should be joe:www and not joe:wwwuser. If
you set it to joe:wwwuser, then every other users will be able
to write to it and it will defeat the purpose of the SGID bit.
So that way, the owner will be able to write to it, the others
users can't since they belong to the wwwuser but not www. Any
CGI/process with the group ID of www could write to that
directory. Any further questions on the topic, send mail to me
directly minh@qc.bell.ca.

Regards,
Minh Lai
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I have been running these systems for a few years now and I am just very happy with them.   I just wanted to share the manual that I have created for upgrades and other things.  Oooh yes! FreeBSD makes me happy (as a server), no maintenance and I al…
Every server (virtual or physical) needs a console: and the console can be provided through hardware directly connected, software for remote connections, local connections, through a KVM, etc. This document explains the different types of consol…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
This video shows how to set up a shell script to accept a positional parameter when called, pass that to a SQL script, accept the output from the statement back and then manipulate it in the Shell.

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now