Hello everyone!
I've set up a group called 'www' on my machine. There are two users in that group 'user1' and 'user2'. When I connect to my FC3 box via ftp as 'user1' and then upload a file to the web directory the owner and group of that file are user1.user1. Since this is the case user2 is able to download the file and make changes to it locally. However, user2 is unable to upload the file because the file owner and group on the server is user1.user1.
My question is how do I make it so that when user1 and user2 connect to the server and upload files they are grouped under the 'www' group and not under each username group? I created the group www with the /usr/sbin/groupadd www and then added each user to the the www group using the /usr/bin/gpasswd -a username www.
Any ideas on how I can get this to work correctly?
Thanks, jay
On Wed, 2005-03-02 at 14:46 -0600, Jay Paulson wrote:
Hello everyone!
I've set up a group called 'www' on my machine. There are two users in that group 'user1' and 'user2'. When I connect to my FC3 box via ftp as 'user1' and then upload a file to the web directory the owner and group of that file are user1.user1. Since this is the case user2 is able to download the file and make changes to it locally. However, user2 is unable to upload the file because the file owner and group on the server is user1.user1.
My question is how do I make it so that when user1 and user2 connect to the server and upload files they are grouped under the 'www' group and not under each username group? I created the group www with the /usr/sbin/groupadd www and then added each user to the the www group using the /usr/bin/gpasswd -a username www.
Any ideas on how I can get this to work correctly?
Try this: # cd my-upload-directory # chgrp www . # chmod 2775 .
See how that goes.
Paul.
I've set up a group called 'www' on my machine. There are two users in that group 'user1' and 'user2'. When I connect to my FC3 box via ftp as 'user1' and then upload a file to the web directory the owner and group of that file are user1.user1. Since this is the case user2 is able to download the file and make changes to it locally. However, user2 is unable to upload the file because the file owner and group on the server is user1.user1.
My question is how do I make it so that when user1 and user2 connect to the server and upload files they are grouped under the 'www' group and not under each username group? I created the group www with the /usr/sbin/groupadd www and then added each user to the the www group using the /usr/bin/gpasswd -a username www.
Any ideas on how I can get this to work correctly?
Try this: # cd my-upload-directory # chgrp www . # chmod 2775 .
See how that goes.
That worked! However, what is odd is that user1 is using Dreamweaver to upload files and user2 is using Fugu to upload files. When using Fugu it writes the file with permissions of 644. However, if user2 uses Dreamweaver to upload the file it's permissions are set to 664 which is correct.
Any ideas?
thanks, jay
On Wed, 2005-03-02 at 16:22 -0600, Jay Paulson wrote:
I've set up a group called 'www' on my machine. There are two users in that group 'user1' and 'user2'. When I connect to my FC3 box via ftp as 'user1' and then upload a file to the web directory the owner and group of that file are user1.user1. Since this is the case user2 is able to download the file and make changes to it locally. However, user2 is unable to upload the file because the file owner and group on the server is user1.user1.
My question is how do I make it so that when user1 and user2 connect to the server and upload files they are grouped under the 'www' group and not under each username group? I created the group www with the /usr/sbin/groupadd www and then added each user to the the www group using the /usr/bin/gpasswd -a username www.
Any ideas on how I can get this to work correctly?
Try this: # cd my-upload-directory # chgrp www . # chmod 2775 .
See how that goes.
That worked! However, what is odd is that user1 is using Dreamweaver to upload files and user2 is using Fugu to upload files. When using Fugu it writes the file with permissions of 644. However, if user2 uses Dreamweaver to upload the file it's permissions are set to 664 which is correct.
Any ideas?
Maybe Dreamweaver explicitly sets the permissions of the files? Which FTP server are you using?
Try using a command-line FTP client and experiment logging in as each user and writing a file to the upload area. What permissions do they get?
Paul.
Try this: # cd my-upload-directory # chgrp www . # chmod 2775 .
See how that goes.
That worked! However, what is odd is that user1 is using Dreamweaver to upload files and user2 is using Fugu to upload files. When using Fugu it writes the file with permissions of 644. However, if user2 uses Dreamweaver to upload the file it's permissions are set to 664 which is correct.
Any ideas?
Maybe Dreamweaver explicitly sets the permissions of the files? Which FTP server are you using?
Try using a command-line FTP client and experiment logging in as each user and writing a file to the upload area. What permissions do they get?
I tried it several different ways and Fugu was the only one that did weird things. However, I did find that it is a bug in the Fugu program itself
https://lists.ccs.neu.edu/pipermail/scponly/2004-October/000621.html
But now that I have set the group and the permissions to the directory to 2775 Apache doesn't like it and I get a 403 Forbidden error and I don't know why.
jay
Jay Paulson wrote:
Try this: # cd my-upload-directory # chgrp www . # chmod 2775 .
See how that goes.
That worked! However, what is odd is that user1 is using Dreamweaver to upload files and user2 is using Fugu to upload files. When using Fugu it writes the file with permissions of 644. However, if user2 uses Dreamweaver to upload the file it's permissions are set to 664 which is correct.
Any ideas?
Maybe Dreamweaver explicitly sets the permissions of the files? Which FTP server are you using?
Try using a command-line FTP client and experiment logging in as each user and writing a file to the upload area. What permissions do they get?
I tried it several different ways and Fugu was the only one that did weird things. However, I did find that it is a bug in the Fugu program itself
https://lists.ccs.neu.edu/pipermail/scponly/2004-October/000621.html
This is an sftp issue, but you said you were using ftp - not the same thing. Do both users use sftp, or does one use regular ftp?
But now that I have set the group and the permissions to the directory to 2775 Apache doesn't like it and I get a 403 Forbidden error and I don't know why.
Do you have SELinux enabled?
Paul.
Maybe Dreamweaver explicitly sets the permissions of the files? Which FTP server are you using?
Try using a command-line FTP client and experiment logging in as each user and writing a file to the upload area. What permissions do they get?
I tried it several different ways and Fugu was the only one that did weird things. However, I did find that it is a bug in the Fugu program itself https://lists.ccs.neu.edu/pipermail/scponly/2004-October/000621.html
This is an sftp issue, but you said you were using ftp - not the same thing. Do both users use sftp, or does one use regular ftp?
Oops sorry I was assuming sftp since (correct me if I'm wrong) FC3 only comes with sftp. But yes both users were using sftp in all applications.
But now that I have set the group and the permissions to the directory to 2775 Apache doesn't like it and I get a 403 Forbidden error and I don't know why.
Do you have SELinux enabled?
Yes it is enabled. I've done the ls -aZ command and everything looks right. The only thing I have done to the directory is chgrp to my web group 'www', chmod it to 2775, and chown it to root.www. I'm not quite sure why Apache is complaining. The other directories I have set up with the <VirtuaHost> config don't complain (granted I haven't chgrp, chmod, or chown'ed them yet).
jay
Jay Paulson wrote:
Maybe Dreamweaver explicitly sets the permissions of the files? Which FTP server are you using?
Try using a command-line FTP client and experiment logging in as each user and writing a file to the upload area. What permissions do they get?
I tried it several different ways and Fugu was the only one that did weird things. However, I did find that it is a bug in the Fugu program itself https://lists.ccs.neu.edu/pipermail/scponly/2004-October/000621.html
This is an sftp issue, but you said you were using ftp - not the same thing. Do both users use sftp, or does one use regular ftp?
Oops sorry I was assuming sftp since (correct me if I'm wrong) FC3 only comes with sftp. But yes both users were using sftp in all applications.
sftp clients will often set the permissions of the uploaded file to the same permissions as the original file on the source computer. Regular ftp clients don't usually do this. You may be able to work around the problem at the client end. If all else fails, you could always set up a cron job to periodically set the group write bit on all files in that directory.
But now that I have set the group and the permissions to the directory to 2775 Apache doesn't like it and I get a 403 Forbidden error and I don't know why.
Do you have SELinux enabled?
Yes it is enabled. I've done the ls -aZ command and everything looks right. The only thing I have done to the directory is chgrp to my web group 'www', chmod it to 2775, and chown it to root.www. I'm not quite sure why Apache is complaining. The other directories I have set up with the <VirtuaHost> config don't complain (granted I haven't chgrp, chmod, or chown'ed them yet).
Look in /var/log/messages to see if there are any selinux errors relating to that directory when you try to access it.
Paul.
This is an sftp issue, but you said you were using ftp - not the same thing. Do both users use sftp, or does one use regular ftp?
Oops sorry I was assuming sftp since (correct me if I'm wrong) FC3 only comes with sftp. But yes both users were using sftp in all applications.
sftp clients will often set the permissions of the uploaded file to the same permissions as the original file on the source computer. Regular ftp clients don't usually do this. You may be able to work around the problem at the client end. If all else fails, you could always set up a cron job to periodically set the group write bit on all files in that directory.
As of now on our production box the network admin has FC3 set up. If anyone wants to download a file we have to ssh in chown the file to the owner being the person who wants to work on it. Then download the file and change the owner back. There has to be a secure way around this so that people in the same group do not have to ssh into the box and change the permissions of the file every time they want to work on the file and still have Apache act normal not giving the 403 error.
Do you have SELinux enabled?
Yes it is enabled. I've done the ls -aZ command and everything looks right. The only thing I have done to the directory is chgrp to my web group 'www', chmod it to 2775, and chown it to root.www. I'm not quite sure why Apache is complaining. The other directories I have set up with the <VirtuaHost> config don't complain (granted I haven't chgrp, chmod, or chown'ed them yet).
Look in /var/log/messages to see if there are any selinux errors relating to that directory when you try to access it.
Looked and there aren't any error messages. Apache is running with httpd_t and all the directories and files are httpd_t as well.
jay
On Thu, 2005-03-03 at 07:48 -0600, Jay Paulson wrote:
Try this: # cd my-upload-directory # chgrp www . # chmod 2775 .
See how that goes.
That worked! However, what is odd is that user1 is using Dreamweaver to upload files and user2 is using Fugu to upload files. When using Fugu it writes the file with permissions of 644. However, if user2 uses Dreamweaver to upload the file it's permissions are set to 664 which is correct.
Any ideas?
You have 2 different users uploading files. The permissions on the files uploaded should not depend on the program that creates them but rather on the umask set for that user when they log in and upload.
It seems really weird that the same user can use fugu to upload files with one permission (644) and dreamweaver gives different permissions (664)
However, if your notes above are wrong and user1 is uploading with dreamweaver (664) and user2 is uploading with fugu (644) then it likely is the umask.
Maybe Dreamweaver explicitly sets the permissions of the files? Which FTP server are you using?
Try using a command-line FTP client and experiment logging in as each user and writing a file to the upload area. What permissions do they get?
I tried it several different ways and Fugu was the only one that did weird things. However, I did find that it is a bug in the Fugu program itself
https://lists.ccs.neu.edu/pipermail/scponly/2004-October/000621.html
But now that I have set the group and the permissions to the directory to 2775 Apache doesn't like it and I get a 403 Forbidden error and I don't know why.
Having the directory set to allow group writing and the sgid bit set is VERY insecure. Apache knows that and refuses to use insecure settings. You should reset the directory back to the proper permissions.
jay
However, if your notes above are wrong and user1 is uploading with dreamweaver (664) and user2 is uploading with fugu (644) then it likely is the umask.
What's really strange is that if user2 uploads with Dreamweaver the permissions are set to 664. With Fugu it's 644.
Having the directory set to allow group writing and the sgid bit set is VERY insecure. Apache knows that and refuses to use insecure settings. You should reset the directory back to the proper permissions.
Thank goodness it's a development server then! :) However, I still want it to be secure and agree with you that the sgid bit needs to be set right. The problem is what are the proper permissions that need to be set (I'm sort of a n00b when it comes to file permissions obviously)
thanks! jay
Jeff Vian wrote:
On Thu, 2005-03-03 at 07:48 -0600, Jay Paulson wrote:
But now that I have set the group and the permissions to the directory to 2775 Apache doesn't like it and I get a 403 Forbidden error and I don't know why.
Having the directory set to allow group writing and the sgid bit set is VERY insecure. Apache knows that and refuses to use insecure settings. You should reset the directory back to the proper permissions.
This is not only not true (about Apache refusing to access the group-writeable sgid directory - I just tried it myself) but changing the permissions back breaks the requirement that the OP's original question was about, namely how to make sure that new files written into the directory have the right group ownership.
Paul.
But now that I have set the group and the permissions to the directory to 2775 Apache doesn't like it and I get a 403 Forbidden error and I don't know why.
Having the directory set to allow group writing and the sgid bit set is VERY insecure. Apache knows that and refuses to use insecure settings. You should reset the directory back to the proper permissions.
This is not only not true (about Apache refusing to access the group-writeable sgid directory - I just tried it myself) but changing the permissions back breaks the requirement that the OP's original question was about, namely how to make sure that new files written into the directory have the right group ownership.
I went so far as deleting the entire directory and remaking it to clear all the permissions on it. Apache still complained and I got the 403 error.
jay