So I'm considering a small project that involves online file storage.
Let's say I wanted to set up a site that allows people to log-on,
create an account, and then have space to upload files. The problem
I'm having concerns permissions, basically.
1) How do I automatically create users in Linux from a PHP script
running under Apache's uid/gid?
2) Once 1 is done, how, when they log back on (authenticated with SQL
which will keep up with their username), do I allow them access to
their files for download? I would like to use Linux file permissions
to try and have some sort of security (i.e., would like to store users'
files under /home/[user]/files), but how do I allow the PHP script to
securely access their files, when the script runs under the Apache uid?
Is this a job for suExec?
Any input will be appreciated, and I will clarify anything that is
unclear.
Thanks,
jab3 9 1777
jab3 wrote: So I'm considering a small project that involves online file storage. Let's say I wanted to set up a site that allows people to log-on, create an account, and then have space to upload files. The problem I'm having concerns permissions, basically.
1) How do I automatically create users in Linux from a PHP script running under Apache's uid/gid?
You can't. You need to be running as root. 2) Once 1 is done, how, when they log back on (authenticated with SQL which will keep up with their username), do I allow them access to their files for download? I would like to use Linux file permissions to try and have some sort of security (i.e., would like to store users' files under /home/[user]/files), but how do I allow the PHP script to securely access their files, when the script runs under the Apache uid? Is this a job for suExec?
Again, you need to be running as root to be able to change file
permissions for someone other than the Apache process.
Any input will be appreciated, and I will clarify anything that is unclear.
One way to do the above is suexec. Or you can start batch jobs to do
the work. One thing you do NOT want to do is give the Apache process
root privileges. Thanks, jab3
--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp. js*******@attgl obal.net
=============== ===
"Jerry Stuckle" <js*******@attg lobal.net> wrote in message
news:Sc******** *************** *******@comcast .com... jab3 wrote: So I'm considering a small project that involves online file storage. Let's say I wanted to set up a site that allows people to log-on, create an account, and then have space to upload files. The problem I'm having concerns permissions, basically.
1) How do I automatically create users in Linux from a PHP script running under Apache's uid/gid?
You can't. You need to be running as root.
What about exec( some_script )? Where some_script could be run as root
through sudo? It could be a Perl script or shell script that runs the
appropriate commands to set up the user.
Balazs
Jerry Stuckle wrote: jab3 wrote: So I'm considering a small project that involves online file storage. Let's say I wanted to set up a site that allows people to log-on, create an account, and then have space to upload files. The problem I'm having concerns permissions, basically.
1) How do I automatically create users in Linux from a PHP script running under Apache's uid/gid?
You can't. You need to be running as root.
Yeah, similar to what Balazs said, I actually have done this by running
a program I wrote in C as setuid root, but I consider that dangerous.
I made the program very compact, dealing with untainted data, but
still. Guess that's the way to go for that though. 2) Once 1 is done, how, when they log back on (authenticated with SQL which will keep up with their username), do I allow them access to their files for download? I would like to use Linux file permissions to try and have some sort of security (i.e., would like to store users' files under /home/[user]/files), but how do I allow the PHP script to securely access their files, when the script runs under the Apache uid? Is this a job for suExec?
Again, you need to be running as root to be able to change file permissions for someone other than the Apache process.
Yep, that's my problem. :) I keep wondering how these other sites do
it (like these online photo sites, e.g. SnapFish, that give you an
account and let you upload images for others to see). I've considered
making it all managed from an SQL database and putting the files in a
PHP-accessible directory with SQL-generated ids as subdirectory names
for each user's folder and bypassing Linux permissions. But that seems
less secure. Any input will be appreciated, and I will clarify anything that is unclear.
One way to do the above is suexec. Or you can start batch jobs to do the work. One thing you do NOT want to do is give the Apache process root privileges.
I suppose I could have cron jobs that run x times an hour to move stuff
around. I'll have to look some more into suexec. And don't worry,
giving Apache root access has not occurred to me. :)
Thanks for help,
jab3
Balazs Wellisch wrote: "Jerry Stuckle" <js*******@attg lobal.net> wrote in message news:Sc******** *************** *******@comcast .com... jab3 wrote: So I'm considering a small project that involves online file storage. Let's say I wanted to set up a site that allows people to log-on, create an account, and then have space to upload files. The problem I'm having concerns permissions, basically.
1) How do I automatically create users in Linux from a PHP script running under Apache's uid/gid?
You can't. You need to be running as root.
What about exec( some_script )? Where some_script could be run as root through sudo? It could be a Perl script or shell script that runs the appropriate commands to set up the user.
Yeah, as I told Jerry, I've done this before with a C program I wrote.
Was wondering if there was a better way as far as this option is
concerned. It's really the managing of the user's files when they log
onto the website that I've got problems figuring out. Uploading and
moving to appropriate directory (e.g., /home/'user'/files), then
browsing them for downloading again, etc.
Thanks for help,
jab3 > 2) Once 1 is done, how, when they log back on (authenticated with SQL > which will keep up with their username), do I allow them access to > their files for download? I would like to use Linux file permissions > to try and have some sort of security (i.e., would like to store users' > files under /home/[user]/files), but how do I allow the PHP script to > securely access their files, when the script runs under the Apache uid? > Is this a job for suExec? >
I think it would be much simpler and just as secure to store the files
outside the web root and use a script to retrive them based on information
in a database table. So you're HTML in case of an image would look something
like this:
<img src="fileserver .php?userId=XXX &fileID=XXX" >
Then the script "fileserver.php " would look up the appropriate details for
the file including its mime type and return it to the browser. It would also
be responsible for authenticating the request based on the userId. For added
security the userId can either be encrypted or stored in the session so it
doesn't have to be passed in on the URL.
Balazs
Balazs Wellisch wrote: > 2) Once 1 is done, how, when they log back on (authenticated with SQL > which will keep up with their username), do I allow them access to > their files for download? I would like to use Linux file permissions > to try and have some sort of security (i.e., would like to store users' > files under /home/[user]/files), but how do I allow the PHP script to > securely access their files, when the script runs under the Apache uid? > Is this a job for suExec? >
I think it would be much simpler and just as secure to store the files outside the web root and use a script to retrive them based on information in a database table. So you're HTML in case of an image would look something like this:
<img src="fileserver .php?userId=XXX &fileID=XXX" >
Then the script "fileserver.php " would look up the appropriate details for the file including its mime type and return it to the browser. It would also be responsible for authenticating the request based on the userId. For added security the userId can either be encrypted or stored in the session so it doesn't have to be passed in on the URL.
Interesting. That's a good idea. Would this directory off the
web-root be owned by the apache user/group? (Doesn't the PHP script
run as the apache user?) Cause if the files were just world-readable,
I would have to figure a way to get the files there after uploading in
the first place, which presumably could just be a perl script or
something run as the owner of the directory.
Thanks for the idea,
jab3
Yeah, it would have to be owned by the apache user since I'm assuming you're
going to upload the files through the web as well. Apache will need to have
write access to it. I don't think any other user should have access to it at
all
To upload the files you'd just use move_uploaded_f ile(). http://www.php.net/manual/en/features.file-upload.php
B Interesting. That's a good idea. Would this directory off the web-root be owned by the apache user/group? (Doesn't the PHP script run as the apache user?) Cause if the files were just world-readable, I would have to figure a way to get the files there after uploading in the first place, which presumably could just be a perl script or something run as the owner of the directory.
Thanks for the idea, jab3
Balazs Wellisch wrote: "Jerry Stuckle" <js*******@attg lobal.net> wrote in message news:Sc******** *************** *******@comcast .com...
jab3 wrote:
So I'm considering a small project that involves online file storage. Let's say I wanted to set up a site that allows people to log-on, create an account, and then have space to upload files. The problem I'm having concerns permissions, basically.
1) How do I automatically create users in Linux from a PHP script running under Apache's uid/gid?
You can't. You need to be running as root.
What about exec( some_script )? Where some_script could be run as root through sudo? It could be a Perl script or shell script that runs the appropriate commands to set up the user.
Balazs
That's one way to do it.
--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp. js*******@attgl obal.net
=============== ===
jab3 wrote:
Yeah, similar to what Balazs said, I actually have done this by running a program I wrote in C as setuid root, but I consider that dangerous. I made the program very compact, dealing with untainted data, but still. Guess that's the way to go for that though.
Yes, that's one way to do things.
Yep, that's my problem. :) I keep wondering how these other sites do it (like these online photo sites, e.g. SnapFish, that give you an account and let you upload images for others to see). I've considered making it all managed from an SQL database and putting the files in a PHP-accessible directory with SQL-generated ids as subdirectory names for each user's folder and bypassing Linux permissions. But that seems less secure.
Why not just keep everything owned by the Apache process? Protect
access to the files through a download script, .htaccess, or some
similar way.
Even if you do change the ownership of the files you won't be more or
less secure. They'll all be access via the Apache uid anyway. I suppose I could have cron jobs that run x times an hour to move stuff around. I'll have to look some more into suexec. And don't worry, giving Apache root access has not occurred to me. :)
One of the worst ways to do things. Thanks for help, jab3
As I said - I just keep everything owned by Apache. Membership is
managed through a MySQL database or .htaccess.
--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp. js*******@attgl obal.net
=============== === This thread has been closed and replies have been disabled. Please start a new discussion. Similar topics |
by: Dennis C. Drumm |
last post by:
Is there one place (local xml file, registry, etc.) that all user can read
and write to??
I have some settings that applicable to all users, but when a restricted
rights user start my application, these global settings cannot be updated,
since it seems they cannot write to an xml or ini settings file in the
folder where the executing assembly runs from or to the HK_LOCAL_MACHINE
part of the registry.
If it comes to writing to, say an...
|
by: jd |
last post by:
I am playing about with the Personal Web Site Starter Kit. It uses a
database called ASPNETDB.MDF for loggin users into the site.
I have successfuly added users using the ASP.NET Configuration Tool and can
log users in when running in Visual Studio.
When I want to test the web site out properly I use the Copy Website tool to
copy all files to http://localhost.
I can the open that site just fine but I don't seem to be able to login...
|
by: Zabby |
last post by:
hi,
i want to turn on/turn off a usb lamp via a vb.net button...
i think i would have to turn on/turn off the power for this usb port....
how could i do this?
kind regards
|
by: Yogee |
last post by:
Hello all,
I dont know the exact group where I should post my questions. So, I m
doing it on most of the groups which support components of LAMP stack.
My client wants to use WAMP ( Windows + apache + MySQL + PHP ). But the
site performance is very slow on windows. I dont know the exact
reasons.
I have seen some benchmark details on internet. But still they are not
|
by: google |
last post by:
I have a few general questions. I am working on a new database to be
used within my company. I would like to give a couple of people,
particularly HR, the ability to add and delete Access users, and
add/remove them to groups, so as people join and leave the company,
they can be added/removed as database users at that time. However, I
don't want them to have to do it through the standard Access
users/groups interface, and I don't want...
| |
by: none |
last post by:
Hello:
I had a nice php application running on my server here at home, and I
uploaded it to a shared public type server and it started to break all
over the place. It turns out that some scripts required higher
permissions that others, but I can't figure out what the difference is.
They all read from the database. Some write to the database, but not
all the ones that require higher permissions do. I don't understand
what it is about...
|
by: hamarsheh |
last post by:
please i need you'r help .. we are designing a web site and we need a critical code in php for security , we have to read users permissions on files in the local network ,to give them the real access and permissions also in their homes(on website) not just in thier work place (by local network security)so we have to read ldap file system ,but we can't find the code required ........
|
by: Kesavan |
last post by:
I install apache2 in /usr/local/apache2
and install php5 by ./configure --with-apxs2=/usr/local/apache2/bin/
apxs
PHP is successfully installed in my system.
But now my .php files inside /usr/local/apache2/htdocs doesn't get
phrased.
When I run
suse-10-2:/home/kesavan # php info.php
|
by: Marco A. Cruz Quevedo |
last post by:
Hi everybody,
I am building php-5.2.6 with the following options:
.. . . . . . . . . . . . . . . . . . . .
--prefix=/usr --with-mysql=shared,/usr --with-zlib=/usr --with-apxs2 --
with-config-file-path=/etc --with-config-file-scan-dir=/etc/php.d --
with-bz2 --with-db4=/usr --with-layout=GNU
.. . . . . . . . . . . . . . . . . . . .
but when I make install, the /etc/php.d directory is not created and
|
by: marktang |
last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look !
Part I. Meaning of...
|
by: Hystou |
last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it.
First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
| |
by: Oralloy |
last post by:
Hello folks,
I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>".
The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed.
This is as boiled down as I can make it.
Here is my compilation command:
g++-12 -std=c++20 -Wnarrowing bit_field.cpp
Here is the code in...
|
by: jinu1996 |
last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth.
The Art of Business Website Design
Your website is...
|
by: tracyyun |
last post by:
Dear forum friends,
With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
|
by: isladogs |
last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM).
In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules.
He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms.
Adolph will...
|
by: conductexam |
last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one.
At the time of converting from word file to html my equations which are in the word document file was convert into image.
Globals.ThisAddIn.Application.ActiveDocument.Select();...
|
by: 6302768590 |
last post by:
Hai team
i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
| |
by: bsmnconsultancy |
last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...
| |