7

I am trying to find the most secure way to transfer files from one server to another.

I have the following architecture:

Architecture

Currently I am using the main user salamis in order to mount the directories.

The files in the original directory are created through a PHP file manager elfinder.

Unfortunately, I am not able to move, rename or delete any file from the mounted directory through PHP. I get permission denied.

1) Is it because I mounted the filesystem using salamis instead of www-data?

2) Is it secure to mount the filesystem on Server 2 as www-data ? If yes, how can I achieve that? www-data does not have a password and I cannot login using su -m www-data. I get authentication failure.

3) Can you think of a better architecture?

2 Answers 2

2

SSHFS is a FUSE filesystem. These are managed by a user-land process which runs as the user who mounts the filesystem: that sshfs process you run doubles as the filesystem driver. By default, most FUSE filesystems only allow the mounting user to access files inside.

In order to be able to access files through sshfs, you need three things:

  1. The user who is authenticated over ssh on server1 must be able to access the files.
  2. The user who tries to access the sshfs filesystem on server2 must have the necessary access permissions.
  3. The user who tries to access the sshfs filesystem on server2 must be allowed to access that filesystem.

As I wrote above, only the mounting user has that last permission. You can relax this by adding -o allow_user to the sshfs command line, but this won't solve the other two problems. Note that -o allow_user only takes effect if /etc/fuse.conf contains user_allow_user or you are running sshfs as root.

On server2, you need to either run sshfs as the www-data user (whom you will have to give access to the SSH private key), or enable allow_user and arrange for the local www-data to have access to the files it needs. There are several ways to do that: through the uid option, or by passing -o default_permissions, or by passing -o umask 770,gid=www-data. If you enable allow_user, make sure that you don't end up allowing www-data to access more files than it should, and that you don't end up allowing other users to see or modify what they shouldn't. Running sshfs as www-data has the advantage of simplicity, you have a far better chance of not accidentally being too permissive.

For problem #1, you need to ssh into the www-data account on server1, or to allow the account that you use to access those files. There is some benefit in not allowing remote logins to system accounts such as www-data, because these make for poor auditing (you can't know who actually used the account). However, it's not out of the question, and it is somewhat easier to set up. If you don't want to allow remote logins to the www-data account, add salamis¹ to the www-data group, make sure that the filesystem on server1 is mounted with the acl option (add it to the relevant entry in /etc/fstab if necessary), and add an ACL to www-data's files:

setfacl -d -m group:www-data:rwx -R /path/to/www-root
setfacl -m group:www-data:rwx -R /path/to/www-root

¹ If that's your account on server1, I didn't understand from your question whether salamis was a user on server1, on server2 or both.

2
  • salamis was a user on both servers. That's why I was using salamis to sshfs from one server to the other server
    – glarkou
    Feb 8, 2012 at 23:02
  • It's not enough for the user accounts to be the same name in unix. The userid (uid) and groupid (gid) need to match across sytems as well. Compare the entries for the 2 accounts in the /etc/passwd and /etc/group files on both systems and make sure they're in sync.
    – slm
    Dec 23, 2012 at 2:56
0

1) Yes, just like Gilles answered, the login id you use are the default owner of created files. This is true for most protocolls.

2) Its correct there are no password for the www-data user. You can however give www-data a temporary password and copy salamis certificate to www-data with the command ssh-copy. When this is done salami can login and mount as www-data without input of any password. (You have to have a certificate built with ssh-keygen.)

3) Another possible solution are rsync the files between the two servers. Rsync uses the same secure infrastructure as ssh/sftp/sshfs, you can use ssh-copy just like you did in 2. With rsync you can let www-data fetch the files from salami. Using ssh-copy gives you the opportunity to script the syncing, a one-liner in /etc/cron.[dayly|hourly] is sufficient in most cases. Rsync are robust, if there are any problems with the salamis-server your application can still be functional with the last files that you synced, your application are not slowed down by the network but you have a delay between a change in a file in salamis-directory and at the server. You can also consider using a VCS, for example bzr, and fetch your files from a repository. That gives you a nice revision control of your source codes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .