Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

So I built what I thought would be this awesome reporting page in PHP that loads data from some CSV text files and creates nice Google charts and tables for our clients. I then thought it would be awesome if the text files lived in a shared Dropbox folder so that my staff can update the text files and then see their updates online without hacking any code or dealing with databases. It all works great on my local dev, but when I upload the code to my production server I run into problems. I think it's a Unix permissions problem, here is the PHP error:

[Sun Apr 07 11:27:58 2013] [warn] [client 208.69.41.10] mod_fcgid: stderr: PHP Warning:  file(/root/Dropbox/Reports/client-report.csv): failed to open stream: Operation not permitted in /var/www/vhosts/mydomain.com/httpdocs/my-awesome-report-page.php on line 49, referer: http://www.mydomain.com/my-awesome-report-page.php

What's the best way to allow PHP to grab the CSV files from /root/Dropbox ? Production is running CentOS 5.8.

The files in site's httpdocs folder all seem to belong to mydomain:psacln, whereas the files in root ~ are root:root.

As discussed in the comments, I would like to find a secure solution. The report page HTML is hidden behind a login.

share|improve this question
    
yes, it's a permission problem. i would for security reasons not really advice to do this but you could give permission with something like chown user:group /root/Dropbox/Reports. It would be better though to move this directory somewhere else if you want to give public access to it or maybe have some cron job copy the relevant files into another folder. (that said question is off topic here, would more likely belong on SuperUser) –  thorsten muller Apr 7 '13 at 16:15
    
Thanks for migrating the question. I don't want the files to be public, just available to PHP. I also don't want to create any security issues, the data contained needs to be protected. I guess I should try and install Dropbox under the Apache user. I'll add some more detail to the question with the 2 sets of users and groups. Cron seems unnecessary, as Dropbox does such a good job of keeping things updated in folders. –  jnthnclrk Apr 7 '13 at 18:13
add comment

migrated from programmers.stackexchange.com Apr 7 '13 at 16:45

This question came from our site for professional programmers interested in conceptual questions about software development.

2 Answers

Set a symlink from your document root to the folder.

ln -s /var/www/reports /root/Dropbox/Reports

This helps to directly access these files without changing security settings in Apache and PHP if the files is readable.

share|improve this answer
    
Of course, that's perfect. –  jnthnclrk Apr 8 '13 at 9:47
    
Hmmm, running into some trouble with this. I created the sym link under root, but it failed. I then tried to chown the sym link file to mydomain:psacln but that failed to0. –  jnthnclrk Apr 8 '13 at 20:28
    
According to this ( cyberciti.biz/faq/… ) sym links will always inherit the permissions of the target. Feel like I'm back to square one again. –  jnthnclrk Apr 8 '13 at 20:33
    
Of course you need read permissions for the file, but the advantage it that you don't allow your hole web server to access all files in that directory and can symlink to only that one. –  Tobias Zander Apr 10 '13 at 18:42
    
How do I add the read permissions securely? –  jnthnclrk Apr 10 '13 at 18:50
show 1 more comment

I got two ideas that might solve your issue:

  • you could create a cronjob as root (crontab -e) that copies the files you need to a folder the webserver can read.
    You can configure the cronjob to run once a minute, that should be enough for most cases.
  • Create a new user for your dropbox (it's not good practice to run stuff as root if not absolutely necessary). I'd also recommend creating a separate Dropbox user that only has shared access to the one folder you need (so you don't accidentally share more than you want to).

If you want me to get into more detail, feel free to ask :)

share|improve this answer
    
Thought about cron, but that really breaks the wonderful almost real time feel of Dropbox. –  jnthnclrk Apr 14 '13 at 11:25
    
@jnthnclrk Then what about my other suggestion? Run Dropbox under a new user account (e.g. dropboxsync) and let it sync an account that only has access to the data it needs (e.g. by creating a new acct that only has access to a single folder that's shared to it). –  mreithub Apr 14 '13 at 16:00
    
Yeah, that would probably work, but doesn't answer the question. I eventually abandoned the idea of using Dropbox in favour of FTP when it looked like the question couldn't be answered. –  jnthnclrk Apr 15 '13 at 16:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.