23

I was reading Practical Unix and Internet Security, when I came across the following lines which I couldn't comprehend.

If you are using the wu archive server, you can configure it in such a way that uploaded files are uploaded in mode 004, so they cannot be downloaded by another client. This provides better protection than simply making the directory unreadable, as it prevents people from uploading files and then telling their friends the exact filename to download.

A permission of 004 corresponds to -------r--. Can't a file be downloaded if it has read access? Also why is it considered better than simply making the directory non-readable? What does this imply?

Note: This is with regard to unauthorised users leaving illegal and copyrighted material on servers using anonymous FTP. The above solution was suggested to prevent this along with a script which deletes the directory contents after a period of time.

  • Specifically, it looks like it's referencing WU-FTP, of wuarchive.wustl.edu fame. – Parthian Shot Jul 6 '15 at 19:50
  • 2
    here is UMASK 004 meant and not a permission! – Afsin Toparlak Jul 6 '15 at 22:56
  • 3
    @AfsinToparlak no, this is definitely positive permission, not a umask. See the accepted answer. – o11c Jul 7 '15 at 6:51
  • "Can't a file be downloaded if it has read access" That's not entirely correct. Everyone except the user and the group owning the file has read access. – scai Jul 7 '15 at 8:38
  • 1
    With respect to the "This provides better protection than simply making the directory unreadable, as it prevents people from uploading files and then telling their friends the exact filename to download." ... an earlier trick was to make an upload area something like 333 (or d-wx-wx-wx) which let people (FTP users) create files, but because there is no read permission [on the directory], they could not list the files in the upload directory. However, if you knew the name, you could read/download the files. – TripeHound Jul 7 '15 at 15:54
33

The permissions 004 (------r--) means that the file can only be read by processes that are not running as the same user or as the same group as the FTP server. This is rather unusual: usually the user has more rights than the group, and the group has more rights than others. Normally the user can change the permissions, so it's pointless to give more restrictive permissions to the user. It makes sense here because the FTP server (presumably) doesn't have a command to change permissions, so the files will retain their permissions until something else changes them.

Since the user that the FTP server is running as can't read the files, people won't be able to download the file. That makes it impossible to use the FTP server to share file.

Presumably some process running as a different user and group reads the file at some point, verifies that it complies to some policy, copies the data if it does, and deletes the uploaded file.

It would have made more sense to me to give the file permissions 040 (readable by the group only) and have the consumer process run as the same group as the FTP server, but a different user.

  • 1
    @Cthulhu: The FTP server process also belongs to "all". But UNIX permissions are not searched. Only one triplet of rights is considered, and this is a pass/fail check. (Unlike Windows ACL's which have pass/fail/look further) – MSalters Jul 8 '15 at 7:30
8

The octal permissions mask of 004 corresponds to a symbolic permissions mask of u=,g=,o=r which means that the (u)ser who owns the file cannot read it or write to it or execute it, and neither can other users in the same (g)roup as the user who owns the file. Only (o)ther users who are neither the owner, nor in the same group as the owner, are able to read the file.

  • 1
    here is UMASK 004 meant and not a permission! – Afsin Toparlak Jul 6 '15 at 22:58
  • 4
    @AfsinToparlak: no, it's an explicit permission. See accepted answer. – TripeHound Jul 7 '15 at 15:43
6

Yes, but the file is owned by the user. So the client itself has the 0 permission (user) on the file and cannot read it.

You can test this yourself:

echo TEST > myTestFile;
chmod 004 myTestFile;
cat myTestFile;
chmod 700 myTestFile;
cat myTestFile;

The third step will raise an error.

  • So when a file is uploaded only that user gets the read permission for the file and all others get 000 ? Am I correct? Can you please expand your answer? – Aswin P J Jul 6 '15 at 17:44
  • 1
    I found the book and the chapter is about securing a public directory which is writeable for anonymous ftp clients. Any anonymous client opens the file as the same uid as any other anonymous client, so a created file is creatable by anonymous but not readable by anonymous. It is readable by any other uid on the system. – Jodka Lemon Jul 6 '15 at 17:57
  • @hope: each digit in a permission octal string represents 4 bits: set-id, read, write, and exec, in that order. Thus, 7 means read, write, and execute bits are all set. The first digit is the permission for the owner, etc. So it makes no sense to say that others get 000. Other gets just 0. Gilles' answer is the best explanation of what a permission setting like 004 actually does. – Peter Cordes Jul 6 '15 at 23:48
  • The third step is writing, not reading. – OrangeDog Jul 7 '15 at 7:58
  • @OrangeDog You are right. I corrected it. – Jodka Lemon Jul 7 '15 at 9:34
-1

It seems more likely that it means that any permissions are masked by 004, that is, other users cannot read the file. This would serve to protect the file from other users on the system (to some degree).

  • No, as others have explained, the ftp server sets the permissions to 004 so the user who uploaded it and any other users of ftp (at least anonymous ones) cannot access the file until it has been checked (when it would be re-permissioned and probably moved/renamed to an appropriate place). Places like WU Archive were often (mis)used in the dim and distant past as file-sharing sites if things like this were not put in place. – TripeHound Jul 7 '15 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.