LinuxQuestions.org - file permissions and sshfs

- Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)

- - file permissions and sshfs (https://www.linuxquestions.org/questions/linux-security-4/file-permissions-and-sshfs-462542/)

file permissions and sshfs

Hi,probably not right forum,but not sure where to put it in.Its sort of security.

I want to use sshfs to run a program from a central server on remote boxes.That works fine.I mounted the file system of the server,using sshfs and i can see the file and execute it,but i dont want any of the users on the remote boxes to be able to read the file,in other words,just execute it.On the remote box,here's the settings

Code:

chmod 711 file

ls -l

total 4

-rwx--x--x    1 usergroup test          37 Jul 10 09:39 file

711 means that only root can read it,does n't it?all the other ones can execute it,but not read it...

But,if i log in as test on the box and do a vim file,i can read it.How can I get this user to be able to execute the file(its a php script) but not be able to read it,in other words see the source code?

Thanks

711 means that the *OWNER* (usergroup here) can read it but no one else, root can always read all local files.

Ok Thanks,There i already learned something.So i changed the permission to 111 now,but now i cannot see the output of the program,for instance say I have script Hallo.php that just echo's Hallo. If i run it as root(./Hallo.php) its outputs hallo,but if a run it as user it runs,but outputs nothing.the permission looks like this now...

Code:

ls -l

total 4

---x--x--x    1 user test          40 Jul 11 09:39 Hallo.php

As root

Code:

[root@box]./Hallo.php

X-Powered-By: PHP/4.2.2

Content-type: text/html

Hallo

[root@box]

As user

Code:

[user@box]./Hallo.php

[user@box]

This is not an answer to your question, but I would like to point out there are other methods to run a command on remote boxen. If the commands don't change (often) then copying the file to the servers and using a ssh tool could be efficient. If you can't or won't copy, then there's tools like Webjob.