Directory Permissions for 2 users on 1 directory

UNIX Solaris
1

we want to allow user to FTP files into a directory, and then the program (PLSQL) will read and process the file, and then move the file to other directory for archiving.

the user id: uftp1, group: ftp
the program run in oracle database, thus have the user Id: oraprod, group: dba

how to configure the directory so that the directory, and all subsequences files FTP by user are both read-able and write-able by both user id: (uftp1, and oraprod) ?

2

Hi,

you may think to put user oraprod in ftp group as secondary group, then make the content of the directory where ftp-ed files are stores r/w for ftp group (you meay also think to create a new group, to which both users belong, and assign r/w privs to this group in the said directory).

Should be able to use usermod -G to assign users to additional groups (check man pages anyway).

see ya
fra

3

Making the user uftp1 a member of dba or oraprod a member of ftp may lead to security hole as either way will open the door for the uftp1 or the oraprod user to have access to the resources which ftp or dba is the owner of.

Creating a separate group for uftp1 and oraprod is a better approach.

But the best approach in terms of security in this scenario would be to make use of ACL and SGID bit. I will explain the approach here:

  1. Suppose /u01 is the directory in question. Make oraprod and dba are the owner of the directory:
chown oraprod:dba /u01
  1. Give 770 permission on /u01:
chmod 770 /u01
  1. Turn on SGID bit on /u01 so that when the uftp1 user creates any file in the directory the group owner of the directory (dba) will have the ownership of the newly created file by default rather than ftp. This will help the oraprod user to have permission on the file as it's a member of the group.
chmod g+s /u01
  1. Now you have to set ACL for the user uftp1 on /u01. The syntax varies depending on whether it's a ZFS or UFS filesystem.

For ZFS:

chmod A+user:uftp1:add_file/write_data/read_data/execute:allow /u01
ls -ldv /u01 ## to verify the ACL

For UFS:

setfacl -m u:uftp1:rwx /u01
getfacl /u01 ## to verify the ACL

That's it and you are all setup.

1 Like