1

So I have a Windows SFTP server (SFTPSERVER), which receives files (duh).

I then need to push those files to a Linux server (AD authenticated to my domain) elsewhere in my organzation.

So that bit I have down.

rsync -vzO --remove-source-files -e "ssh -i /cygdrive/c/cygwin/home/transferuser/privatekey.pri" /cygdrive/d/SFTPPATH/SFTPUSER/* [email protected]:/path/to/files

The problem is I then get files on the linux server owned by transferuser. They need to be owned by processuser and processgroup on the destination server. Because these files arrive irregularly and need to be copied upon completion of upload, a cronjob from the destination server is not viable for me. I've tried scripting a chown, but the user pushing the files (transferuser) doesn't seem to have the relevant permissions. Given that I don't want to give this account sudo rights on the destination server, what options do I have here?

3
  • sudo rights are pretty granular. You can give that account very specific rights. chown is a root-only command. You could give rights to a specific command line -- /bin/chown faculty * for example, and the only additional permission is to change ownership to just that one new owner.
    – unkilbeeg
    Oct 29, 2014 at 20:36
  • 1
    Do the files NEED to be owned by processuser? If they're owned by processgroup, is there a reason that wouldn't be sufficient? Oct 29, 2014 at 20:43
  • The app grabbing the data is badly coded enough that it requires specific user and group ownership. Yes, I've told them to change that. No, it's not getting changed any time soon. Oct 29, 2014 at 21:32

1 Answer 1

0

In your /etc/sudoers file you could give permissions to a very specific command. In my sudoers I have the following:

%student ALL = /bin/chgrp faculty *, /bin/chmod 2770 *

That's probably too general for what you want. You probably want something more like:

transferuser ALL = /bin/chown processuser:processgroup /path/to/files/*

You're not giving carte blanc -- the user is only allowed to issue one very specific class of commands.

You could also give processuser these permissions and embed the commands in whatever script does the processing at the receiver end.

Here's a completely different approach that does not involve sudo. You could run a cron job once a minute on the receiving machine to check for new files and chown them as needed.

In root's crontab:

* * * * * find /path/to/files/ -user transferuser -exec chown processuser:processgroup {} \;

This will find any files that are currently owned by transferuser and chown them, and will ignore any files that are already fixed. Since find is already recursive, you don't have to worry about subdirectories, they will be handled. The only question is whether once a minute is often enough.

3
  • Note that /path/to/files is hardcoded, as are the target user and group. No other changes can be made.
    – unkilbeeg
    Oct 29, 2014 at 20:59
  • Does it allow for subfolders? So if I have /path/to/files/sub1 through /path/to/files/sub999 could I just do /path/to/files and it would pick up the subfolders? Oct 30, 2014 at 5:19
  • Well, chown supports recursive operation with a -R flag -- I don't know whether you'd have to explicitly put that in the sudoers or whether it would be enough to include it while you're actually issuing the command. You might have to test it. /bin/chown -R processuser:processgroup /path/to/files/
    – unkilbeeg
    Oct 30, 2014 at 18:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .