1

I have set up a server (A) with a user that allows ssh access from another somewhat (but not fully) trusted server (B). Server B will be sending over files to Server A into a directory that is accessible from the web.

This folder is owned by the user that ssh uses to connect and the group for the directory is Apache.

This is all working fine but I am wondering what is the best way to prevent the directory containing files from Server B from running any executables or PHP/CGI scripts.

I could draw up a white list of file types if that would help. The files will mostly be images but will also include other files such as mp3's, PDF's and other day to day consumer file types.

1 Answer 1

0

You can use sudoers file to prevent as you want.

user ALL=(ALL:ALL) /home/user/script.sh

So only user can run /home/user/script.sh. Also need to make sure there is no another rule allowing user or group can run anything. It will replace above rule.

1
  • I don't mean a specific file, I mean the no scripts or executables should be run from a given directory
    – Kline
    Jun 7, 2019 at 12:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .