-----BEGIN PGP SIGNED MESSAGE-----
This was first mentioned in July, and I've seen no progress on the
thread. It doesn't appear that my last message on this topic reached
the list; I apologize if we end up with duplicates.
I was disturbed to see that during uploads via scp from a Linux
workstation to a Solaris server, where the permissions on the original
file were 644 and the umask for the receiving user was 022, the
uploaded file was created 666. I uploaded a file to my public web
directory on the server some weeks ago, and only just now discovered
that it was world-writeable. I confirmed that scp was to blame by
repeating the upload, checking the umask and perms before the
transfer.
The transfer involved ssh v.2.3.0 on both ends. This is not good.
- -d
- --
David Talkington
Community Networking Initiative
[EMAIL PROTECTED]
217-244-1962
PGP key: http://www.prairienet.org/~dtalk/dt000823.asc
Calvin Bebermeyer wrote:
>Though the permissions for 2.1.0 and 2.2.0 servers do not give the
>permissions of the original question, they do NOT use the umask settings
>for the connecting user either ... this is strange (should not be)
>behavior to me.
>
>For myself, the umask setting is 077 and I still get files uploaded that
>are not *.exe as 644 permissions. The *.exe files get 755 settings,
>which I think should not be on a UNIX box. The Win apps should not
>attempt or have executable permissions on UNIX systems, in my opinion.
>
>
>Calvin Bebermeyer
>2000-2001 MU-ACM Program Chair
>[EMAIL PROTECTED]
>
>-----Original Message-----
>From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Shane
>Williams
>Sent: Wednesday, July 19, 2000 9:49 AM
>To: Wesley Most
>Cc: [EMAIL PROTECTED]
>Subject: Re: Default Permissions via the Windows SCP GUI
>
>
>On Mon, 17 Jul 2000, Wesley Most wrote:
>
>> Good day...
>>
>> First, let me say that I think the new Windows client has been done
>quite
>> well. Also, the appearance of the free license for Universities makes
>my
>> life easier as an admin to pull the plug on telnet and ftp.
>>
>> However, there is, in my humble opinion, a glaring problem with
>version of
>> 2.2 of the Windows client. I haven't checked the older versions for
>the
>> same bug, but I believe it is there based upon the documentation for
>the
>> product. If one uploads a file that Windows deems an application the
>> permissions at rwxrwxrwx. If one uploads a document file of any type,
>the
>> file goes up rw-rw-rw-. Why would a company who's products are all
>> security-related hardcode in values like this?
>
>Hmm.. Well, it's either not in the older version (2.1.0), or it's some
>other problem. I used the sftp GUI to send a powerpoint file and it
>was saved 644. I wonder if the default permissions from the GUI are
>related to umask. Has anyone else noticed this sort of behavior,
>because if it does exist, it's definitely a problem.
>
>--
>Public key at www-swiss.ai.mit.edu | Shane Williams
>/~bal/pks-toplev.html | Systems Administrator UT-GSLIS
>=----------------------------------+-------------------------------
>All syllogisms contain three lines | [EMAIL PROTECTED]
>Therefore this is not a syllogism | www.gslis.utexas.edu/~shanew
>
- ------------ Output from pgp ------------
Pretty Good Privacy(tm) Version 6.5.8
(c) 1999 Network Associates Inc.
Uses the RSAREF(tm) Toolkit, which is copyright RSA Data Security, Inc.
Export of this software may be restricted by the U.S. government.
File is signed. Good signature from user "<[EMAIL PROTECTED]>".
Signature made 2000/10/26 03:30 GMT
- ------------ Output from pgp ------------
Pretty Good Privacy(tm) Version 6.5.8
(c) 1999 Network Associates Inc.
Uses the RSAREF(tm) Toolkit, which is copyright RSA Data Security, Inc.
Export of this software may be restricted by the U.S. government.
File is signed. Good signature from user "<[EMAIL PROTECTED]>".
Signature made 2000/10/26 21:07 GMT
-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
Comment: Made with pgp4pine 1.75-6
iQEVAwUBOfjgVb1ZYOtSwT+tAQGVxwf/XZNekEfFNN+8u8dHxH9C+ptpQ15/0+J1
rm1gWsUepfzxeNG4WbCBSp6nqi3uCtettl++Fb9qfejTPk3q7NBmqA0FTfmG096O
J7wE1kaVs/TyGkUVk+if9LbfB52GWCZ+TsNquQ5dAoR6oSKDTa1ipT98V9Go12YJ
LNDfqtlUBU0Lh9K+ZfFLaJVtFpJpefPw3VFe04anNQayBkbo0PvmL/1xNtPcjKAW
U5lWF46CqTUczFG7JfyhTvex7xmiNswONlcHFgsapXQMHtreOjsQ4nC79IZfkpgt
Y3bTtS/+fTkKCU5OeAzashWnIC9BWzB/0WUA/iFriMM40NS6sMPtEg==
=EEI3
-----END PGP SIGNATURE-----
