Facebook
Twitter
nilsringersma_nl
Basic Pleskian
Username: nilsringersma_nl
TITLE
RHEL8's default umask for sshd process (0077) causes unexpected behaviour for Plesk users with SSH access
PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE
CentOS Linux 8.2.2004 (Core)
Plesk Obsidian V18.0.30 Update #2
PROBLEM DESCRIPTION
Hi Devs,
In RHEL7 the default Umask for newly created homedirs is '0022' in RHEL8 this is changed to '0077' as explained here. This change is also mentioned in Red Hat Bugzilla – Bug 1777718.
Plesk allows us to enable access via SSH for subscription owners (regardless of the shell but I used /bin/bash). When creating files via that SSH user the file permissions are set with the earlier explained Umask octave. In RHEL8 this means the new file will have no r(wx) permissions for the group/others. Deploying website files via the SSH user this results in the webserver returning a 403 for those files.
I understand this is beyond the scope of Plesk but can be solved rather easily by setting the Umask for newly created homedirs in /etc/login.defs. I believe this should either be done when installing Plesk or should at least be mentioned in your article about CentOS 8/RHEL 8 support in Plesk.
STEPS TO REPRODUCE
1. Use RHEL8 with Plesk obsidian.
2. Create a subscription.
3. Allow that subscription owner access via SSH with /bin/bash
4. Login to that SSH user and create a file (touch test)
5. Now compare the file permissions to those of a file created with the same proces on .i.e. RHEL7
ACTUAL RESULT
-rw-------. 1 webreact-staging psacln 0 Oct 16 13:11 test
EXPECTED RESULT
-rw-r--r--. 1 webreact-staging psacln 0 Oct 16 13:18 test
ANY ADDITIONAL INFORMATION
1777718 – default umask for sshd process is 0077
YOUR EXPECTATIONS FROM PLESK SERVICE TEAM
Confirm bug
TITLE
RHEL8's default umask for sshd process (0077) causes unexpected behaviour for Plesk users with SSH access
PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE
CentOS Linux 8.2.2004 (Core)
Plesk Obsidian V18.0.30 Update #2
PROBLEM DESCRIPTION
Hi Devs,
In RHEL7 the default Umask for newly created homedirs is '0022' in RHEL8 this is changed to '0077' as explained here. This change is also mentioned in Red Hat Bugzilla – Bug 1777718.
Plesk allows us to enable access via SSH for subscription owners (regardless of the shell but I used /bin/bash). When creating files via that SSH user the file permissions are set with the earlier explained Umask octave. In RHEL8 this means the new file will have no r(wx) permissions for the group/others. Deploying website files via the SSH user this results in the webserver returning a 403 for those files.
I understand this is beyond the scope of Plesk but can be solved rather easily by setting the Umask for newly created homedirs in /etc/login.defs. I believe this should either be done when installing Plesk or should at least be mentioned in your article about CentOS 8/RHEL 8 support in Plesk.
STEPS TO REPRODUCE
1. Use RHEL8 with Plesk obsidian.
2. Create a subscription.
3. Allow that subscription owner access via SSH with /bin/bash
4. Login to that SSH user and create a file (touch test)
5. Now compare the file permissions to those of a file created with the same proces on .i.e. RHEL7
ACTUAL RESULT
-rw-------. 1 webreact-staging psacln 0 Oct 16 13:11 test
EXPECTED RESULT
-rw-r--r--. 1 webreact-staging psacln 0 Oct 16 13:18 test
ANY ADDITIONAL INFORMATION
1777718 – default umask for sshd process is 0077
YOUR EXPECTATIONS FROM PLESK SERVICE TEAM
Confirm bug
