I have a consultant who is about to access files on our UNIX server
via FTP.
Is there a simple way to protect the CGI scripts from being
copied/stolen while, at the same time, keeping the CGI script actively
available for public use?
If I were doing it, my solution might be to only give the consultant a
user or FTP account that is able to access files that you want them to
access. The webserver user can of course access those files _and_
others. Ensure that user account only has FTP acccess, and maybe use
your FTP daemon's access controls to restrict access further than the
plain filesystem permissions allow.
Depending on your directory structure you might find that you can use
the basic unix file permissions to restrict what the consultant can
read. Maybe you can use the restrictions in the FTP daemon to add
further limits. Maybe you can use symlinks, a chroot, a jail, a copying
process, or a "mount --bind". Maybe, in the worst case, you need to
avoid giving them an FTP account at all, and manually send them the
files (and then recieve the files from them and manually put them back
on the filesystem).
If you're that worried about third party access maybe it's better that
you do not grant them an account on the server, and opt for something
like the last option. You might also want to consult your legal team
about your intellectual property rights, the consultant's contract, your
territory's copyright laws, etc etc. Anyway, is this consultant really
likely to try to steal any of your code or are you being (rightly, in
this day and age) paranoid about security
?
P
