Ftp – How to configure Web/FTP Server so that it downloads .sh files instead of showing its content

ftp

I have an FTP server (vsftpd) where there are many files of various types. Normally when you click on .tar.gz file in your browser, it starts downloading it.

The problem is when user clicks on .sh file, the file is not downloaded but instead its content is displayed in the browser.

What should I configure FTP or Web server to force it to download .sh files?

Edit: First, Web server is Apache. However, as I understood, Web server doesn't interfere with the request as "ftp://" protocol is used instead of "http://". Perhaps, this is the reason Apache's rules are ignored (because Apache doesn't receive any request). FTP server directly handles all the client requests.

Considering all these. Is there a way to configure FTP server to correctly handle .sh files?

Best Answer

In Apache, you can do the following to force even the most reluctant of web browsers (I'm looking at you, IE) to download a file:

<FilesMatch *.sh>
  ForceType application/octet-stream
  Header set Content-Disposition attachment
</FilesMatch>

This should be added inside either a VirtualHost, or a Directory within a VirtualHost.

Related Solutions

Ftp – How to tell SELinux to give vsftpd write access in a specific directory

# semanage fcontext -a -t public_content_rw_t "/myftp/pub(/.*)?"

Be sure to include the (/.*)? at the end of the directory name.

I also tried to use audit2allow to generate a policy, but what it does is generate a policy that gives ftpd write access to directories of type public_content_t; this is equivalent to turning on allow_ftpd_full_access, if I understood it correctly

Essentially, yes; since SELinux allows directories/files labeled with public_content_t to be shared between different services. However, further access control is in place through the use of sebooleans (or sebool, more precisely).

Giving "ftpd full access", doesn't mean giving it the rights to do/read/write what and where it wants. SELinux has designated policies in place for the services on your system; meaning, ftpd is allowed to read files if the directory's file context (fcontext) is public_content_t. SELinux gives write permissions to the ftp server if the directory's fcontext is public_content_rw_t; other services such as samba, apache, etc. have to be allowed write permissions to those directories through the booleans, according to the pertaining RedHat Documentation. If your "local policy" gives ftpd write access in directories labelled public_content_t, it essentially strips away a layer of security. Therefore, I suggest labeling the directory with the public_content_rw_t context, and removing your custom generated local policy.

For further information and details, please see the SELinux wiki pages.

Linux – 403 Forbidden when trying to download file that was uploaded using SSH

Possible causes:

umask issues (Unix file permissions)
selinux context
extended ACLs

Best Answer

Related Solutions

Ftp – How to tell SELinux to give vsftpd write access in a specific directory

Linux – 403 Forbidden when trying to download file that was uploaded using SSH

Related Topic