如何在 RHEL 服务器上安全地托管文件并允许用户下载
我编写了一个应用程序，用户可以用它来处理基因组数据。该应用程序依赖于 10GB 的数据库文件，用户必须下载该数据库文件才能运行该应用程序。目前，我已将此文件存储在 Google Drive 上，但下载带宽有限，因此如果某一天有多个用户下载该文件，则其他用户将无法使用该文件，并且他们在运行应用程序时会出错。
我的解决方案是将文件托管在我们的研究服务器上，创建一个仅具有此文件夹访问权限而无其他权限的用户，并通过该用户在应用程序（开源）中通过 scp 从服务器下载文件。
我现在的问题是，这样做安全吗？或者人们是否有可能侵入我们的服务器？如果此方法存在安全风险，那么提供此文件的更好方法是什么？
先感谢您！
I have programmed an application that users can use to process genome data. This application relies on a 10GB database file, that users have to download in order to run the application. At the moment, I have stored this file on Google Drive, but the download bandwith is limited, so if a number of users download the file on a certain day, it will not work for others and they will get errors running the application.
My solution would be to host the file on our research server, create a user that only has access rights to this folder and nothing else, and make the file downloadable from the server via scp within the application (which is open source) through that user.
My question now is, is this safe to do or are people potentially able to hack into our server? If this method would be a security risk, what would be a better way to provide this file?
Thank you in advance!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您想将SSH（SCP）用作文件托管的运输和身份验证方法。可以谨慎可以保持这种安全。例如，GitHub在使用GIT+SSH协议提供GIT访问时使用SSH进行运输。
现在，出于小心部分，如果您以前从未做过，那不是一项琐碎的任务。
实现此目的的正确方法将在Chroot环境中设置为孤立的SSH服务器，并仅在此孤立的SSH实例上设置SSH用户（不是系统中添加的用户EG
userAdd ）。然后，您可以添加Chroot绝对必要的文件，并为用户提供SSH访问权限。如今
（ 只要您对HTTP和TLS有一些了解。互联网上有很多关于此的著作。
两种方式，如果要将服务器公开到Internet或Intranet，则需要确保防火墙。如果还没有，请考虑了解Nftables或Firewalld之类的信息。
You want to use SSH (scp) as a transportation and authentication method for file hosting. It's possible to keep this safe with caution. For example, GitHub uses SSH for transport when providing git access with the git+ssh protocol.
Now for the caution part, if you haven't done it before, it's not a trivial task.
The proper way to achieve this would be set up an isolated SSH server in a chroot environment, and set up an SSH user on this isolated SSH instance only (not a user in the system that is added by eg
useradd). Then you can add the files that's absolutely necessary to the chroot, and provide SSH access to users.(Nowadays you might want to consider using Linux filesystem namespaces, if applicable, to replace chroot, but I'm not sure on this.)
As for other options, setting up a simple Nginx server for static file hosting might be a lot easier, provided you have some understanding of HTTP and TLS. There're lots of writings on the Internet about this.
Both ways, if you are to expose your server to the Internet or Intranet, you need to make sure of firewalling. Consider to learn about nftables or firewalld or the like, if you haven't already.
SSH 相当安全。始终保持软件最新。
设置仅 sftp 用户和 chroot 目录。在 /etc/ssh/sshd_config 中：
该用户将不会获得 shell（因为内部 sftp），并且无法看到 /var/ssh/chroot 之外的文件。
除密码外，还使用客户端证书。
对证书设置过程的良好描述：
https： //www.digitalocean.com/community/tutorials/how-to-configure-ssh-key-based-authentication-on-a-linux-server
SSH is reasonably safe. Always keep software up-to-date.
Set up an sftp-only user with chrooted directory. In /etc/ssh/sshd_config:
This user will not get a shell (because of internal-sftp), and cannot see files outside of /var/ssh/chroot.
Use a certificate client-side, additional to password.
Good description of the setup process for certificates:
https://www.digitalocean.com/community/tutorials/how-to-configure-ssh-key-based-authentication-on-a-linux-server
您的解决方案具有一定的安全性。
更好的解决方案是将其放在可通过 sftp 访问的服务器上，并使用密码，同时对文件进行加密：通过这种方式，您可以引入双层保护。
在 Linux 服务器上，您应该能够使用 gpg 之类的工具来加密您的文件。
接下来，您可以使用安全通道（例如端到端加密消息传递软件）与合作伙伴共享解密密钥。
Your solution is moderately safe.
A better solution is to put it on a server accessible via sftp, behind a password, but also encrypt the file: in this way you introduce a double layer of protection.
On a Linux server you should be able to use a tool like gpg to encrypt your file.
Next you share the decryption key with your partners using a secure channel with e.g. an end2end encrypted messaging software.
Aloha
您可以设置免费的 Seafile https://www.seafile.com/en/home/< /a>，或者要求管理员为您设置它，这非常安全，就像具有 2fa 身份验证的自托管谷歌驱动器一样。
另一个简单易用的工具是 github 上的 Filebrowser (https://github.com/filebrowser/filebrowser)
我真的不建议让人们在您的网络内进行 shell/scp 访问。
在公司网络内托管任何东西通常不是最明智的想法，总是存在风险。
我会在网络之外的廉价租用服务器上设置 Seafile/filebrowser 解决方案并将其上传到那里。或者，如果您还有一台小型电脑，请将其设置在 DMZ 区域中，该区域在您的公司内部具有特殊的访问限制。
Aloha
You can setup something like free Seafile https://www.seafile.com/en/home/, or ask the admin to set it up for you which is pretty secure like a self hosted google drive with 2fa authentication.
Another nice and easy tool is Filebrowser on github (https://github.com/filebrowser/filebrowser)
I would not really advice giving people shell/scp access inside your network.
And hosting anything inside a company network is in general not wisest idea, there is a always a risk involved.
I would setup a Seafile/filebrowser solution at a cheap rented server outside your network and upload it there. Or if you have a small pc left set it up in a DMZ Zone, a zone that has special access restrictions inside your company.