Security alert email when opening file manager as admin

Community Support
1

Hi,

Since the latest update, every time I open the file manager as admin I got an email security alert:

*** SECURITY information for cp.liby.hu ***
cp.liby.hu : Feb 12 11:14:57 : hestiaweb : a password is required ; PWD=/usr/local/hestia/web/fm/dist ; USER=root ; COMMAND=/usr/bin/chmod o+x /home/Liby/.ssh

after checking the auth.log I found the following messages:

Feb 12 11:14:57 cp sudo: hestiaweb : PWD=/usr/local/hestia/web/fm/dist ; USER=root ; COMMAND=/usr/local/hestia/bin/v-add-user-sftp-key Liby 30
Feb 12 11:14:57 cp sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1004)
Feb 12 11:14:57 cp sudo: pam_unix(sudo:session): session closed for user root
Feb 12 11:14:57 cp sudo: pam_unix(sudo:auth): conversation failed
Feb 12 11:14:57 cp sudo: pam_unix(sudo:auth): auth could not identify password for [hestiaweb]
Feb 12 11:14:57 cp sudo: hestiaweb : command not allowed ; PWD=/usr/local/hestia/web/fm/dist ; USER=root ; COMMAND=/usr/bin/chmod o+x /home/Liby/.ssh

A quick search showed, that this commands come from hestia/web/fm/configuration.php line 188

                // filemanager also requires .ssh chmod o+x ... hopefully we can improve it to g+x or u+x someday
                // current minimum for filemanager: chmod 0701 .ssh
                shell_exec("sudo chmod o+x " . quoteshellarg("/home/" . basename($v_user) . "/.ssh"));

Everything seems to work fine (at least for me), it is just an annoying to get a mail every time I access the file manager.

2

We need to change it … to v-change-fs-file-permission

3

im having the same issue, is this the correct usage of the command to fix the above issue ?

v-change-fs-file-permission user /home/user/.ssh 0700

im getting the mail for all the users when they access file manager.

4

Try this.

Edit file /usr/local/hestia/web/fm/configuration.php and replace this:

               shell_exec("sudo chmod o+x " . quoteshellarg("/home/" . basename($v_user) . "/.ssh"));

by this:

               shell_exec("sudo /usr/local/hestia/bin/v-change-fs-file-permission " . quoteshellarg(basename($v_user)) . " " . quoteshellarg("/home/" . basename($v_user) . "/.ssh" . " 0755"));
5

same thing happen with a fresh install of hestiacp is this normal ? getting emails if i open the file manager with admin or by login with a user account.

6

this fixed the issue no more emails. but i wonder why this issue happens with fresh installs.

Update: now i see this on system log when open the file manager for the first time v-add-user-sftp-key 'username' '30'

7

Because this issue has not been fixed in the installed version yet

8

I’ve created this PR to fix it in version 1.9.4.

9

still same after upgrading to 1.9.4

10

Yes, the PR wasn’t merged, you should apply the fix manually again.