Log in to create and rate content, and to follow, bookmark, and share content with other members. Not a member? Join Now!

AnsweredAssumed Answered

FileMaker Server assigns wrong privileges to backup files

Question asked by anothersmurf on Apr 9, 2018
Latest reply on Apr 10, 2018 by wimdecorte

Like • Show 0 Likes0
Comment • 11

I'm running FileMaker Server 16.0.4 on MacOS 10.13.4. Under Schedules, FileMaker Server is set up to make daily backps of all hosted databases. It makes those backups as scheduled, but assigns the incorrect permissions to the backup files.

For example, a hosted database will have these permissions:

Owner[me] Read & Write

Group fmsadmin Read & Write

Everyone No Access

But the backed up version of that same database will have these permissions:

Owner fmserver Read & Write

Group fmsadmin Read & Write

Everyone Read Only

The permissions on the backup folder are Everyone No Access, so it's not coming from there. I also tried setting a umask 006 on the server, but that didn't fix the Everyone permission.

Does anyone know how to make FileMaker Server respect permissions when backing up files? (The big problem is its granting everyone read access; changing the owner to fmserver is no big deal.)

No one else has this question

Outcomes

11 Replies

wimdecorte Apr 9, 2018 1:15 PM
Mark Correct
Correct Answer
You shouldn't have to worry about it because you're not supposed to share the backup folders and especially not to people that shouldn't have read access to it. If you need the backup files somewhere where you can share them from, use an OS-level script that runs after the backup to manipulate the files but you have to leave the FMS backup folders alone. Otherwise you may interfere with FMS cleaning up after itself as it rotates the backup files and folders.
Like • Show 0 Likes0
Actions
taylorsharpe Apr 9, 2018 1:58 PM
Mark Correct
Correct Answer
The FileMaker service runs under the user "fmserver" with a group of "fmsadmin". When files are created at the OS level, they obtain the rights of the user creating them. So this would be correct of your server to make backups with the privileges you reference. ADDITIONALLY, if your live data files do not have those same permissions, you did not upload them using FileMaker tools. You probably dragged and dropped them or other wise "moved" them to the live FileMaker data folder. That is not how FileMaker recommends putting solutions onto FileMaker Server. You may run into problems if you do this due to permissions that you are referencing. This is a red flag to me as a developer that you did not properly host your files. The fix is to close all databases and then to open the parent Database folder, click the lock button, and then apply privileges of the parent folder to all of the sub folders. You will need to do this for all of the files including remote container files. OS X is Unix operating system and a lot less forgiving than Windows. Having wrong permissions can stop things from happening or keep them from opening.
Like • Show 0 Likes0
Actions
anothersmurf @ taylorsharpe on Apr 9, 2018 2:24 PM
Mark Correct
Correct Answer
Hm. That's *always* how I upload files to the server now; there used to be a command in the server to upload/import a file but that was removed (or hidden?) a few versions ago. I do normally change the owner to fmserver though; I just didn't for one file to test what happened backing it up.

The problem here is that policy (which I can't control) doesn't like Everyone having Read Only access. So no problem, I changed Everyone to No Access for the hosted files, and there's been no loss of fuctionality. But backups are giving Everyone Read Only again.
Like • Show 0 Likes0
Actions
ch0c0halic @ anothersmurf on Apr 9, 2018 2:33 PM
Mark Correct
Correct Answer
Possibly the new backup folders are inheriting the parent folder permissions.
What are the “Data/Backups/” folders permissions?
And can you change them to “Everyone - no access” to test this theory?
Like • Show 0 Likes0
Actions
anothersmurf @ ch0c0halic on Apr 9, 2018 2:37 PM
Mark Correct
Correct Answer
The parent folder is indeed Everyone No Access.
Like • Show 0 Likes0
Actions
wimdecorte @ anothersmurf on Apr 9, 2018 2:38 PM
Mark Correct
Correct Answer
anothersmurf wrote:

The problem here is that policy (which I can't control) doesn't like Everyone having Read Only access. So no problem, I changed Everyone to No Access for the hosted files, and there's been no loss of fuctionality. But backups are giving Everyone Read Only again.

Then, instead of fiddling with permissions of folders and files that FMS needs access to, set up a different kind of backup where FMS backs up to just one folder and keeps 0 sets, followed by an OS-level script that you create that zips and moves that zip file to where you need it and where you can control permissions, then delete the FMS backup.
Like • Show 0 Likes0
Actions
taylorsharpe @ anothersmurf on Apr 9, 2018 2:42 PM
Mark Correct
Correct Answer
anothersmurf wrote:

Hm. That's *always* how I upload files to the server now; there used to be a command in the server to upload/import a file but that was removed (or hidden?) a few versions ago. I do normally change the owner to fmserver though; I just didn't for one file to test what happened backing it up.

The problem here is that policy (which I can't control) doesn't like Everyone having Read Only access. So no problem, I changed Everyone to No Access for the hosted files, and there's been no loss of fuctionality. But backups are giving Everyone Read Only again.

To upload a file, you should open FileMaker Pro and go to File and Pull down to Sharing and click the Upload to Server. It will require you to put your Admin Console credentials in. That is the supported way to upload to FileMaker Server. And when you do, since it is run by fmserver, it will obtain the proper credentials.

I understand you do not want the default privileges, but that is not how FileMaker is designed to work. And if you should not be giving users access to the server. Are you using a Directory Service? But regarding "read only", if you have properly Encrypted at Rest, then someone copying the database would not be able to do anything with it without the EAR password.

You will not be able to get FileMaker to change its default behavior on backups and I recommend against it. But if you want to, there are plugins (Monkey Bread Software) and OS level scripts you can fire off to make such changes. But I recommend against it. FileMaker also does not recommend you have end users getting access to the FileMaker Server as users. It should be Admin access only by IT and Developers at the user level.

I realize you are trying to think through security and improve things and that is good. But there has been a lot of work put into how FileMaker works and I recommend you follows its security policy guidelines for best results.
Like • Show 0 Likes0
Actions
taylorsharpe @ ch0c0halic on Apr 9, 2018 2:47 PM
Mark Correct
Correct Answer
ch0c0halic wrote:

Possibly the new backup folders are inheriting the parent folder permissions.
What are the “Data/Backups/” folders permissions?
And can you change them to “Everyone - no access” to test this theory?

The permissions are generated by the user who creates the file. FileMaker is an operating system service and the user that it logs on and operates as is "fmserver". Since that is the user creating the files, that is why it receives that permission and it is what is setting the Read Only permission (it's in the FM service programing that we can't change). But the problem referenced at the top here is that it creates a Read-Only permission for everyone and that is what he is trying to avoid. FileMaker both protects those files with EAR as well as recommends end users not be users on the FileMaker Server, only IT and Admins. You would only need users on that same machine if you were doing things like File Sharing or Mail, but FileMaker specifically says not to run other services on the same server.
Like • Show 0 Likes0
Actions
anothersmurf @ wimdecorte on Apr 9, 2018 2:59 PM
Mark Correct
Correct Answer
Thanks, I might end up with an OS-level script timed to run after the backup is done. It seemed unnecessarily complicated, but perhaps it's the only way.

There isn't any user-level access to the machine; it's just a FileMaker Server, nothing else, no file sharing, etc. And Encryption-at-rest is in use. So this may be a bit academic. But my role is following policy, not setting it.
Like • Show 0 Likes0
Actions
ch0c0halic @ taylorsharpe on Apr 9, 2018 3:05 PM
Mark Correct
Correct Answer
While all you point out is true it is also possible to set folder policies that change permissions on newly created folder/files within said folder, regardless of who created them. Our IT manager has done this on some of our systems. If their IT department had done something like this it is possible they could get what they want without interfering with FMS. Who as the owner of the folder and files should still be able to delete them as required.

I totally agree that
Only trained IT or FMS admin personnel should ever access the FMS hard drive by any means.
File sharing should be turned off.
EAR should be in place and the password stored in a safe, both on and off premises.
If the OS service isn’t required by FMS it shouldn’t be running either.
No 3rd party services should be running.

And I think their IT department may agree with this as they are interested in file level permissions. They just need to be informed of FMS security measures and best practices.
1 person found this helpful
Like • Show 1 Like1
Actions
wimdecorte @ anothersmurf on Apr 10, 2018 3:54 AM
Mark Correct
Correct Answer
anothersmurf wrote:

There isn't any user-level access to the machine; it's just a FileMaker Server, nothing else, no file sharing, etc. And Encryption-at-rest is in use. So this may be a bit academic. But my role is following policy, not setting it.

The policy is there to mitigate a risk. While I'm not privy to the decision-making process at the company I won't be far off by saying it is to protect access to data and/or intellectual property. Setting the OS-level permissions is just one of the ways to mitigate that risk and it is by no means the definitive way. The other measures as you have outlined (access to the machine itself, directly or through shares, and the use of EAR) are going to have a bigger impact.

And given that fiddling with OS-level permissions may interfere with the workings of FMS (and in the worst case interfere with the ability to restore backups!): I would imagine that any decent IT department would be willing to evaluate the totality of the measures taken vs the stated goal and allow the default FMS permissions to stand.

If you haven't already, I would certainly engage in that conversation.
1 person found this helpful
Like • Show 0 Likes0
Actions

FileMaker Server assigns wrong privileges to backup files

Outcomes

Related Content

Recommended Content