0

I have Ubuntu machine thats running a Rails app. I want to share the log file with another developer so they can watch what is happening with the app in real time using a command such as this:

tail -f ~/railsapp/log/staging.log

What is the best way to do this without exposing all of my passwords, API keys, etc that are embedded in my Rails app?

I could create a group & user using the command:

groupadd logviewer
adduser lv1 --ingroup logviewer

Then remove permissions for others

chmod -R o-rwx ~/railsapp

Then re-add read permission for others

chmod -R o+rx ~/railsapp/log

Are there consequences to this approach? Is there a better way?

Added 3/5/2014 - Looks like this is also a good idea:

chmod -R o+rx ~/railsapp/public

Added 4/14/2014 - You're also to need to allow the path to the log directory...so:

chmod o+rx ~/railsapp
chmod o+rx ~/railsapp/log
JPN
  • 632
  • 12
  • 24

3 Answers3

1

You may just grant the logviewers with the read and traversing access(r+x) to the directory other than the rails dirs where they would have no permission to read, but only the traversing permission through the path to the log file, and make a soft link to the log file.

ln -s /railsapp/log/staging.log /to/somewhere/staging.log

logviewers should have access to log files and the path /to/somewhere. The idea is to allow them read log only and can't read all the other files under railsapp.

canoe
  • 1,273
  • 13
  • 29
1

If you do not want to setup fileshare, and also have something that is more long term, I would recommend something that is a light http wrapper over log files.

Refer to this question for more options, but my recommendation goes like this:

Use tailon and set it up to watch your rails logs:

tailon -f ~/railsapp/log/staging.log

This would then stream staging.log to localhost:8080

You could also have tailon stream to nginx and setup user access.

You may also want to look at this answer, to see similar thing working with Sinatra and ruby :) - in case you do not want to use python based tools.

Community
  • 1
  • 1
Srikanth Venugopalan
  • 9,011
  • 3
  • 36
  • 76
  • I would also like to mention [wtee](http://wtee.readthedocs.io/en/latest/), which is a sister project of tailon. If you're only interested in following a single file, wtee could be the simpler solution (disclaimer: I'm the author of both projects). – gvalkov Sep 12 '16 at 17:55
0

Create a unix user, create group, add the user to the group, add permission on reading the file (740), after all revoke rights and delete the group and the user.

itsnikolay
  • 17,415
  • 4
  • 65
  • 64