2

Is there a way to create a shell user for developers to login to the server and execute command line php scripts to see the output? They have to be restricted to a folder.

In other words, I don't want to give developers root access just a basic access to see output of certain command line php scripts by logging in and running >php phpfile.php

2
  • 3
    I hope you trust all of the people you intend to access this service. It could be abused greatly.
    – Tim
    Dec 21, 2011 at 14:45
  • To limit both the functions and the directory access you will likely need a very complete chroot (jailed) environment. This can still be abused but may be a significant amount of work to keep in sync with production. Dec 21, 2011 at 15:36

2 Answers 2

7

Along the lines of Tim's comment, I would recommend you create a development server that is an identical environment to your production server. Then you should create accounts for each developer to log in with ssh. They can copy over or write php files and use the php CLI interpreter all they want.

2

There are ways to created restricted shells with permissions that will cascade on to any application run (AppArmor is good for this).

While that can protect your server infrastructure, it cannot protect the internals of your application unless it is limited to a very narrow set of scripts that can't modify data. That can be a lot of work.

Thus, the summary is mandatory access control systems and well-written devops scripts can provide this, but think carefully before doing so.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .