1

So, for my clients to who have sites hosted on my server, I create user accounts, with standard home folders inside /home.

I setup an SSH jail for all the collective users, because I really am against using a separate FTP server. Then, I installed ACL and added acl to my /etc/fstab — all good.

  1. I cd into /home and chmod 700 ./*.
    • At this point users cannot see into other users home directories (yay), but apache can't see them either (boo)
    • . I ran setfacl u:www-data:rx ./*. I also tried individual directories.
    • Now apache can see the sites again, but so can all the users. ACL changed the permissions of the home folders to 750.

How do I setup ACL's so that Apache can see the sites hosted in user's home folders AND 2. Users can't see outside their home and into others' files.


Edit: more details:

Output after chmod -R 700 ./*

sh-3.2# chmod 700 ./*
sh-3.2# ls -l
total 72
drwx------+ 24 austin  austin     4096 Jul 31 06:13 austin
drwx------+  8 jeremy  collective 4096 Aug  3 03:22 jeremy
drwx------+ 12 josh    collective 4096 Jul 26 02:40 josh
drwx------+  8 joyce   collective 4096 Jun 30 06:32 joyce

(Not accessible to others users OR apache)

setfacl -m u:www-data:rx jeremy

(Now accessible to members apache and collective — why collective, too?)

sh-3.2# getfacl jeremy 
# file: jeremy
# owner: jeremy
# group: collective
user::rwx
user:www-data:r-x
group::r-x
mask::r-x
other::---

Solution

Ultimately what I did was:

chmod 755 *
setfacl -R -m g::--- *
setfacl -R -m u:www-data:rx *

4 Answers 4

1

Try changing the mask into "---" ?

Or revoke the group permission with setfacl. chmod and setfacl do not work too well together.

2
  • This is starting to make some sense, but I don't quite understand 'masks' and 'effective masks'. Can I not just set permissions to allow only user access and then also allow apache?
    – arbales
    Aug 10, 2009 at 17:53
  • Also, I can't vote up your answer, but I would if I could. I wish my Stack Overflow reputation would carry over.
    – arbales
    Aug 10, 2009 at 17:54
0

Well, you can't stop users seeing "outside their home directories" without a full chroot, because they're always going to be able to see into system directories like /usr/bin (because that's how programs get run). I don't see how the setfacl command you gave will produce the results shown; can you give the output of getfacl and ls -l for a user's home directory in your question?

3
  • 1
    Normally that's true but they don't have console access — I'm CHROOT-ing and forcing SFTP. I posted more details. Moreover, I only really care about preventing access to other user's directories.
    – arbales
    Aug 7, 2009 at 5:20
  • It looks like you might be getting bitten by the effective rights mask; I've never hit it before, but it's the only thing that makes any sense. Not sure how to unset it, the setfacl manpage is being particularly obtuse today.
    – womble
    Aug 7, 2009 at 5:31
  • I know exactly what you mean — I can't find any simple documentation for ACL's — I assumed it'd be a highly used feature. I hope someone else has encountered it, because it seems like it should be a simple solution.
    – arbales
    Aug 7, 2009 at 5:39
0

For jailing, newer versions of ssh support the ChrootDirectory option. For scp only connections, I've used scponly successfully in the past.

As for apache seeing the files, you didn't quite get the chmod right. Try something like this (assumes apache uses the apache group):

cd /home

chmod -750 * # owners can do everything, group members can read, others can do nothing

chgrp -R apache * # by changing group to apache, apache can now read the files.

Remember, you don't want to add regular users to the apache group.

1
  • 1. I'm already using the ChrootDirectory option. 2. I don't want the user's home directories to be in the apache group. 3. I'm not adding regular users to the apache group.
    – arbales
    Aug 10, 2009 at 17:51
0

hayalci's comment that

chmod and setfacl do not work too well together.

helped a good deal. Instead of using CHMOD to prevent other groups from accessing the data, I used:

cd /home
setfacl -m g::0 joeuser # Removes permissions for the owning group.
setfacl -m g:www-data:r joeuser # Adds read permissions for Apache
cd joeuser/joeuser.com/static/
setfacl -m g:www-data:rwx uploads # So apache can write to the uploads directory.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .