5

I am in the arduous and painful process of setting up secure users on a new web LEMP server with Ubuntu 12.04. I was initially going to setup something like vsftpd or proftpd but many have suggested just to use SFTP directly so I will. Ultimately, I have one primary user (which I use simply to prevent root logins). I created this new user, generated a public-key pair, uploaded the public key to the users ~/.ssh directory as authorized_key, changed the SSH port number, removed root login and also set passwordauthentication to NO so the user is forced to use his/her key to log in. Easy enough (though working on a PC seems to be much more of a headache for this than my OSX/NIX counterparts).

I am now trying to create new users (for my web developers) which will simply have SFTP access and limit their exposure simply to the web directory of their charge. Each directory has the following format:

/var/www/sitename.com/public/

My headache starts now. Create a new user? Easy. Add password? Don't really need to given I am requiring public/private keys (and they will never have sudo access) but ok. I am struggling however with the following:

  • How do I actually store THIS new user's public key on the server? If I login as my root user and simply create the authorized_keys file within their home directory, it will have root owner and group permissions and they are unable to log in to the server. Similary, these new users cannot login and create it themselves, well, duh because they aren't permitted to login via password.

(note: I am also struggling with setting up the sftp and limiting them to their respective web directories but I think I can figure that out later on my own).

Any advice?

Edit

Currently the process is this:

  • get public key from the individual
  • go through the following commands:
#sudo mkdir -p /home/newuser/.ssh
#sudo nano /home/newuser/.ssh/authorized_key
#(copy key into single line and save)
#chown -R newuser:newuser /home/newuser
#chmod 700 /home/newuser/.ssh
#chmod 600 /home/newuser/.ssh/authorized_key

I suppose this isn't absolutely horrible but if we have a large number of developers (plus the amount of time it is about to take me to set them up with the SFTP portion and limit to directories) it seems like a huge pain.

5
  • 2
    My only recommendation on your workflow: ditch nano. :)
    – EEAA
    Mar 7, 2013 at 1:19
  • 1
    @EEAA - why you say that? It is just as fast as vi and easier to use IMO.
    – JM4
    Mar 7, 2013 at 20:51
  • 1
    Just wait until you have to do more complex editing...then you'll want a more capable editor.
    – EEAA
    Mar 7, 2013 at 20:59
  • @EEAA - any suggestions to try out?
    – JM4
    Mar 7, 2013 at 21:19
  • 1
    Well, vi will be present on any unix system you ever touch, and it's a very capable editor. The functionality gained from getting over the learning curve is well worth the effort required...
    – EEAA
    Mar 7, 2013 at 21:45

3 Answers 3

11

You need to change the ownership of the file and set permissions appropriately.

$ chown -R newuser /path/to/home/.ssh
$ chmod 700 /path/to/home/.ssh
$ chmod 600 /path/to/home/.ssh/authorized_keys

To make this process more simple, repeatable, and audit-able, use a configuration management system for user management. All widely-used config management systems (puppet, chef, ansible, etc.) ship with the ability to create users and deploy keys. A huge added benefit of using a config management system is that you can also keep your configuration in source control.

7
  • heh.. you beat me by 57 seconds, but also gave a more detailed response, in that you supplied example commands. upvote for you. original poster will probably also need to mkdir /home/$USER/.ssh if it doesn't exist and create an authorized_keys file, but basically yes. Mar 7, 2013 at 1:03
  • @MichaelMcNally - I'm quick like a bunny. :)
    – EEAA
    Mar 7, 2013 at 1:03
  • @EEAA - I meant to include in my original question but that is exactly what I'm currently doing. Just didn't know if there was a way to do this more easily as there are other steps involved.
    – JM4
    Mar 7, 2013 at 1:04
  • 1
    create a script which tests for the existence of the directories and, if not found, creates them with appropriate permissions and ownership. write once, run many times. Mar 7, 2013 at 1:06
  • 1
    Yup, different question. :)
    – EEAA
    Mar 7, 2013 at 22:21
1

How do I actually store THIS new user's public key on the server? If I login as my root user and simply create the authorized_keys file within their home directory, it will have root owner and group permissions and they are unable to log in to the server.

Create it for them using the public key they supply you when they request the account. Chown it appropriately. Chmod it appropriately. Done.

0
/home/newuser/.ssh/authorized_key

Watch out for that typo :)

it's `authorized_keys'. It frustrated me for at least half an hour.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .