After a long hesitation, I finally ordered a small VPS for my own use, basically web hosting (several websites, for me and friends) amongst other things (mumble server hosting, wave server, etc.). It will essentially be a basic LAMP box.
I'd like to offer some hosting space to a few friends, and to allow them to tweak it. This means they will need their own FTP access, and maybe SSH (if secure enough).
I have some experience in LAMP setup/administration, but not much in general server administration (user setup, ftp, etc). That's why I'd like to start from the basics and build something reliable and secure.
User management
Each of my friends will have their own user on the system, but is there something special to do about it ? Do I create one group per user, or do they all share the same group ? I guess this only changes if I allow them to login via SSH, but more on that later.
Web hosting
My first concern is the shared web hosting. Even if I will not host sensitive data, I don't want users messing around with others' files. I solved this problem before using PHP/CGI and Apache suexec
, but after reading Stuart Herbert's awesome articles about web platforms, I feel like going with mpm-itk
. Do you have any feedback on this ?
As my target user are kind of geeky, I was thinking about letting them tweak their own php.ini. What do you think about that ? Are there any potential security threats by doing so ?
They could for instance increase their memory limit a lot and affect other users, but I don't think this will be a problem.
FTP
Hard to deploy your website without FTP access, right ? I read a lot of pureftpd tutorials that explain how to create virtual users. This does not really apply to me, does it ? I was simply thinking about allowing the users to log via ftp, chroot them to their home dir, and that's it. Is there anything else (appart from disabling root access via ftp) ?
SSH
This is kind of my main issue. As a user, I always enjoyed being able to connect to my account via SSH, just to perform some batch operations, or extract an archive directly on the server instead of having to upload each individual file via FTP. However, I don't want my users to be able to browse through the whole filesystem, etc.. I'my not really familiar with SSH configuration, so is there a way of allowing users to connect and "chrooting" them to their home ?
Other thoughts
I'm already tweaking on my side, but I'd really like to have the input of all the wise gurus around here about how to do things right, and how to avoid the rookie mistakes. I have an easy-to-press "OS reset" button in the admin interface of my VPS, but I don't want to have to hit it regularly after seeing "H@ked by th3 H4xx00r5" message on all of my hosted websites.