1

After a long hesitation, I finally ordered a small VPS for my own use, basically web hosting (several websites, for me and friends) amongst other things (mumble server hosting, wave server, etc.). It will essentially be a basic LAMP box.

I'd like to offer some hosting space to a few friends, and to allow them to tweak it. This means they will need their own FTP access, and maybe SSH (if secure enough).

I have some experience in LAMP setup/administration, but not much in general server administration (user setup, ftp, etc). That's why I'd like to start from the basics and build something reliable and secure.

User management

Each of my friends will have their own user on the system, but is there something special to do about it ? Do I create one group per user, or do they all share the same group ? I guess this only changes if I allow them to login via SSH, but more on that later.

Web hosting

My first concern is the shared web hosting. Even if I will not host sensitive data, I don't want users messing around with others' files. I solved this problem before using PHP/CGI and Apache suexec, but after reading Stuart Herbert's awesome articles about web platforms, I feel like going with mpm-itk. Do you have any feedback on this ?

As my target user are kind of geeky, I was thinking about letting them tweak their own php.ini. What do you think about that ? Are there any potential security threats by doing so ?

They could for instance increase their memory limit a lot and affect other users, but I don't think this will be a problem.

FTP

Hard to deploy your website without FTP access, right ? I read a lot of pureftpd tutorials that explain how to create virtual users. This does not really apply to me, does it ? I was simply thinking about allowing the users to log via ftp, chroot them to their home dir, and that's it. Is there anything else (appart from disabling root access via ftp) ?

SSH

This is kind of my main issue. As a user, I always enjoyed being able to connect to my account via SSH, just to perform some batch operations, or extract an archive directly on the server instead of having to upload each individual file via FTP. However, I don't want my users to be able to browse through the whole filesystem, etc.. I'my not really familiar with SSH configuration, so is there a way of allowing users to connect and "chrooting" them to their home ?

Other thoughts

I'm already tweaking on my side, but I'd really like to have the input of all the wise gurus around here about how to do things right, and how to avoid the rookie mistakes. I have an easy-to-press "OS reset" button in the admin interface of my VPS, but I don't want to have to hit it regularly after seeing "H@ked by th3 H4xx00r5" message on all of my hosted websites.

3 Answers 3

5

I deploy all my web content via SFTP, SCP, or by editing on the server (or through the CMS I've employed). FTP, per se, should not be needed.

Second - if you have user and group permissions correct, they won't be able to browse into other folks' websites via the commandline.

Certainly being able to login via SSH should be allowed, though, for exactly the reasons you stated.

I personally wouldn't let folks "tweak" their own php.ini files - I don't on the VPS I run in similar fashion to yours (ie, host a few sites for myself and friends). It's your server, and you're the one who's allowing others to use it: so let them use it according to your rules. I can't think of a shared hosting provider I've ever looked-at that allows people to tweak their php.ini settings.

What it's going to boil-down-to at some point, though, is trusting your friends to NOT do something mean/stupid/cruel to each other.

If you can't trust them - I wouldn't allow them to have access outside of a CMS.

For example, I set my different user's web roots thusly:

drwxr-x--- <user> apache

That allows apache to see and server content, but only the user can make changes.

13
  • 1
    I agree with everything warren said. Avoid ftp if at all possible. If you do want to allow restricted access via ssh, look into rssh and scponly. These are alternate shells that can help restrict what users are able to do.
    – EEAA
    Dec 3, 2009 at 2:43
  • It is true that provided you have SSH access and thus can SFTP/SCP your file, FTP is not needed anymore. Plus, it's one less service to configure and maintain, and one less possible hole in my box. Thanks for pointing that out !
    – Wookai
    Dec 3, 2009 at 3:03
  • Could you elaborate on the "user and group permissions" ? I don't know how to prevent others from browsing the whole filesystem once they logged in via SSH, except with chmod a-rwx / (which I won't do).
    – Wookai
    Dec 3, 2009 at 3:07
  • 1
    There are relatively few places in the linux file tree that you really need to prevent people form reading. One place is /home/username of course, and that problem is easily solved by setting user and group ownership (and permisions) correctly.
    – EEAA
    Dec 3, 2009 at 5:07
  • @Wookai, @ErikA - I've modified my example
    – warren
    Dec 3, 2009 at 5:10
1

I've run a host for many, many years now. A few things I've found out in that time is that if you allow your users to run CGI scripts, it's more or less "all bets off." They cannot always do things unintended, but chances are you will feel the pain later for allowing this.

For one, you have drastically increased the security hole chances. I've had users install phpBB (under my suexec wrapper) and then never upgrade it... I've had people write CGI scripts themselves which were security holes waiting to happen -- only lack of popularity prevented it.

I put each user in their own group. It came in handy when I made a user for a purpose (like a MUD, back when those were popular) and the owner of the MUD could then tweak files using the group permissions.

In any case, if you're willing to help and willing to spend the time to ensure that people aren't doing bad things, most of this is pretty easy. Just takes time away from better things IMHO.

2
  • Sure, I totally agree. That's why I want PHP to run with the user's rights, such that it can only do limited harm (ie alter user's files, but nothing more). I guess it's up to the users to make sure their webiste is not a giant honeypot after that !
    – Wookai
    Dec 3, 2009 at 5:42
  • suexec requires that your users are smarter, too, since every php script written seems to think it is being run from an Apache module... thus you need to add the #!/usr/bin/env php to every php script. Worse, some 'require' others, and then that line is rendered to the screen... not good. And hard to fix, and every upgrade requires the same fix again. I thought wrappers would help, but they're just as painful. Dec 3, 2009 at 8:31
1

I'd go with PHP-FPM and nginx, it's the way I've gone with my 20 or so PHP dedicated servers, in that way you can obtain both your objectives, PHP will run under the "pool" defined user, and your users can tweak their php.ini (although it will be called .user.ini, in their document root), without getting in the hassle of configuring suexec. https://www.vultr.com/docs/use-php-fpm-pools-to-secure-multiple-web-sites

If you decide to run PHP-FPM with Apache HTTPD, I'd suggest to use mpm or event worker instead of the default prefork worker. https://www.digitalocean.com/community/tutorials/how-to-configure-apache-http-with-mpm-event-and-php-fpm-on-ubuntu-18-04

However, PHP-FPM works ONLY for PHP, if your users want to execute other CGI, you will have to configure suexec all the same.

I'd avoid FTP like the plague, in favor of FTPS or better, SFTP which is already installed if you have SSH.

With SFTP you can chroot users to their home directories, via group match or direct user match, you can force your users to use a RSA key instead of a password (more secure), just by tweaking your sshd_config, https://www.tecmint.com/restrict-ssh-user-to-directory-using-chrooted-jail/

Even more, with chrooting you can decide if your users should have SSH access or SFTP-only.

Finally, allow me to share the wisdom my old system administrator shared with me while teaching me (read with the voice of Samuel Jackson):

your users are your enemy,
they will put crap on your server,
they will fill it to the brim,
they will use every watt of power it has,
they will try to access what they shouldn't,
you are ultimately responsible for your server
and what they do with it.

Of course, if you shared more specifics, like for example the OS used on the server, we could help more, since these are the settings that are in different places on most distros.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .