Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Config: Debian Lenny Apache2

I have configured SSH to "PermitRootLogin no" and have created another user to login with and the do "su".

Now I want to connect with e.g. Filezilla via SFTP. I can do that by creating a user that only has access to "/var/www" (all my website are located there e.g. "/var/www/domain.com")

But doesn't that kinda defeat the idea of using "su"? Of course "su" in this case will secure everything else but "/var/www" will not get the added protection. The reason I created the "su" setup in the first place was to protect my websites better.

By the way, I am the only one that will be uploading stuff to the server.

What am I missing?

share|improve this question

4 Answers 4

up vote 1 down vote accepted

Here my compendium for optimal configuration in both clients and servers:

http://wiki.lapipaplena.org/index.php/How_to_mount_SFTP_accesses

(special care of users and permissions)

share|improve this answer

What you're missing is an understanding of what it means to su while logged in via ssh and what it means to transfer files in an encrypted manner. You're confusing several ideas here.

You've done the correct thing by denying root login via ssh. That will limit brute force attacks and keep you (since you'll need to elevate your privileges by using sudo or su) from making needless mistakes.

Having access via sftp does not give you the same privileges of su via ssh. It guarantees that your password will not be sent in the clear and that your files transfers are secure.

I'm going to go out on limb here and also suggest that you do a search on linux file permissions (for users and groups). Understanding those will help you secure your webserver and will help you understand why having a user that can su doesn't mean that your server is inherently insecure.

share|improve this answer

You could use extended ACLs to allow only your user write access to the directories (with setfacl). This also has the benefit of being easy to add future users to it.

Or, you could go with making the directory owned by your UID's group, and then make it group-writable, but I think this isn't as clean a solution as the above, and you might run into problems if your website needs to write to anything as the (presumably) Apache user.

share|improve this answer

A domain name has changed for Lapipaplena. Please update your link for: http://wiki.gilug.org/index.php/How_to_mount_SFTP_accesses

share|improve this answer
    
What do you want to tell with "A domain name has changed for Lapipaplena."? –  xhochy Oct 30 '12 at 8:55
    
This should be a commment to the other answer, not an answer by itself. –  Sven Oct 30 '12 at 9:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.