Giving SSH access to a user, and security issues

Question

Okay, so I have a VPS and I made an account for a friend so he can host his own domains (using the reseller features in DirectAdmin). He's asking for SSH access, and I know that this is probably a bad idea. Does he have access to my whole server, such as executing commands, accessing my domains that I host on my server? I logged into my SSH using his account details and it let me navigate around all of the root folders/files, and his account is under /home/AccountName/.

Is there anyway to restrict his access to his folder only? And the commands he can use?

Edit: Can he install programs and whatnot on my server?

Answer 1

As a normal user your friend won't be able to do too much harm to your server (sure they could spawn off a fork bomb or fill your disk, but if they're really a friend they probably wouldn't pull a dick move like that). My friends get actual login shells on my machine if they ask for an account, and a stern lecture that if they do anything that pisses me off they'll get booted off the machine.

It sounds like you don't trust your "friend" very much, so in addition to The Rook's answer I'll also say that a halfway competent person with the ability to run a PHP script can be almost as dangerous as a user with unrestricted (login-able) SSH access, and I assume your server allows PHP. Remember that the user can run untrusted code via PHP, up to and including downloading, compiling and running other arbitrary programs on your system (albeit within the limitations of the web server user's privileges). Generally speaking unless you are chrooting/jailing your webserver anything your friend could have seen with his login shell he can see with some not-terribly-creative PHP scripting.

Bottom line: giving someone an account on your system and then locking out their shell in /etc/passwd & setting the SFTP chroot option helps, but you should really consider the security implications of any access, and your level of trust in this person.

Answer 2

Giving someone FTP access is one of the worst things you can do in terms of network secuirty. Worms will sniff network traffic looking for ftp and will use this to spread. I have personally cleaned up a few sites that where infected like this.

You can disable shell access to the user account in /etc/passwd, in this case ssh is only used for SFTP. You can also set the ChrootDirectory in your sshd_config file to prevent the user from access files outside of a directory tree of your choice. ChrootDirectory shouldn't be necessary, you should be using Linux's built in file access control. For instance if the file isn't owned by the user, and global privileges have been removed then that user will be unable to access the file. Use chmod 700 instead of 777. The last number is the global privileges, and 7 gives all users full access to that file. chown user:group filename is used to change the user/group that owns the file.

Answer 3

SSH and FTP etc. REQUIRE access to the rest of the files, since they run commands from the bin directories to list files etc. Some FTP/SSH servers support chroot to provide access to just the right files, or even fake the access completely.

You can (and should) secure your home directories and lock down any website files to just the users that need them. Your site(s) should probably be locked down to ownership yourname:www-data (on debian systems) or yourname:apache (on redhat systems), whilst his would be locked down to ownership hisname:www-data or hisname:apache (in the same way). Home and website directory Permissions should then be o=rwx,g=rx,o= files would be the same with no x. Set g+w and g+x as necessary for particular web apps to update their files. In particular, upload, temporary, and cache directories on sites will often need g+w permissions.

Run man chmod and man chown on your server and read if you're not sure what all this means.

Also, consider running something like plesk/webmin on your server to make management easier (not good, but maybe better if you're new to all this). Or, look into other reseller options that lock things down better so you don't have to.

Answer 4

If you are worried you could make a chroot environment for him, with only access to the tools and files he needs.