Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Okay, so I have a VPS and I made an account for a friend so he can host his own domains (using the reseller features in DirectAdmin). He's asking for SSH access, and I know that this is probably a bad idea. Does he have access to my whole server, such as executing commands, accessing my domains that I host on my server? I logged into my SSH using his account details and it let me navigate around all of the root folders/files, and his account is under /home/AccountName/.

Is there anyway to restrict his access to his folder only? And the commands he can use?

Edit: Can he install programs and whatnot on my server?

share|improve this question

4 Answers 4

up vote 3 down vote accepted

As a normal user your friend won't be able to do too much harm to your server (sure they could spawn off a fork bomb or fill your disk, but if they're really a friend they probably wouldn't pull a dick move like that). My friends get actual login shells on my machine if they ask for an account, and a stern lecture that if they do anything that pisses me off they'll get booted off the machine.

It sounds like you don't trust your "friend" very much, so in addition to The Rook's answer I'll also say that a halfway competent person with the ability to run a PHP script can be almost as dangerous as a user with unrestricted (login-able) SSH access, and I assume your server allows PHP. Remember that the user can run untrusted code via PHP, up to and including downloading, compiling and running other arbitrary programs on your system (albeit within the limitations of the web server user's privileges). Generally speaking unless you are chrooting/jailing your webserver anything your friend could have seen with his login shell he can see with some not-terribly-creative PHP scripting.

Bottom line: giving someone an account on your system and then locking out their shell in /etc/passwd & setting the SFTP chroot option helps, but you should really consider the security implications of any access, and your level of trust in this person.

share|improve this answer
    
He's a friend in the way that we know each other through an online community and we've exchanged words a few times. The reason why I'm giving him a hand is because his host (shared server) shut his site down for going over the limits so I generously offered to host his site free on my VPS (about $100 a month). He is also a respected person in the community that we're both a part of (he's a gamer - finished 2nd place in a WCG event a few years back). Here's what shows up in /etc/password for his account: AccountName:x:502:502::/home/AccountName:/bin/bash ..what exactly would I need to change? –  Kris Sauquillo Apr 28 '10 at 20:24

Giving someone FTP access is one of the worst things you can do in terms of network secuirty. Worms will sniff network traffic looking for ftp and will use this to spread. I have personally cleaned up a few sites that where infected like this.

You can disable shell access to the user account in /etc/passwd, in this case ssh is only used for SFTP. You can also set the ChrootDirectory in your sshd_config file to prevent the user from access files outside of a directory tree of your choice. ChrootDirectory shouldn't be necessary, you should be using Linux's built in file access control. For instance if the file isn't owned by the user, and global privileges have been removed then that user will be unable to access the file. Use chmod 700 instead of 777. The last number is the global privileges, and 7 gives all users full access to that file. chown user:group filename is used to change the user/group that owns the file.

share|improve this answer

SSH and FTP etc. REQUIRE access to the rest of the files, since they run commands from the bin directories to list files etc. Some FTP/SSH servers support chroot to provide access to just the right files, or even fake the access completely.

You can (and should) secure your home directories and lock down any website files to just the users that need them. Your site(s) should probably be locked down to ownership yourname:www-data (on debian systems) or yourname:apache (on redhat systems), whilst his would be locked down to ownership hisname:www-data or hisname:apache (in the same way). Home and website directory Permissions should then be o=rwx,g=rx,o= files would be the same with no x. Set g+w and g+x as necessary for particular web apps to update their files. In particular, upload, temporary, and cache directories on sites will often need g+w permissions.

Run man chmod and man chown on your server and read if you're not sure what all this means.

Also, consider running something like plesk/webmin on your server to make management easier (not good, but maybe better if you're new to all this). Or, look into other reseller options that lock things down better so you don't have to.

share|improve this answer

If you are worried you could make a chroot environment for him, with only access to the tools and files he needs.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.