Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am creating a small game server hosting company (just to help me learn Python, Django, and server administration) and thought that when the user signs up it will create a home directory for them so that instead of having game servers somewhere else it will be easier to manage if each person gets there own home directory to put the server files in (they get an actual Debian account that is the same as there username on the website). Is this a good idea and are there any security risks and how can I mitigate them if there are any?

share|improve this question
    
Are you going to give them shell access? –  Dennis Williamson Jul 18 '10 at 8:27
    
No, the Python script will move a copy of the game server to the home directory and run it there, thats it. They will have no shell access. –  Dr Hydralisk Jul 18 '10 at 9:21

1 Answer 1

up vote 3 down vote accepted

Whether or not to use "home" directories sounds like more of a design decision than necessarily just security. But wherever your store user-created files:

  • Use a dedicated partition. You do not want a user being able to halt logging and other system level stuff that needs root. This also makes upgrades and migrations way easier. If you're paranoid, then put them on dedicated hard drive(s).
  • Qoutas. Likewise, you don't want one user to bogart all the space and ruin everyone else's fun. Setup reasonable soft and hard quotas to prevent this.
  • Noexec. Mount the partition with noexec and nosetuid so that users can't upload and execute anything nasty (as easily). You likely want to do this with /tmp and other places your server writes files out to as well.
  • Backups. These are likely the most important files on your server, as you could rebuild the rest. Treat them as such.
  • Permissions. Make sure the default umask is what you want it.
  • public_html. Unless it's what you want to offer, check that the web server isn't configured to serve up user webpages.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.