I'm in the process of configuring a cloud server to run the following stack: Ruby, Passenger, Apache; under Ubuntu 10.04 (Lucid Lynx).
In the process of wanting to make the server easier to manage I setup RSA keys on
www-data so that I can
ssh into the server. The thing I didn't like was that
.ssh directory sat in
/var/www which is the default directory setup for apache. My worry is that if apache isn't configured properly then the
.ssh directory can be exposed.
I came across the solution to move the
~/.ssh/authorized_keys file into a central location by changing
/etc/ssh/sshd_config. This comes with 2 pros: A single location for keys, and not having to worry about a bad apache configuration. The single con that I can think of is that now every user is available for login on the server (clearly a double edged sword of the central key file.)
Is there anything that I've missed in this configuration? Have I over exposed myself, or is this a better solution than individual
I'm green when it comes to server management, but am totally ready to be called bad names for doing bad things. :D