How to secure a group of *nix users to a single directory and it's subdirectories?

Question

We're setting up a CentOS 6.2/ Apache web server with higher security requirements than I'm used to.

I've set up a user group called "web" and I want to limit it's members to only being able to read, write and execute in /var/www/html/ and subdirectories.

Members of the "web" group should not be able to access any other part of the server (although individual user home directories are fine).

I thought this would be straight forward but have been going around in circles for the past half hour.

What bash commands do I need to use to achieve this?

Answer 1

Well, it seems to me that you'll need to jail the members of your group, otherwise they'll be able to see the content of your file system.

If you're going to allow ssh access to the users, you probably want to check this tutorial for chrooted ssh/sftp access: http://www.howtoforge.com/chrooted-ssh-sftp-tutorial-debian-lenny

Also, if this is the group apache will run under and you're going to host PHP applications, check out the php open_basedir directive in order to achieve such restriction: http://www.php.net/manual/en/ini.core.php#ini.open-basedir

Finally, if you're going to provide FTP access, I believe ftp servers such as vsftpd and proftpd will chroot its users by default, but the restriction will take place by their respective home directory.

Hope this helps you achieve your goal.