Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're setting up a CentOS 6.2/ Apache web server with higher security requirements than I'm used to.

I've set up a user group called "web" and I want to limit it's members to only being able to read, write and execute in /var/www/html/ and subdirectories.

Members of the "web" group should not be able to access any other part of the server (although individual user home directories are fine).

I thought this would be straight forward but have been going around in circles for the past half hour.

What bash commands do I need to use to achieve this?

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

Well, it seems to me that you'll need to jail the members of your group, otherwise they'll be able to see the content of your file system.

If you're going to allow ssh access to the users, you probably want to check this tutorial for chrooted ssh/sftp access: http://www.howtoforge.com/chrooted-ssh-sftp-tutorial-debian-lenny

Also, if this is the group apache will run under and you're going to host PHP applications, check out the php open_basedir directive in order to achieve such restriction: http://www.php.net/manual/en/ini.core.php#ini.open-basedir

Finally, if you're going to provide FTP access, I believe ftp servers such as vsftpd and proftpd will chroot its users by default, but the restriction will take place by their respective home directory.

Hope this helps you achieve your goal.

share|improve this answer
    
Thank you Luis. I'm heading home for the day but will crack into this tomorrow. –  Tama Feb 15 '12 at 3:03
    
Hi Luis. I found this link about chrooting in CentOS which almost exactly matched my situation: meshfields.de/sftp-chroot-centos - might be worth adding to your answer. –  Tama Feb 16 '12 at 1:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.