Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am working on a website with someone. I want to give them access only to their home directory and the website directory. What is the easiest way to accomplish this? I also don't want this to mess up apache's permissions with the site. I am running Ubuntu.

share|improve this question
1  
You need to tell us what operating system you're running on your server computer. –  Evan Anderson Jul 6 '09 at 2:59
    
ok, just added it..ubuntu. thanks –  Tony Jul 6 '09 at 3:03
    
do they need to be able to run programs, or will just transfering files to your server be enough access for them? –  Tim Howland Jul 6 '09 at 3:09
    
just transferring files will be enough for now. however, i don't care if they can run programs because the guy isn't stupid and i trust him. i just don't want him to be able to access any system folders or any other websites on the server. he should only be able to access his home directory and the website folder "/var/www/website/public" –  Tony Jul 6 '09 at 3:16

3 Answers 3

up vote 2 down vote accepted

You could create a group for that website project, then add his user account to that group. Be certain the group has write access to the website folder.

If you'd like to make things slightly easier for him copying to the website folder you could create a link in his home folder to the project web folder.

groupadd projectX
useradd -G projectX consultantID
chown -R Apache:projectX /var/www/projectDir
cd ~consultantID
ln -s /var/www/projectDir
share|improve this answer
    
looking good. one missing piece though. how do i then allow myself to see the system directories but deny him? do i have to make an "admin" group for myself to see the system stuff? or is there a way to just deny him from everything except those 2 directories? thank you –  Tony Jul 6 '09 at 4:02
    
i guess my last comment is very system specific. i am just denying read access to any directory he can get to easily by doing "cd .." or something. i guess if he knows to go to specific directories then he will be able to see them. is it normal to make all of your system directories permission 751? i feel like maybe my entire system should be that –  Tony Jul 6 '09 at 4:19
    
well every user in general will get access to /bin most of the time. You can't deny him things that you deny everyone access to. Although he should be denied most anything harmful. Another option would be to create a script to update your production directory and have him do development out of his home directory. –  sparks Jul 6 '09 at 5:53
    
Adding to this, you will also need to use ACL's (getfacl/setfacl) or set the sticky bit (chmod g+s dir). That way you leave the files he edits editable by you too. –  churnd Jul 6 '09 at 14:00

You should reconfigure your home directories to not world-readable:

dpkg-reconfigure adduser

And check permissions for existing home dirs. I wouldn't worry to much about system folder access, linux default permissions are already meant for a multi user environment.

Afterwards put the user in his own group and create his webserver directory, make sure www-data is able to read there. Look out for other world writable folders though.

If your user is allowed to upload cgi/php scripts you probably want to look into suexec for apache, since those scripts will be running as user www-data. It is trivial to upload a php shell and browse other users document roots. Their home directories will be save if you removed the world read permission.

Update: I totally forgot to mention rbash. Just replace your users login shell with rbash and he won't be able to change directories anymore:

chsh -s /bin/rbash user
share|improve this answer

You can restrict them to just their home directory using chroot. But it is very complicated to setup. If it is worth it you can have look at Security focus article on building secure user environment.

You can also use option ChrootDirectory provided by SSH server. You would have to edit sshd_config file and enable chroot for that user.

If you really go for it then you can configure apache using Alias or VirtualHost to server files from some folder say ~/web. You can also enable UserDir so that user can see pages of folder "~/public_html" at

http://<domain>/~<username>

In either case do chmod o+x on his home directory so that apache can go inside it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.