Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

New to creating users with linux. Trying to

  1. add users in a secure manner, limiting damage a user can do
  2. give all members of the webadmins group access to the public_html folder as projects are often shared
  3. restrict the webadmins from any other directories besides the public_html folder (SFTP, etc)
  4. use non-standard paths for my public_html location

I believe this is best done by

mkdir /nonstandard/path/public_html

Adding users by

useradd -d /nonstandard/path/public_html -g webadmins -m someuser -p password

Restricting them with ChrootDirectory

The Question
Is this the correct, secure way? Is it ok that users share a home directory? How can this be improved?

share|improve this question
    
imho, don't give them all same home dir but give everyone group privilege on the directory via chmod 775?? –  Chris K Feb 8 '13 at 20:57
    
Thanks. If they had access to the public_html directory, what would be gained by giving each user a different home directory? –  csi Feb 8 '13 at 21:04
    
A lot of programs use $HOME for storing state and configuration data. There are unintended consequences when users share $HOME. Linux/unix applications are designed with this philosophy in mind. –  Chris K Feb 8 '13 at 23:11

1 Answer 1

up vote 1 down vote accepted
  1. Restrict SSH to admin users only. Allow normal users via FTP and chroot them in the home folder. vsftpd can do that. You can use SSL/TLS with FTP.
  2. mkdir /nonstandard/path/public_html; chgrep -R webadmins /nonstandard/path/public_html;chmod -R g+r /nonstandard/path/public_html; find /nonstandard/path/public_html -type d -exec chmod g=rwxs \{\} \+
  3. You can use suEXEC in apache. Configure also the DocumentRoot
  4. See for this the apache configuration directive DocumentRoot.
share|improve this answer
    
THANKS! 1 - done. 2- thanks. 3 - haven't used su_exec. If limited to 3 users, all partners, is there still a reason for su_exec. Sorry, not familiar. 4 - was there supposed to be a link? –  csi Feb 8 '13 at 21:33
    
I've edited and added the links. I've changed the permissions to have set group ID for folders. In this way the users will be able to add files to that folder. –  Mircea Vutcovici Feb 8 '13 at 21:42
    
You do not need suEXEC if the users will collaborate and if they will edit the same site. –  Mircea Vutcovici Feb 8 '13 at 21:44
    
It is not clear what you want to protect. Take in consideration also to create a virtual machine for the site where the users have full or partial access. You can use Linux containers if you want only separation. –  Mircea Vutcovici Feb 8 '13 at 21:45
    
Great answer. Answered a lot of questions. Virtual machine is also an option. Thanks! –  csi Feb 8 '13 at 21:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.