Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

tl;dr:

I need:

  • FTP access to a Debian server for multiple users
  • Micro management of which users have access to which directories at a given time (imagine a telephone switchboard operator!)
  • A solution that doesn't suck (e.g. I suggest mount --bind below, does that suck when scaled?)

The long story

Hi All,

I am the sysadmin for a public facing Debian server. This server primarily serves websites from a custom built CMS. We have many contractors who are preparing themes for these websites which are served from another server where they have FTP access (this is a convenience while the themes are under development). The themes are comprised of a CSS file plus supporting fonts/images. The contractors do not currently have direct access to the server that hosts the website (and is the ultimate resting place for the themes). This has been a deliberate security decision but I'm looking at opening that up now as it is preventing them from making changes to markup which is the source of much frustration.

The way the system works is that each website has it's own "filestore" directory which is where the theme and any custom code for the website (MVC type structure) is based. The CMS application lives in /apps/appname and the filestore directory lives on the same filesystem in /apps/filestore. Each website has an ID and it's files are stored in /apps/filestore/1234 for example.

I have recently installed proftpd to see whether I can configure it as required and so far so good. I have specified that users (actual users on the machine) are locked to their home directories which prevents them from escaping and exploring the filesystem, however I still want to selectively grant and revoke their access to the filestore directories which are outside of their home directories. In my case giving them access to the entire server and limiting their access via user and group permissions isn't really an option.

For example, if bob needs to work on /apps/filestore/1234 I have discovered that I can mount that directory from bob's home directory as follows:

root@server:/home/bob# mkdir -p filestore/1234
root@server:/home/bob# mount --bind /apps/filestore/1234 /home/bob/filestore/1234

Then bob can log into his FTP account, go into filestore/1234 and access the files as required. I can then remove his access by unmounting the directory later. This appears to work just nicely. It will be a small sysadmin pain to have to do the mounting by hand all the time so I need to automate the mounting / unmounting a little better, but is this the right way to do it?

Thanks for your comments!

- Bob -

share|improve this question
    
What type of automation do you want? Removing Bob's access will be a manual call at some point... how far down the stack do you want to go though? is a myScript_add.sh <id> <username> and myScript_rem.sh <id> <username> enough automation? What are you looking for? I still am not in love with the mount solution you have found, but it is YOUR server. –  lVlint67 Sep 30 '13 at 20:24
    
The automation could be managed via a tool already on the server where we can queue commands to be run as root (your add.sh/rem.sh would fit in nicely). I can see the mount method resulting in tens and tens of mounts existing for the sake of this and I'm not so keen on that hence the question. I love it because it works but I'm also very aware of the "you made it now you have to feed it" problem. –  Bob M Brown Oct 1 '13 at 3:24
    
@lVlint67 I added a few bullet points of what I actually want at the top of the question to clarify. Thanks for your time. –  Bob M Brown Oct 1 '13 at 3:39
add comment

2 Answers

Most people approach this problem by giving each contractor an account and using chown and chmod to set permissions on the filesystem to limit the access that these users have.

share|improve this answer
    
True, although restricting access via group isn't useful - the files will be owned by www-data and groupwise I can't see how this would work. Ideally I don't want them to be able to (or have to) walk the directory tree and have to know the layout of the application. I'll update the question to clarify this point. –  Bob M Brown Sep 30 '13 at 19:43
add comment

From our hosting guys: Bind mounts may cause problems with data being backed up multiple times and will be annoying when removing your ftp users (you will have to unmount first, then remove from fstab, then remove the users home directory, etc), other than that there shouldn't be a problem with using them for this purpose and they'll definitely scale up to 10s of 1000s of mounts with no issues.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.