Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

After a long hesitation, I finally ordered a small VPS for my own use, basically web hosting (several websites, for me and friends) amongst other things (mumble server hosting, wave server, etc.). It will essentially be a basic LAMP box.

I'd like to offer some hosting space to a few friends, and to allow them to tweak it. This means they will need their own FTP access, and maybe SSH (if secure enough).

I have some experience in LAMP setup/administration, but not much in general server administration (user setup, ftp, etc). That's why I'd like to start from the basics and build something reliable and secure.

User management

Each of my friends will have their own user on the system, but is there something special to do about it ? Do I create one group per user, or do they all share the same group ? I guess this only changes if I allow them to login via SSH, but more on that later.

Web hosting

My first concern is the shared web hosting. Even if I will not host sensitive data, I don't want users messing around with others' files. I solved this problem before using PHP/CGI and Apache suexec, but after reading Stuart Herbert's awesome articles about web platforms, I feel like going with mpm-itk. Do you have any feedback on this ?

As my target user are kind of geeky, I was thinking about letting them tweak their own php.ini. What do you think about that ? Are there any potential security threats by doing so ?

They could for instance increase their memory limit a lot and affect other users, but I don't think this will be a problem.

FTP

Hard to deploy your website without FTP access, right ? I read a lot of pureftpd tutorials that explain how to create virtual users. This does not really apply to me, does it ? I was simply thinking about allowing the users to log via ftp, chroot them to their home dir, and that's it. Is there anything else (appart from disabling root access via ftp) ?

SSH

This is kind of my main issue. As a user, I always enjoyed being able to connect to my account via SSH, just to perform some batch operations, or extract an archive directly on the server instead of having to upload each individual file via FTP. However, I don't want my users to be able to browse through the whole filesystem, etc.. I'my not really familiar with SSH configuration, so is there a way of allowing users to connect and "chrooting" them to their home ?

Other thoughts

I'm already tweaking on my side, but I'd really like to have the input of all the wise gurus around here about how to do things right, and how to avoid the rookie mistakes. I have an easy-to-press "OS reset" button in the admin interface of my VPS, but I don't want to have to hit it regularly after seeing "H@ked by th3 H4xx00r5" message on all of my hosted websites.

share|improve this question
add comment

2 Answers

I deploy all my web content via SFTP, SCP, or by editing on the server (or through the CMS I've employed). FTP, per se, should not be needed.

Second - if you have user and group permissions correct, they won't be able to browse into other folks' websites via the commandline.

Certainly being able to login via SSH should be allowed, though, for exactly the reasons you stated.

I personally wouldn't let folks "tweak" their own php.ini files - I don't on the VPS I run in similar fashion to yours (ie, host a few sites for myself and friends). It's your server, and you're the one who's allowing others to use it: so let them use it according to your rules. I can't think of a shared hosting provider I've ever looked-at that allows people to tweak their php.ini settings.

What it's going to boil-down-to at some point, though, is trusting your friends to NOT do something mean/stupid/cruel to each other.

If you can't trust them - I wouldn't allow them to have access outside of a CMS.

For example, I set my different user's web roots thusly:

drwxr-x--- <user> apache

That allows apache to see and server content, but only the user can make changes.

share|improve this answer
1  
I agree with everything warren said. Avoid ftp if at all possible. If you do want to allow restricted access via ssh, look into rssh and scponly. These are alternate shells that can help restrict what users are able to do. –  EEAA Dec 3 '09 at 2:43
    
It is true that provided you have SSH access and thus can SFTP/SCP your file, FTP is not needed anymore. Plus, it's one less service to configure and maintain, and one less possible hole in my box. Thanks for pointing that out ! –  Wookai Dec 3 '09 at 3:03
    
Could you elaborate on the "user and group permissions" ? I don't know how to prevent others from browsing the whole filesystem once they logged in via SSH, except with chmod a-rwx / (which I won't do). –  Wookai Dec 3 '09 at 3:07
1  
There are relatively few places in the linux file tree that you really need to prevent people form reading. One place is /home/username of course, and that problem is easily solved by setting user and group ownership (and permisions) correctly. –  EEAA Dec 3 '09 at 5:07
    
@Wookai, @ErikA - I've modified my example –  warren Dec 3 '09 at 5:10
show 8 more comments

I've run a host for many, many years now. A few things I've found out in that time is that if you allow your users to run CGI scripts, it's more or less "all bets off." They cannot always do things unintended, but chances are you will feel the pain later for allowing this.

For one, you have drastically increased the security hole chances. I've had users install phpBB (under my suexec wrapper) and then never upgrade it... I've had people write CGI scripts themselves which were security holes waiting to happen -- only lack of popularity prevented it.

I put each user in their own group. It came in handy when I made a user for a purpose (like a MUD, back when those were popular) and the owner of the MUD could then tweak files using the group permissions.

In any case, if you're willing to help and willing to spend the time to ensure that people aren't doing bad things, most of this is pretty easy. Just takes time away from better things IMHO.

share|improve this answer
    
Sure, I totally agree. That's why I want PHP to run with the user's rights, such that it can only do limited harm (ie alter user's files, but nothing more). I guess it's up to the users to make sure their webiste is not a giant honeypot after that ! –  Wookai Dec 3 '09 at 5:42
    
suexec requires that your users are smarter, too, since every php script written seems to think it is being run from an Apache module... thus you need to add the #!/usr/bin/env php to every php script. Worse, some 'require' others, and then that line is rendered to the screen... not good. And hard to fix, and every upgrade requires the same fix again. I thought wrappers would help, but they're just as painful. –  Michael Graff Dec 3 '09 at 8:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.