I have a LEMP stack (Ubuntu 20.04) which is perfectly configured and optimized by me. It has no any webpanel. I was first using it for my own websites only. Later I've started adding some client websites into server.
Since they've requested SFTP access to manage website files, I decided to make sure that they cannot access/edit sensitive files on the server.
List of the changes that I did to isolate uses as much as possible:
- Created a sudo user (lets call serveradmin) for myself and root access has been disabled
chmod 700 /home/serveradmin(without
- Created normal user accounts for my clients (ex. client1, client2...) and then added all of them to serveradmin group
- Set nginx user to serveradmin
- Created different php-fpm pool for each client. (ex. owner: client1 group: serveradmin, the same for listeners)
- Made sensitive website files inaccessible by others (ex. wp-config.php file includes database credentials)
chmod -R 700for website SSL folder.
- And of course, created different mysql users and databases for each of the clients.
Now, I'm 100% sure that no one can access to others /home/clientX folder. They cannot edit or remove any file at least. However, I'm not experienced linux user and not a hosting provider as well. the thing is that, Can those clients damage/hurt my server by accessing and editing any system files outside of /home folder? (for example /etc, /var/run paths might be dangerous I guess).
I didn't change folder/file permissions of the default system files.
So, Is my server unsecured? Does it still need changes to improve safety or should I totally avoid giving them SFTP access?