2

I have a LEMP stack (Ubuntu 20.04) which is perfectly configured and optimized by me. It has no any webpanel. I was first using it for my own websites only. Later I've started adding some client websites into server.

Since they've requested SFTP access to manage website files, I decided to make sure that they cannot access/edit sensitive files on the server.

List of the changes that I did to isolate uses as much as possible:

  1. Created a sudo user (lets call serveradmin) for myself and root access has been disabled
  2. chmod 700 /home/serveradmin (without -R)
  3. Created normal user accounts for my clients (ex. client1, client2...) and then added all of them to serveradmin group
  4. Set nginx user to serveradmin
  5. Created different php-fpm pool for each client. (ex. owner: client1 group: serveradmin, the same for listeners)
  6. Made sensitive website files inaccessible by others (ex. wp-config.php file includes database credentials)
  7. chmod -R 700 for website SSL folder.
  8. And of course, created different mysql users and databases for each of the clients.

Now, I'm 100% sure that no one can access to others /home/clientX folder. They cannot edit or remove any file at least. However, I'm not experienced linux user and not a hosting provider as well. the thing is that, Can those clients damage/hurt my server by accessing and editing any system files outside of /home folder? (for example /etc, /var/run paths might be dangerous I guess).

I didn't change folder/file permissions of the default system files.

So, Is my server unsecured? Does it still need changes to improve safety or should I totally avoid giving them SFTP access?

Kind regards.

0
3

At least points 3 and 4 are invalid/insecure.

  1. Created normal user accounts for my clients (ex. client1, client2...) and then added all of them to serveradmin group

What does a normal user account has to do with server admin? Absolutely nothing, even naming wise. What is the point of having each site user belong to the serveradmin group?

  1. Set nginx user to serveradmin

Likewise. NGINX should run under its own user, typically nginx (CentOS/RHEL distros) or www-data (Debian-based systems). It has nothing to do with server administration.

I can't go into details on how the current setup is insecure as this needs far more details like socket ownership for PHP, file locations, etc.

A truly secure setup assumes as much user separation as possible, and and this pertains to services. So start with allocating (or using the one provided by package) separate user for NGINX and follow through secure permissions for PHP-FPM. It is NGINX's user that should be in each site user's group, not the other way around:

usermod -a -G client1 nginx
usermod -a -G client2 nginx
...

Now nginx user belongs to client1 and client2 groups. Why, is because the nginx user really has to be able to read each and every website files.

PHP-FPM pools, on the other hand are fine to be bound to client1:client1 both in runtime and socket listen options.

3
  • Does php-fpm even require any overlap between socket permissions and php user? (I am assuming they are created pre-setuid, so there would be no need to create extra groups) – anx Dec 4 '20 at 8:19
  • 2
    @anx It is required in at least one case I can think of: suppose that you have set opcache.validate_timestamps=0 and making use of a utility like cachetool. You typically configure it with path to the socket file and run it as PHP user. That makes it necessary for the PHP user to be able to access the socket. – Danila Vershinin Dec 4 '20 at 11:14
  • Thank you very much @DanilaVershinin for the amazing tips. That totally makes sense! I wanted to add a quick notice: after changing nginx user, we should also change the ownership of the fastcgi directory: sudo chown -R www-data:root /var/lib/nginx/fastcgi. Otherwise it returns (13: Permission denied) error when I try to access WooCommerce admin pages. – Serdar Koçak Dec 8 '20 at 23:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.