0

Config: Debian Lenny Apache2

I have configured SSH to "PermitRootLogin no" and have created another user to login with and the do "su".

Now I want to connect with e.g. Filezilla via SFTP. I can do that by creating a user that only has access to "/var/www" (all my website are located there e.g. "/var/www/domain.com")

But doesn't that kinda defeat the idea of using "su"? Of course "su" in this case will secure everything else but "/var/www" will not get the added protection. The reason I created the "su" setup in the first place was to protect my websites better.

By the way, I am the only one that will be uploading stuff to the server.

What am I missing?

1
  • If you need just to download/upload files you can look at ProFTPD (mod_sftp) with /sbin/nologin as user shell and chroot.
    – ALex_hha
    Feb 21, 2016 at 22:50

3 Answers 3

1

Here my compendium for optimal configuration in both clients and servers:

http://wiki.gilug.org/index.php/How_to_mount_SFTP_accesses

(special care of users and permissions)

2

What you're missing is an understanding of what it means to su while logged in via ssh and what it means to transfer files in an encrypted manner. You're confusing several ideas here.

You've done the correct thing by denying root login via ssh. That will limit brute force attacks and keep you (since you'll need to elevate your privileges by using sudo or su) from making needless mistakes.

Having access via sftp does not give you the same privileges of su via ssh. It guarantees that your password will not be sent in the clear and that your files transfers are secure.

I'm going to go out on limb here and also suggest that you do a search on linux file permissions (for users and groups). Understanding those will help you secure your webserver and will help you understand why having a user that can su doesn't mean that your server is inherently insecure.

0

You could use extended ACLs to allow only your user write access to the directories (with setfacl). This also has the benefit of being easy to add future users to it.

Or, you could go with making the directory owned by your UID's group, and then make it group-writable, but I think this isn't as clean a solution as the above, and you might run into problems if your website needs to write to anything as the (presumably) Apache user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .