Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to securely have many to many users on virtual hosts

I currently setup a single user on my virtual host like this:

sudo useradd -d /website/ -m user -s /usr/bin/rssh

sudo chown root:root /website/ -R #Don't get why I need this part but doesn't work without! 
sudo chmod 755 /website/
sudo chown -R user:www-data /website/public_html
sudo chmod 755 /website/public_html

This works for user to add and edit folders and files within /website/public_html.

I now want to be able to add other users with the ability to add and edit folders and files within /website/public_html. The issue with this, is that if I get into using groups and add users to the group www-data and change the chmod to 775 the users will then be able to edit other virtual hosts websites for example /website2/public_html.

All users (as you can see above) can only access the server through sftp (-s /usr/bin/rssh). Users are also locked to their home directories with the help of settings from sshd_config†. As of that I suppose I could add all the users to the same group (www-data) and chmod 775 the directory or is that not safe ?

For example here someone mentions that giving the virtual hosts 775 permissions may allow for users to insert php scripts that could delete everything. But without it being 775 this also does not allow for php to create files.

†:

Match user user
        ChrootDirectory /website/
        ForceCommand internal-sftp
        AllowTcpForwarding no
        GatewayPorts no
        X11Forwarding no
like image 838
maxisme Avatar asked Aug 09 '15 20:08

maxisme


People also ask

How many virtual host can one Apache installation contain?

If each virtual host has its own log, the limit is likely 64 due to file descriptor limits. However, you can configure Apache to run more using this guide.

Where should a virtual host be configured in an API proxy?

If you have any existing API proxies, add the virtual host to the <HTTPConnection> element in the Proxy Endpoint. The virtual host is added automatically to all new API proxies. See Configuring an API proxy to use a virtual host.

What is IP-based virtual hosting?

IP-based virtual hosting is a method to apply different directives based on the IP address and port a request is received on. Most commonly, this is used to serve different websites on different ports or interfaces.


1 Answers

You can create a new group for each virtual host and add www-data and other granted users to this. Then set that group as the owner of your files (chown). With specifying an appropriate permission (like 775) you will be there.

like image 200
Ahmad Avatar answered Sep 26 '22 01:09

Ahmad