1

I would like to:

  • give a SFTP access to a friend to his directory /home/friend on my server
  • give him a web hosting with Apache in /home/friend/www/
  • not allow him to visit /etc/ and similar directories (solved now), and not allow him to visit my own user's home /home/me (not solved for now)

To do this:

  • I created adduser friend

  • I added an Apache VirtualHost for him:

    <VirtualHost *:80>
        ServerName hiswebsite.com
        DocumentRoot /home/friend/www
        ...
    </VirtualHost>
    

    and service apache2 restart.

  • I "jailed" the SFTP/SSH access:

    PermitRootLogin yes
    ChallengeResponseAuthentication no
    UsePAM yes
    X11Forwarding yes
    PrintMotd no
    AcceptEnv LANG LC_*
    PasswordAuthentication yes
    GatewayPorts yes
    Subsystem sftp internal-sftp
    Match User friend
    ChrootDirectory /home/
    ForceCommand internal-sftp
    

    and service sshd restart.

Problems:

  1. friend now cannot go out of /home/ (this is good), but he can still go to /home/me/ and read the files inside! How to only give him access to /home/friend/ and nothing else? This does not seem possible because:

    ChrootDirectory
    Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group.

  2. Should I

    • add user friend to group www-data?
    • or add user www-data to group friend?
    • or another user/group setting?

      to allow Apache to serve the files, and PHP to have write access to /home/friend/www/? Let's say there is a file uploader on his website: PHP needs to write in this directory. Which permissions to give to /home/friend and /home/me?


Linked topics:

What's the best way of handling permissions for Apache?

What permissions should my website files/folders have on a Linux webserver?

  • 2
    Why do you need a chroot jail for this? if permissions are correct, a regular user should suffice. – Panki Jan 10 at 9:19
  • @Panki Permissions can be tricky because we want Apache+PHP to have read+write access, but we don't want each user to have access to the other user's home. Maybe would you have an answer for 2.? (without chroot jail) Thanks in advance. – Basj Jan 10 at 9:35
  • Have you considered running two instances of apache, running as different groups. Then use nginx as a reverse-proxy to do the vhosts. (It will also protect apache from a slow-loris). – ctrl-alt-delor Jan 17 at 21:46
3
+50

Current situation

Warning for this section, this is only recommended if your only usage is web-hosting, apache is not meant to have access to home user's folder (other suggestion at the end of the answer may be more suitable).


  1. Web/Apache group (www-data group) must have all users using the service
  2. Apache and the users need to have access to their respective www while limiting access between each others
    • Each directory under /home should have www-data:user rights
        chown www-data:me /home/me

OR

  1. Web/Apache group (www-data group) must have all users using the service
  2. Apache and the users need to have access to their respective www while limiting access between each other
    • Home user's folder should have the right chown me:me /home/me
    • Make /home belong to apache chown www-data:root /home

Like that, apache would have access to the necessary www directory and users won't have access to other users folders.

The key here is the group permission is shared between users while apache itself is a user that is not exposed to other user, for instance chown www:me /home/me keep me isolated from other user while granting access to apache and me (and chown me:www /home/me would let everyone on the group www access me folder)

The directory www need to be present in a location that belong to apache (www-data user) in your current config setting /home/me to www-data:me or /home to www-data:root is a workaround because you are locating www inside the user directory.

This is why the default www location is under /var and not under the home directory, to let apache and the user have w/r to www without giving apache unnecessary access (like in this case access to the whole user's folder)

If your home folder is only meant for www (web usage) you are fine with the current suggestion/config, now if you are using the system for additional purpose more than web hosting; then www should not reside on /home folder but on another location like /var; in that case you would need to remove ChrootDirectory usage and instead go for a classic config where the file access would be managed only by file access permission, here is some reading about restriction to a classic user...

If you want security, separation, web hosting plus other Linux/server usage for each user, you would need to implement a different solution evolving virtualisation and/or sandboxing.

Note that there are many other possibilities to achieve what you are asking but this one is the fastest regarding your config, read the section Final suggestion below for a more suitable implementation.

The config

The implementation depends on the targeted security level and the targeted usage. Thus one config could be great for one situation and at the same time bad for another situation.

Your current config is not far from a classic one where instead of ChrootDirectory classic file permissions, group, and user access level would be used to manage the separation between each ssh user. I guess that you are just missing user access level on your config to achieve that. Here are some details on how to implement that here, here and here (that said using ChrootDirectory in addition to that is a good security practice)

Alternative (hardened security)

First PermitRootLogin yes should never be used, instead add me user to the suders. Root will then be accessible through me user with sudo su or su

If you are targeting a hardened security, Kernel user space feature can be used, which will separate completely each user, but this is a whole other config. This can be achieved with the native Linux tools and/or firejail to separate files/network etc.

Also in the same scope of hardened security, authentication with private/public key should be used instead of PasswordAuthentication yes

SSHFS may also be an alternative to separate the hosted file.

Also here are some interesting link on the topic:

Final suggestion

Finally, regarding your config I would just suggest

  • Disabling PermitRootLogin
  • Review users and /home right.
  • In the case of unique web hosting usage
    • Apply the suggested permission, not for /home directory but use a structure like /var/apache/user1,user2,etc. then use ChrootDirectory /var/apache/
  • In the case of multi-purpose system
    • Many possibilities can be used here one of them is applying the suggested permission, not for /home directory but use a structure like /var/apache/user1,user2,etc without using ChrootDirectory then manage permission with file access rights.
| improve this answer | |
  • Thank you for your comment. (minor typo: "servie"). Could you add details about recommended permissions in such a shared hosting situation? – Basj Jan 12 at 12:47
  • I tried your solution: drwxrwx--- 5 me me 4096 Feb 26 2019 www (i.e. me:me ownership and 770 permission for www) + adduser me www-data (i.e. add user me to www-data). But Apache can't access the files even if me is now member of group www-data. Any idea? – Basj Jan 12 at 21:01
  • @Basj my bad, i did forget that you are locating www under the home folder... The traversal permission is a must for a user/apache to access child sub-folders... i rewrote my answer completely it's now en-globing the whole situation enjoy ;) – intika Jan 12 at 23:31
  • @jeff-schaller thanks for the edit :) – intika Jan 19 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.