0

I have a friend who is getting into web dev and he is currently developing on a php/apache setup.

I use nginx and arbirtrary server languages which is what is currently running on my (ubuntu) server.

I'm wondering how I can setup a user account and permissions that would allow him to log in and install apache, some php modules, and his website without jeopardizing my security.

Improve this question

3 Answers 3

Reset to default
1

If you want him to do the software installation and administration, you're going to need to give him root access and trust him with everything.

If you want to deal with the complexities of doing the administration required to run a multiuser server, you could do that. Although he would always be making requests for you to modify various things. It would get tiring very quickly, even if you make it past the complexities of properly configuring a multiuser server.

The goal you're trying to achieve is the same one that inspired cPanel.

Rather than do all of that from scratch, you should consider researching control panels such as Webmin, cPanel, Plesk, Ensim, DirectAdmin, etc etc.

Improve this answer
1

This sounds like something that might be suited to Docker.

  • Option 1: Build him an image that he can use as a sandbox.
  • Option 2: Give him a standard user account on your host OS and add him to the docker group.

If you really care about security, a third option would be to give him full control (root access) of something like a Raspberry Pi. The Pi can be used in headless mode with ssh access, which should be enough for web dev. Make a backup of the SD card using dd and gzip/7zip, and if something goes terribly wrong you have a way to restore to a good state.

Improve this answer
1
  • Just to add in another thought I had this morning: you can set up an Ubuntu VM using a bridged network and give him root access to it. You can use snapshots to make an easy backup.
    – Jordan Deyton
    Aug 20, 2020 at 17:08
0

First obvious step: audit what is world writable, and what is confidential and world readable.

Second, I believe you create users with the command adduser. (This only applies to choices 1 and 2 below.)

Third, there are several choices for installing apache and the like.

  1. You can install it system wide and configure it to a non-standard port. You might also need to configure it to a different user id, as the standard installs of both webserver may use the same user.
  2. You can let him do source installs of apache and whatever else he needs. This significantly more painful for him, but easier for you.
  3. Instead of creating a normal user for him, you could install xen (or something similar), and run a virtual machine just for him. On this virtual machine, you could give him root access. He would be constrained to the virtual machine. In managing the VM, you could limit his memory usage and CPU usage.
  4. With Linux namespaces, it is possible to create something similar to a virtual machine, but running in the same kernel. I haven't seen a good package for this, but they may exist. This can also let you give him root access.

Which you choose is probably based on how much administration he wants to do, and how much you want to do.

Another available choice: let him get a VM on a hosting service. Amazon for instance will give him a small virtual machine free for a year.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .