2

I would like to:

  • give a SFTP access to a friend to his directory /home/friend on my server
  • give him a web hosting with Apache in /home/friend/www/
  • not allow him to visit /etc/ and similar directories (solved now), and not allow him to visit my own user's home /home/me (not solved for now)

To do this:

  • I created adduser friend

  • I added an Apache VirtualHost for him:

    <VirtualHost *:80>
    ServerName hiswebsite.com
    DocumentRoot /home/friend/www
    ...
</VirtualHost>

    and service apache2 restart.

  • I "jailed" the SFTP/SSH access:

    PermitRootLogin yes
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintMotd no
AcceptEnv LANG LC_*
PasswordAuthentication yes
GatewayPorts yes
Subsystem sftp internal-sftp
Match User friend
ChrootDirectory /home/
ForceCommand internal-sftp

    and service sshd restart.

Problems:

  1. friend now cannot go out of /home/ (this is good), but he can still go to /home/me/ and read the files inside! How to only give him access to /home/friend/ and nothing else? This does not seem possible because:

    ChrootDirectory
    Specifies the pathname of a directory to chroot(2) to after authentication. All components of the pathname must be root-owned directories that are not writable by any other user or group.

  2. Should I

    • add user friend to group www-data?
    • or add user www-data to group friend?

    • or another user/group setting?

      to allow Apache to serve the files, and PHP to have write access to /home/friend/www/? Let's say there is a file uploader on his website: PHP needs to write in this directory. Which permissions to give to /home/friend and /home/me?

Linked topics:

What's the best way of handling permissions for Apache?

What permissions should my website files/folders have on a Linux webserver?

Improve this question
3
  • 2
    Why do you need a chroot jail for this? if permissions are correct, a regular user should suffice. Commented Jan 10, 2020 at 9:19
  • @Panki Permissions can be tricky because we want Apache+PHP to have read+write access, but we don't want each user to have access to the other user's home. Maybe would you have an answer for 2.? (without chroot jail) Thanks in advance. Commented Jan 10, 2020 at 9:35
  • Have you considered running two instances of apache, running as different groups. Then use nginx as a reverse-proxy to do the vhosts. (It will also protect apache from a slow-loris). Commented Jan 17, 2020 at 21:46

2 Answers 2

Reset to default
3
+50

Current situation

Warning for this section, this is only recommended if your only usage is web-hosting, apache is not meant to have access to home user's folder (other suggestion at the end of the answer may be more suitable).

  1. Web/Apache group (www-data group) must have all users using the service
  2. Apache and the users need to have access to their respective www while limiting access between each others
    • Each directory under /home should have www-data:user rights
        chown www-data:me /home/me

OR

  1. Web/Apache group (www-data group) must have all users using the service
  2. Apache and the users need to have access to their respective www while limiting access between each other
    • Home user's folder should have the right chown me:me /home/me
    • Make /home belong to apache chown www-data:root /home

Like that, apache would have access to the necessary www directory and users won't have access to other users folders.

The key here is the group permission is shared between users while apache itself is a user that is not exposed to other user, for instance chown www:me /home/me keep me isolated from other user while granting access to apache and me (and chown me:www /home/me would let everyone on the group www access me folder)

The directory www need to be present in a location that belong to apache (www-data user) in your current config setting /home/me to www-data:me or /home to www-data:root is a workaround because you are locating www inside the user directory.

This is why the default www location is under /var and not under the home directory, to let apache and the user have w/r to www without giving apache unnecessary access (like in this case access to the whole user's folder)

If your home folder is only meant for www (web usage) you are fine with the current suggestion/config, now if you are using the system for additional purpose more than web hosting; then www should not reside on /home folder but on another location like /var; in that case you would need to remove ChrootDirectory usage and instead go for a classic config where the file access would be managed only by file access permission, here is some reading about restriction to a classic user...

If you want security, separation, web hosting plus other Linux/server usage for each user, you would need to implement a different solution evolving virtualisation and/or sandboxing.

Note that there are many other possibilities to achieve what you are asking but this one is the fastest regarding your config, read the section Final suggestion below for a more suitable implementation.

The config

The implementation depends on the targeted security level and the targeted usage. Thus one config could be great for one situation and at the same time bad for another situation.

Your current config is not far from a classic one where instead of ChrootDirectory classic file permissions, group, and user access level would be used to manage the separation between each ssh user. I guess that you are just missing user access level on your config to achieve that. Here are some details on how to implement that here, here and here (that said using ChrootDirectory in addition to that is a good security practice)

Alternative (hardened security)

First PermitRootLogin yes should never be used, instead add me user to the suders. Root will then be accessible through me user with sudo su or su

If you are targeting a hardened security, Kernel user space feature can be used, which will separate completely each user, but this is a whole other config. This can be achieved with the native Linux tools and/or firejail to separate files/network etc.

Also in the same scope of hardened security, authentication with private/public key should be used instead of PasswordAuthentication yes

SSHFS may also be an alternative to separate the hosted file.

Also here are some interesting link on the topic:

Final suggestion

Finally, regarding your config I would just suggest

  • Disabling PermitRootLogin
  • Review users and /home right.
  • In the case of unique web hosting usage
    • Apply the suggested permission, not for /home directory but use a structure like /var/apache/user1,user2,etc. then use ChrootDirectory /var/apache/
  • In the case of multi-purpose system
    • Many possibilities can be used here one of them is applying the suggested permission, not for /home directory but use a structure like /var/apache/user1,user2,etc without using ChrootDirectory then manage permission with file access rights.
Improve this answer
3
  • Thank you for your comment. (minor typo: "servie"). Could you add details about recommended permissions in such a shared hosting situation? Commented Jan 12, 2020 at 12:47
  • I tried your solution: drwxrwx--- 5 me me 4096 Feb 26 2019 www (i.e. me:me ownership and 770 permission for www) + adduser me www-data (i.e. add user me to www-data). But Apache can't access the files even if me is now member of group www-data. Any idea? Commented Jan 12, 2020 at 21:01
  • @Basj my bad, i did forget that you are locating www under the home folder... The traversal permission is a must for a user/apache to access child sub-folders... i rewrote my answer completely it's now en-globing the whole situation enjoy ;) Commented Jan 12, 2020 at 23:31
0

This article gives a nice a simple solution:

  • Create a root-owned dir /friends/, and make /friends/alice/ be the home of user alice:

    usermod -m -d /friends/alice alice

  • Add this at the end of /etc/ssh/sshd_config:

    Subsystem sftp internal-sftp
Match User alice
ChrootDirectory /friends

  • Then /etc/init.d/ssh restart

  • If you chroot multiple users to the same directory, but don't want the users to browse the home directories of the other users, you can change the permissions of each home directory as follows: example:

    chmod 700 /home/alice

    Only drawback: with this solution, Apache won't be able to read in /home/alice/www...

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.