Hi guys.

I've got a dedicated server running Debian Etch. It's fully up to date and running Apache2. Here's the issue:

I have been providing shell accounts to those who want them, provided that they can assure me they won't do anything malicious. I trust my users. However, I do not trust them to not make mistakes.

The root of the problem is, some users have SSH access and they are immediately dropped into their home directory, /home/username.

I have sensitive sever-side scripts located in /var/www and I cannot allow any users to grab my database passwords. Unfortunately, I cannot rely on permissions alone because they must allow outside users to access the website. Here are my options, as I see them:<UL TYPE=SQUARE>

<LI>Trust my users. Not a chance.

<LI>Maintain two directory trees and chroot the users into the jail with prespecified binaries. Possible, but I want to avoid this.

</UL>

Any and all advice is welcome and if you need more information just let me know.

This is the first box I have administered start to finish, so any tips on making everything play nice would also be welcome. I have set up users/groups like www and svn to control apache and subversion access, respectively.

Why? If you users have their own little sites to maintain, use apache to put their DocumentRoot inside their home directories and then disallow them any access to /var/www.

[This message has been edited by cense (edited 04-03-2007).]

If I am hosting a website on /var/www, it needs to be world readable in order to display the pages correctly to outside users. Correct me if I am wrong, but I think /var/www needs to be set to 555 at least.

Also, I suppose I may have the option of using setuid and giving apache root, but that scares me for obvious reasons.

Usualy you want to place a jail around your webserver dir so that unvelcomed guest doesn't get any further. Trial and error is probably the best advice I can give.

Also long as you set the proper permissions to your configuration files it wouldn't be a problem. Flatfile storage is the same procedure.

Untrue. Apache HTTPd under Fedora Core runs as user: apache:x:48:48:Apache:/var/www:/sbin/nologin

User "apache". This means /var/www can be owned by user "apache" and group "apache" then chmod to 500, which will effectively restrict access to any other user and still allow apache to access the directories and files which need displaying.

The reason you believe it needs to be set to 555 I will bet is because your /var/www directory is owned by "root" and group "root". This means if it isn't chmod 555 Apache cannot access these directories because he belongs to "other" when root owns /var/www, simply change the owner and group of /var/www to that of which Apache HTTPd runs under on Debian, and set permissions to 500. This is your solution, using permissions alone.

Absolutely no need to do this.

If you have separate user accounts for every daemon for which it is appropriate, I don't see what the issue is. The solution is simply with discretionary access control.

I think it's been covered but no, you don't need world readable. You only need the user that the apache daemon is running as to read it. No other account needs to have access.

If you're running your httpd as user www and that user is in group www, for instance, you just chown www.www /var/www -R and chmod o-rwx to prevent anyone not in that group from reading any of that data.

He was talking about creating a jail and keeping the users in it, not the webserver.

Thanks guys.

I was having trouble locating the user account for it, but it looks like www-data is the user account for Apache2 on Debian Etch. I've set the access to 770 and added webmasters to group www, so everything looks to be in order.

If I have any more questions, I'll ask them here. Also, does anyone have any tips for running a full server? I've run some servers from home before, but never one that was so loaded with users. I've been reading all that I can and I'm fighting my way through IP tables, but I usually skimp on security because it never really mattered. That's not really an option anymore.

Depends on what exactly you're wanting to accomplish.

For starters, dropping all ICMP requests would make your machine not appear as if it existed, circumventing some script kiddies.
The IP tables rule would look like this:
iptables -A INPUT --source 0.0.0.0/0 --destination <Your interface address> --protocol icmp -j DROP

Hre is the example in action:
Other than this, monitoring traffic using netstat will help you locate any strange activity, and if you suspect foul play, simply drop packets from these people or create specific rules to only allow certain types of traffic, then create a rule to drop all data last.

__________________
[autopsy@localhost ~]$ cat you >>/dev/null && rm -rf you