[Solved] Small Webserver - nginx, php, SFTP and permission for users

Urfaust · 2011-04-24 20:08:05

Hi,

so I'm playing around with a webserver setup in a virtual machine for myself. In the first place I want that one user can connect to the box, upload some files and everyone on the network can see the pages. So far I setup Arch in VirtualBox with one user (userA), configured SSH and SFTP according to the wiki (login with keys, no root login etc.). Now I can connect via SSH, sudo is also working and I can also browse the system via SFTP (with Filezilla).
After that I installed nginx and php-fpm, everything is working so far:

nginx and php-fpm daemons run as user httpd. DocumentRoot is /srv/http/nginx which is owned by root, therefore i can not write into this directory when connecting as userA via SFTP but thats what I want.
So I did a

sudo chown -R userA:users /srv/http/nginx/

and it works. I can upload stuff into DocumentRoot via SFTP as userA and i get the pages displayed in the browser on the other machines. But is this the 'proper' way to do it? Maybe I migrate this setup to a VPS, do I have to change something then? Currently only me is working with it but what if I want to add another user to share the webserver who should not see my files? I found this How-to http://redmine.lighttpd.net/wiki/lightt … ermissions but it seems it might be a bit too much for a setup with 2-3 users, isn't it?

Thx for giving me some advice.

Last edited by Urfaust (2011-04-25 09:52:45)

112percent · 2011-04-24 21:46:24

By looking at your idea I think it is going in the right direction. I fear that if you add userB to your setup they will still be able to see userA's documents, presuming they are a member of the users group. This is due to the default directory permissions - when a directory is created its contents are visible to one and all.

I host a few domains in a similar manner to yourself, the following structure works for me:

> mkdir /srv/vhttp/domain{1,2}.com
> chmod 750 /srv/vhttp/domain{1,2}.com
> chown userA.http /srv/vhttp/domain1.com
> chown userB.http /srv/vhttp/domain2.com
> ls -l /srv/vhttp
drwxr-x--- 2 userA http 4096 Apr 24 22:35 domain1.com
drwxr-x--- 2 userB http 4096 Apr 24 22:35 domain2.com

This way, only the user and the http group can access the contents of the web root. For the basic hosting of a few sites keep it simple, with nginx you can use the PHP-FPM module in combination with the virtual hosting to get around most of the steps in the Redmine guide.

I hope this is helpful,

Byron

Urfaust · 2011-04-25 09:06:21

112percent wrote:

By looking at your idea I think it is going in the right direction. I fear that if you add userB to your setup they will still be able to see userA's documents, presuming they are a member of the users group. This is due to the default directory permissions - when a directory is created its contents are visible to one and all.
I host a few domains in a similar manner to yourself, the following structure works for me:
> mkdir /srv/vhttp/domain{1,2}.com
> chmod 750 /srv/vhttp/domain{1,2}.com
> chown userA.http /srv/vhttp/domain1.com
> chown userB.http /srv/vhttp/domain2.com
> ls -l /srv/vhttp
drwxr-x--- 2 userA http 4096 Apr 24 22:35 domain1.com
drwxr-x--- 2 userB http 4096 Apr 24 22:35 domain2.com
This way, only the user and the http group can access the contents of the web root. For the basic hosting of a few sites keep it simple, with nginx you can use the PHP-FPM module in combination with the virtual hosting to get around most of the steps in the Redmine guide.
I hope this is helpful,
Byron

Thanks, this looks good. :-) If I want that userA and userB only to see their folder and not the whole server I have to setup SFTP with chroot, right? Something like this: http://www.debian-administration.org/articles/590

112percent · 2011-04-25 09:28:16

Yep, correct. chrooting the users would also get around the directory permissions I mentioned earlier, though I'd still keep them.
You could also look at MySecureShell in the AUR as it allows you to customize some SFTP settings. But as I said before, keep it simple - go with the chroot to start with.

Urfaust · 2011-04-25 09:52:25

Thanks again, I will look into this.

Pajaro · 2011-04-25 10:42:42

Yes, you have to create chrooted logins for your users. I use this script to add new applications to the chroot environment:

http://pastebin.com/sJHAExU5

But chrooting the ssh login is not enough for isolation. You also have to isolate the php-fpm instances, otherwise users can run system commands from php and even create interactive system shells that will run with the user httpd. Since safe_mode is deprecated, I know two ways to fix this:
- set a different uid/gid php-fpm instance per user.
- create a chrooted php-fpm instance per user.

In case you choose the first option (the most common) here you have a possible configuration:
- Users default (and only?) group is httpusers instead of users since httpd users have nothing to do with regular users, otherwise you wouldn't chroot bash.
- Each php-fpm instance runs as [user]:httpdusers
- httpd user is in httpusers group, this way nginx can access user files when serving static files.
- user root directories (/srv/vhttp/domain1.com) have permissions 750 and are property of [user]:httpd.

Now only the user, his php-fpm instance or nginx can access user directories, but they still have access to the rest of the system through php system calls... Good! Users can run ffmpeg! ...but they can also query pacman for installed packages, run python scripts, check the contents of /etc/ directory... don't ask me why this is the most common configuration I found, I don't know. To fix this you can create a group called system, set directories under root to have ownership root:system and permissions 750 except directories you want httpdusers to access, and add to the system group every user that is not an httpduser... [EDIT] this is gonna be tedious...

Last edited by Pajaro (2011-04-25 10:45:26)

Pajaro · 2011-04-25 10:49:43

To fix this you can create a group called system, set directories under root to have ownership root:system and permissions 750 except directories you want httpdusers to access, and add to the system group every user that is not an httpduser...

Maybe you could create a directory called /srv/httpdusers_system and place there a bin directory, a lib directory, etc... but chrooting seems much simpler.

Arch Linux

#1 2011-04-24 20:08:05

[Solved] Small Webserver - nginx, php, SFTP and permission for users

#2 2011-04-24 21:46:24

Re: [Solved] Small Webserver - nginx, php, SFTP and permission for users

#3 2011-04-25 09:06:21

Re: [Solved] Small Webserver - nginx, php, SFTP and permission for users

#4 2011-04-25 09:28:16

Re: [Solved] Small Webserver - nginx, php, SFTP and permission for users

#5 2011-04-25 09:52:25

Re: [Solved] Small Webserver - nginx, php, SFTP and permission for users

#6 2011-04-25 10:42:42

Re: [Solved] Small Webserver - nginx, php, SFTP and permission for users

#7 2011-04-25 10:49:43

Re: [Solved] Small Webserver - nginx, php, SFTP and permission for users

Board footer