2

I am familiar with Linux users/groups but have never been able to master the following process and wanted to ping the community for suggestions/best practices.

I use coders from odesk,rac often and want to give them access to my server for periods of time ie to install files develop. I don't use ftp only SSH access and would like to create a user named coder1, give him a password and allow him to login from terminal but allow him to only see the directory /var/www/html/mysite1 on my server.

He has full 777 rights to everything in that folder but can't see or touch anything else.

Typically, I would create a group named developers and add coder1 to that group. Then set the owner of the ...mysite1 directory to be the 'developers' group. I think that's pretty standard but I have never been able to correctly lock a developer to a single website directory.

Thoughts on what I'm doing so far? Advice on how to manage multiple coders that come on and off a server over time?

Thanks1

mrmartin79
  • 21
  • 1
  • I'll just add that I am running Openssh 4.3, so trying something similar to http://serverfault.com/questions/240156/jail-users-in-a-directory isn't working for me, should I just update ssh? – mrmartin79 May 30 '11 at 17:50
  • Would your developers develop in the /var/www/html/mysite1 directory or would they just upload files written elsewhere to it ? – user9517 May 30 '11 at 17:50

1 Answers1

1

If you're fine with limiting the access to SFTP only (upload/download files), you can have a look at a chroot SFTP solution. Something like Chroot SFTP on Ubuntu should get you started in the right direction.

The idea is to lock the user into a chroot consisting solely of the website files. This way he only has access to those specific files.

If you need some more functionality (executing commands on the server, full console access), you can have a look at rssh (limited to rsync/cvs) or some other solutions involving jailing/chrooting. But this can become a maintenance burden. In such a case, I think you should ask yourself if a normal secure system with standard permission management features won't be sufficient for your needs.

Karol J. Piczak
  • 2,358
  • 1
  • 20
  • 22
  • 1
    You can also try http://mysecureshell.sourceforge.net/, it's pretty easy to setup and configure. For SFTP only. – ghm1014 May 30 '11 at 19:33