Bsrgvty

Is there any iPhone SE out there with 3D Touch?

My Project Manager does not accept carry-over in Scrum, Is that normal?

A high quality contribution but an annoying error is present in my published article

Which place in our solar system is mostly fit for terraforming?

How to deal with my team leader who keeps calling me about project updates even though I am on leave for personal reasons?

Late 1970's and 6502 chip facilities for operating systems

Resolving moral conflict

Most practical way to create numbered ladder drop layout

What can a pilot do if an air traffic controller is incapacitated?

Is "ln" (natural log) and "log" the same thing if used in this answer?

If an object moving in a circle experiences centripetal force, then doesn't it also experience centrifugal force, because of Newton's third law?

Do we know the situation in Britain before Sealion (summer 1940)?

What is the meaning of word 'crack' in chapter 33 of A Game of Thrones?

Finding Primes in Pi

What is the need of methods like GET and POST in the HTTP protocol?

I reverse the source code, you negate the output!

Where are they calling from?

Do the villains know Batman has no superpowers?

Could Apollo astronauts see city lights from the moon?

Did Apollo carry and use WD40?

Does wetting a beer glass change the foam characteristics?

Why does this image of Jupiter look so strange?

How to manage expenditure when billing cycles and paycheck cycles are not aligned?

Is it true that, "just ten trading days represent 63 per cent of the returns of the past 50 years"?

Read & Write Permissions for SSH User and Web Server

changing ownership and permissions of /usr/bin/ and /var disables sshDoes nginx require an Ubuntu user for each server block?How to setup Restricted (permission) access for Directories in Apache2 web serverNon-jailed SSH user getting /bin/bash permission deniedRestrict SSH user to one directory onlyApache permissions to allow both user and web server to edit /var/www

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

1

First of all, let me clarify that I've searched through Ask Ubuntu and Stack Overflow as well as have googled a lot but didn't find any concreted solution to my problem.

So I'm setting up a web hosting environment on an Ubuntu server. The server is running Nginx as www-data user. The issue where I'm stuck is the isolation of SSH users.

With a jailed setup, I can restrict an SSH user to their own directory but at the same time, I need to give web server write access to the directories. Now even if a user is jailed, if he knows the absolute path to any other SSH users' home directories (where the web-server has write permissions), he will be able to modify the stuff (write, delete or whatever) without any restriction using the web server.

For example a user can execute a PHP script from /var/userone/sites/alter.php like:

file_put_contents('Creating a file with this text', '/var/usertwo/sites/create.php');

to create a new file create.php in usertwo's home directory. Am I correct?

In this scenario, what's the best way to isolate the SSH users so they should not be able to view/read each other's directories keeping the web server working without any permission issues?

Any proper guidance will be highly appreciated.

ssh apache2 nginx

share|improve this question

edited Apr 16 at 10:14

Rehmat

asked Apr 15 at 20:34

RehmatRehmat

10655 bronze badges

add a comment
 | 

1

First of all, let me clarify that I've searched through Ask Ubuntu and Stack Overflow as well as have googled a lot but didn't find any concreted solution to my problem.

So I'm setting up a web hosting environment on an Ubuntu server. The server is running Nginx as www-data user. The issue where I'm stuck is the isolation of SSH users.

With a jailed setup, I can restrict an SSH user to their own directory but at the same time, I need to give web server write access to the directories. Now even if a user is jailed, if he knows the absolute path to any other SSH users' home directories (where the web-server has write permissions), he will be able to modify the stuff (write, delete or whatever) without any restriction using the web server.

For example a user can execute a PHP script from /var/userone/sites/alter.php like:

file_put_contents('Creating a file with this text', '/var/usertwo/sites/create.php');

to create a new file create.php in usertwo's home directory. Am I correct?

In this scenario, what's the best way to isolate the SSH users so they should not be able to view/read each other's directories keeping the web server working without any permission issues?

Any proper guidance will be highly appreciated.

ssh apache2 nginx

share|improve this question

edited Apr 16 at 10:14

Rehmat

asked Apr 15 at 20:34

RehmatRehmat

10655 bronze badges

add a comment
 | 

First of all, let me clarify that I've searched through Ask Ubuntu and Stack Overflow as well as have googled a lot but didn't find any concreted solution to my problem.

So I'm setting up a web hosting environment on an Ubuntu server. The server is running Nginx as www-data user. The issue where I'm stuck is the isolation of SSH users.

With a jailed setup, I can restrict an SSH user to their own directory but at the same time, I need to give web server write access to the directories. Now even if a user is jailed, if he knows the absolute path to any other SSH users' home directories (where the web-server has write permissions), he will be able to modify the stuff (write, delete or whatever) without any restriction using the web server.

For example a user can execute a PHP script from /var/userone/sites/alter.php like:

file_put_contents('Creating a file with this text', '/var/usertwo/sites/create.php');

to create a new file create.php in usertwo's home directory. Am I correct?

In this scenario, what's the best way to isolate the SSH users so they should not be able to view/read each other's directories keeping the web server working without any permission issues?

Any proper guidance will be highly appreciated.

ssh apache2 nginx

share|improve this question

edited Apr 16 at 10:14

Rehmat

asked Apr 15 at 20:34

RehmatRehmat

10655 bronze badges

file_put_contents('Creating a file with this text', '/var/usertwo/sites/create.php');

share|improve this question

edited Apr 16 at 10:14

Rehmat

asked Apr 15 at 20:34

RehmatRehmat

10655 bronze badges

share|improve this question

edited Apr 16 at 10:14

Rehmat

asked Apr 15 at 20:34

RehmatRehmat

10655 bronze badges

asked Apr 15 at 20:34

RehmatRehmat

10655 bronze badges

asked Apr 15 at 20:34

RehmatRehmat

10655 bronze badges