Ubuntu Webserver Permissions

Now I've bought an Ubuntu Cloud server. I installed Webmin this morning, and now I have a question. Is it possible to create users that can only use one directory, SVN, FTP, PHP, Python, MySQL, Apache? So for example, user Kevin only may use /var/www/kevin/? Oh, after directory creation, a SVN checkout should fill the directory. What is the best way to manage all databases? Many people will work with the database, so how can I keep it开发者_运维百科 safe? Is it possible to backup the database everytime a query was executed?

Many many thanks,

Regards, Kevin

This might be better suited on https://askubuntu.com/

That said, backing up a database after every query sounds like a recipe for horrible performance and probably no real benefit. Configuring or modifying your application to send audit logs to another machine would probably be more approachable.

You can configure your standard Unix permissions to allow kevin to write only in /var/www/kevin. Restricting which programs kevin can run would probably require a tool more like AppArmor, SElinux, TOMOYO, or SMACK. Any of these mandatory access control tools can prevent a user from executing untrusted programs or provide an extra layer of security on top of the standard Unix permissions.

I've been working on AppArmor for over a decade now, and it'd be the tool I'd pick first for this job, but the other tools are excellent and might be a better fit for your environment. (AppArmor may already be pre-installed. Check aa-status(8) output to see. :)

But first make sure your Unix permissions are right -- old-school they may be, but they are superb.

Update

But how can I make that when 'kevin' signs into SSH, he automatically goes to directory /var/www/kevin/ (and can't go to /var/www/ or directories below)?

You could add a cd /var/www/kevin command to kevin's ~/.bash_profile or ~/.profile file. This might be more annoying than useful. (I don't recommend setting kevin's home directory (in /etc/passwd) to /var/www/kevin because that would store ~/.bash_history and ~/.ssh/* information in /var/www/kevin/.bash_history and /var/www/kevin/.ssh/, potentially exposing too much of kevin's private information.)

To allow kevin to enter into /var/www/kevin/, kevin will need to be able to enter /var/www -- but he doesn't necessarily need to see the contents of /var/www:

root:root   755 /var
root:root   751 /var/www
kevin:kevin 755 /var/www/kevin
other:www   750 /var/www/other
priv:www    750 /var/www/private

If your webserver runs with a group or supplementary group www, it will be able to traverse and read all these directories. Kevin cannot. (Assuming kevin is not in the group or supplementary group www.) Kevin can cd /var/www, and if kevin guesses /var/www/other or /var/www/private, he can determine that they exist, but he cannot actually enter the directories or list their contents.