Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I know this is probably a stupid question. I'm guessing that a lot of "others" (various processes) need read access to /etc and other directories.

I am giving SSH access to an outside developer and I want to restrict him as much as possible to just the /var/www area. I was thinking of removing read access from /etc but realized that might break things. Was I right?

share|improve this question

1 Answer 1

You shouldn't fumble around with the permissions of system folders. Having access to /etc is pretty vital for many processes, some of which might not run as root. Simply said: It might be possible, but it's not worth the hassle.

I'd rather encourage you to set up a chroot jail instead.

A chroot jail is the common expression used to describe a section of a filesystem that is sectioned off for a particular user. On a web server, it is particularly useful for the security of shared hosting accounts.

So, you could "lock" the dev in /var/www – or even a subfolder of that – and let him do all he wants without ever being able to see any directory "above" the one he's locked into.

Building chroot jails is made easy through utilities like Jailkit, or is explained in various blog entries and how-to's, like this one: How to build a chroot jail environment for CentOS

share|improve this answer
    
Thanks, I did read about chroot jails awhile ago but my impression is that it would function as his, and only his, playground. But I will need to give access /var/www to various outside devs and various times to have them work on different sites in subfolders there. Not sure if chroot would work for that. –  Buttle Butkus Sep 18 '12 at 8:09
    
If one dev needs to work on only one site, you can restrict them to /var/www/foo – you could set up one chroot jail for each user, basically. –  slhck Sep 18 '12 at 8:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.