Re: [gentoo-hardened] Managing users for clients (persons)

[Adam Lantos]

Hello,

I run a development server for our company (SFTP, web, php
developments, mailing lists).

-gentoo-hardened (grsecurity)
-ldap database for user authentication
-apache2+suphp

I personally prefer Ldap over mysql because of its optimized
performance, and scalability. Ldap is stable enough, and it's much
more secure than mysql (using TLS for connections, you can set ACLs).
You can store virtually anything related to users without bothering
with database schemes - quotas, email accounts, database
configurations, apache configuration and so on... Ldap is faster too
because of the binary database backend it uses. And much more tools
support Ldap, so you can use one password to sftp, one password to
apache htaccess, ... easier than with mysql.

With grsecurity/rsbac/rbac you can limit any aspect of clients
(restrict client socket connections, /tmp usage, log audit events).
Use chroot is you want to separate users strongly from each other.

With the use of SUPhp your customers can run their scripts with their
privilege level. (So no world-writable files required, and the
privileges of PHP is in your hand, customize it per customer.)

Some things to consider:
 -FTP is insecure, because it sends the password in plaintext.
 -SFTP is better, but it uses more CPU. Set rssh shell, and customize
pam. I think you don't want to give them full shell access.
 -If the LDAP is down, your whole hosting system become unusable. The
same thing is with the mysql, so it's not a big problem.


yours,
 Adam

On 4/15/07, Michael <mycroes@××××××.nl> wrote:
> Hello all,
>
> I'm currently working on a hardened install for a web/mail-server.
> Clients need to be able to upload their site content, either by ftp or
> sftp... As I see it now, there are three options for user management:
> 1. Add real users to the system
> 2. Add virtual users to a mysql db, use one user for files and let
> programs use the database
> 3. Use pam-mysql or nss-mysql to have the users in a database
>
> Personally I'd prefer using a database because of the management, but
> I'm not considering security at all in this preference. I bet some of
> you ran into the same problem and took one of the approaches I mentioned
> above.
>
> Because clients are using php too I don't know if it's advisable to use
> one user on the system and virtual users for ftp/sftp access. Next to
> that it would be nice to have decent quota support, so in that case I
> guess point 2 won't work...
>
> Anyway, I hope someone who used one of these methods on a production
> server can tell some more about what's the best way to solve this
> problem and why it's the best way.
> Greetings,
>
> Michael
>
> --
> gentoo-hardened@g.o mailing list
>
>
-- 
gentoo-hardened@g.o mailing list