Re: [gentoo-hardened] Managing users for clients (persons)

[Alexey Kopytko]

Consider using mpm_itk in place of suphp. 
It appers to be much more simple and secure because not only PHP
secured but every apache process run with user's privelege.

Regards,
Alexey Kopytko
 
В Sun, 15 Apr 2007 11:24:05 +0200
"Adam Lantos" <hege@××××××.org> пишет:

> Hello,
>
> I run a development server for our company (SFTP, web, php
> developments, mailing lists).
>
> -gentoo-hardened (grsecurity)
> -ldap database for user authentication
> -apache2+suphp
>
> I personally prefer Ldap over mysql because of its optimized
> performance, and scalability. Ldap is stable enough, and it's much
> more secure than mysql (using TLS for connections, you can set ACLs).
> You can store virtually anything related to users without bothering
> with database schemes - quotas, email accounts, database
> configurations, apache configuration and so on... Ldap is faster too
> because of the binary database backend it uses. And much more tools
> support Ldap, so you can use one password to sftp, one password to
> apache htaccess, ... easier than with mysql.
>
> With grsecurity/rsbac/rbac you can limit any aspect of clients
> (restrict client socket connections, /tmp usage, log audit events).
> Use chroot is you want to separate users strongly from each other.
>
> With the use of SUPhp your customers can run their scripts with their
> privilege level. (So no world-writable files required, and the
> privileges of PHP is in your hand, customize it per customer.)
>
> Some things to consider:
>  -FTP is insecure, because it sends the password in plaintext.
>  -SFTP is better, but it uses more CPU. Set rssh shell, and customize
> pam. I think you don't want to give them full shell access.
>  -If the LDAP is down, your whole hosting system become unusable. The
> same thing is with the mysql, so it's not a big problem.
>
>
> yours,
>  Adam
>
> On 4/15/07, Michael <mycroes@××××××.nl> wrote:
> > Hello all,
> >
> > I'm currently working on a hardened install for a web/mail-server.
> > Clients need to be able to upload their site content, either by ftp
> > or sftp... As I see it now, there are three options for user
> > management: 1. Add real users to the system
> > 2. Add virtual users to a mysql db, use one user for files and let
> > programs use the database
> > 3. Use pam-mysql or nss-mysql to have the users in a database
> >
> > Personally I'd prefer using a database because of the management,
> > but I'm not considering security at all in this preference. I bet
> > some of you ran into the same problem and took one of the
> > approaches I mentioned above.
> >
> > Because clients are using php too I don't know if it's advisable to
> > use one user on the system and virtual users for ftp/sftp access.
> > Next to that it would be nice to have decent quota support, so in
> > that case I guess point 2 won't work...
> >
> > Anyway, I hope someone who used one of these methods on a production
> > server can tell some more about what's the best way to solve this
> > problem and why it's the best way.
> > Greetings,
> >
> > Michael
> >
> > --
> > gentoo-hardened@g.o mailing list
> >
> >
-- 
gentoo-hardened@g.o mailing list