On 09/29/2011 04:13 AM, Neil Bothwick wrote:
> On Wed, 28 Sep 2011 19:23:30 -0700, Grant wrote:
>
>> For some reason I thought SFTP would provide access control but now
>> I'm thinking it's just like SSH in that access control is based on
>> file ownership and permissions? If that's the case, can anyone think
>> of a better way to control remote access to my files than chmod/chown?
>
> ACLs.
>
We went this route once too. We had a developer ($USER) who was supposed
to have access to just one subdirectory of /var/www.
I took notes, assuming /etc, /root, and /usr have correct permissions:
1. A group named ssh_users was created. The $USER account was
added as a member of this group.
2. The ssh_users group was granted the ability to traverse /var/www:
setfacl -m group:ssh_users:--x /var/www
This is necessary to allow the $USER user to chdir into its
home directory in /var/www/$HIS_HOME_DIR.
3. A default ACL was set on /var/www which will apply to each new
subdirectory created within it.
setfacl -d --set u::rwx,g::rx,g:ssh_users:-,o::rx /var/www
This prevents members of the ssh_users group from traversing any
newly-created subdirectories of /var/www.
4. The default ACL described above was applied manually to each of
the existing subdirectories of /var/www:
setfacl -m g:ssh_users:- /var/www/*
Warning: At the time of writing, there were no regular files in
/var/www, so the above command makes sense. Don't blindly run it
again without checking.
5. The $USER user was granted full read/write/traverse permissions
on its home directory and all subdirectories/files contained
therein:
setfacl -R -m u:$USER:rwx /var/www/$HIS_HOME_DIR
6. At this point, we need to change the default ACLs of every
directory within /var/www/$HIS_HOME_DIR. This is so that, when
$USER creates a new file/directory somewhere beneath its home
directory, it has access to the newly-created file or directory:
setfacl -d -R --set u::rwx,u:$USER:rwx,g::rx,o::rx /var/www
/$HIS_HOME_DIR
This command sets the default ACL recursively, and is smart
enough to only apply the command to directories.
