Setting up a user with restricted SFTP access

If you are running a Debian Linux webserver you may want to create users that can upload and download files from specific directories via SFTP. This post will explain how to set this up. First you need to create a user. If you want to create a user with the name 'webdev' then login as root and use the following commands at the prompt.

useradd webdev

Now you want to set the password for the new user 'webdev'

passwd webdev

Now we can create a home directory with the following commands.

mkdir /home/webdev

chown webdev:users /home/webdev

Now we only want this user to be able to login to the server via SFTP. We can do this by changing the users shell to sftp-server.

usermod -s /usr/lib/sftp-server webdev

Next we need to make the sftp-server a valid shell by adding the line "/usr/lib/stfp-server" at the end of the file shells in the etc directory.

By default, a new user will be assigned to a new group with the same name as the new user. So in our case the user 'webdev' will belong to the group 'webdev'. In order to make our new user the owner of any other directory including sub-directories (such as the website document root) we can execute the following command.

chown -R webdev:webdev /var/www

So now the new user webdev will be able to login va SFTP and have owner permissions to their home directory as well the webserver document root directory.

References: The following page has more useful information about managing groups and users in Linux.

Further Restrictions

In the example above we made the directory that holds the website belong to the group "webdev". If you have other users on the system that you do not want to have access to the website data then it could be wise to assign the www directory to the group "www-data" and remove read access for other system users to the directory www.

This is in order to limit access from users except the web server that runs under the user www-data.

For example:

usermod -a -G www-data webdev

usermod -g www-data webdev

chown -R :www-data /var/www

chmod -R o-r /var/www

By doing the above, we have added the user webdev to the group www-data (the same user that Apache normally runs as). Then we make www-data the default group for the user webdev, whereafter we make the www directory belong to the www-data group and set the permissions such that the files in that directory are group-readable but not world-readable.

How to enable mod_rewrite in Apache 2 on Debian Linux

Simple! Just run the command

a2enmod rewrite

Restart Apache 2 by running the command

/etc/init.d/apache2 restart

Done!

...if you are still having problems getting mod_rewrite to work, check that the config file for the site (located in the directory /etc/apache/sites-available/) does not have "AllowOverride None". If it does then change it to AllowOverride All instead in order to allow mod_rewrite commands to be set in the .htaccess file.

Setting up a Linux VPS

Rimuhosting offer good VPS packages and have datacenters in various locations around the globe. The main reasons for staying with Rimuhosting have been ease of setting up the service, server reliability and the level of support they provide. The support saff at Rimuhosting are allways very helpful and go the extra mile to help you out.

Here I am going to show how to set up a Linux VPS from Rimuhosting for web and email hosting. The VPS will be running Debian Linux 5.0 32-bit with Apache, MySQL, PHP. The server configuration is 512MB RAM, 4GB Disk space, 100GB data transfer limit per month, with a Webmin control panel. On a London based server this costs £27 per month (or £324 per annum).

After ordering your VPS package you will receive an order confirmation and later a VPS Setup email specifying the IP address of the server. In this example it took 2 minutes between the order confirmation email and the VPS Setup email.

Apache comes pre-configured and running on these servers so all you need to do now is to put the new server's IP address from the VPS Setup email in the address bar of your browser and you'll get a web page saying "It works!".

Now we need to configure the server to work the way we want it to...

The first time you log in to Webmin at https://<your IP address>:10000/ you will get a Security Failed message if you are using Firefox (presumably the same or similar will happen in other browsers too). This is normal and happens only because the browser can't validate the security certificate with a certificate authority. Just add exception for this certificate by clicking the relevant buttons in the browser window.

Setting up the Apache 2 Webserver using Webmin

In Webmin (we are using Webmin 1.490) you can install the relevant servers under the "Servers" option in the main menu on the left. Since Apache is active by default we don't need to do anything under "Apache Webserver".

Setting up the MySQL Database Server using Webmin

Click on the "MySQL Database Server" option and click the button that says "Start MySQL Server". We now want to set up our database that will be used by our website. On the following page and under "MySQL Databases", click on "Create a new database".

Specify a new database with the default character set and with the name "webdata" or whichever other name you prefer. Click on the "Create" button.

Now that we have created the database we need to specify users that will have access rights to the database. Clicking on "User Permissions" will reveal that there is already a database user called "root" set up and this user will have the same password as your VPS root password.

We are going to set up two users - one that has administrator rights and that can connect to the database from any host (We'll use this user later to connect from the MySQL Administrator tool), and another user with limited rights that will be used by our webiste.

Click on "Create new user" and specify the username "adminuser", set a strong password, set host to "any", details select all permissions by holding down shift while selecting permissions from the list. The click the "Create" button.

Next do the same for the "webuser", except only specify the following permissions: select, insert, update, delete, drop, alter, create tables, create temp tables and lock tables. Under host, specify "localhost" instead of "any" for the webuser.

We now need to configure the MySQL server to accept connections from any host so that we can use the "MySQL Administrator" tool (that runs on your local computer) to connect to the database. Go to the "MySQL Server Configuration" page and select "Any" under "MySQL server listening address" instead of the default 127.0.0.1. Click on Save.

Now restart the MySQL database server by clicking the "Stop MySQL Server" button in Webmin and then click on "Start MySQL Server".

With, for example, the tool MySQL Administrator, you should now be able to remotely login to your MySQL database server as the user "adminuser".

Finally, check that the server is configured to start the MySQL server at boot. In Webmin, go to the "Bootup and Shutdown" section under the System menu. Check that the MySQL deamon is configured to start at boot, and if it isn't change the setting accordingly.

Remote Server Admin and File Upload

We use SSH instead of telnet and SCP instead of FTP as SSH and SCP are more secure. With SSH and SCP passwords and data are encrypted before being sent over the Internet, whereas telnet and FTP don't encrypt.

SSH provides a method for securely logging into your VPS in order to administrate your server. Nothing is required to set up SSH on your VPS as SSH is configured to run by default. In order to login via SSH you need a client and for this we reccommend PuTTY. It is a free tool that can be downloaded from the Internet.

If your development computer is a Windows PC, then we suggest using the tool WinSCP for uploading files to your server. SCP is also pre-configured on your server so nothing is required to set it up there.

Other Webserver Settings

You also might want to consider how to enable mod_rewrite.