Allowing access to server.

Message

CurtE · Post by **CurtE** » Sun Sep 16, 2012 7:41 am

I have a web developer that I need to give access to the server but I only want to allow the directory to the actual web pages.

Let's say I'm giving him access to /home/webguy where /webguy will hold the temporary web site.

How do I do this properly?

audiodef · Post by **audiodef** » Sun Sep 16, 2012 2:50 pm

Easy - set the guy up with /home/webguy/.ssh/authorized_keys, which contains his public ssh key. Have him send you his public key and cat webguy_publickey > /home/webguy/.ssh/authorized_keys. He can then ssh/scp to his home dir.

I have exactly the same situation. I mirror Pappy's Kernel Seeds, and this is how Pappy updates my mirror.

Post by **cach0rr0** » Mon Sep 17, 2012 8:46 am

if it's just plain ole html/css/javascript/whatever, then Userdir should be fine

if you want to be a bit more fancy, and run something like e.g. php, you'd probably want to look at suPHP

some people take yet another route and run an ftp daemon, but set their ftp daemon to run as the apache user. I don't care for ftp at all personally, but it does work.

should be good reading fodder at least.

audiodef · Post by **audiodef** » Mon Sep 17, 2012 1:29 pm

Isn't FTP a security risk compared to scp?

Post by **cach0rr0** » Fri Sep 21, 2012 1:46 pm

audiodef wrote:Isn't FTP a security risk compared to scp?

considerably so, yes.
there is the advent of SFTP, but it's of little value IMHO

...nonetheless, for whatever reason people still do FTP. I think, largely, because where the "average user" would be lost if you asked them to use SCP, they aren't with an FTP client - even though it looks like the same bloody thing! (e.g. WinSCP)

i understand it from a user side. i dont understand it from an admin side. but, c'est la vie

Yess1934 · Post by **Yess1934** » Tue Sep 25, 2012 8:47 am

audiodef wrote:Easy - set the guy up with /home/webguy/.ssh/authorized_keys, which contains his public ssh key. Have him send you his public key and cat webguy_publickey > /home/webguy/.ssh/authorized_keys. He can then ssh/scp to his home dir.

I have exactly the same situation. I mirror Pappy's Kernel Seeds, and this is how Pappy updates my mirror.

There is 1 small problem with keys, you won't be able to use non-default clients (http://webssh.uni.me, smartphones, ...).