opinions requested - giving users shell access vuxxxx

[gilbert]

Hi,

I was wondering if I could get some opinions on what the risks are to give hosting customers shell access.

If anyone does it, are there some steps to do it in the most secure possible way?

I am strongly requesting granting ssh access via static ip.

Any thoughts would be welcome.

Thanks,
Gilbert.

[joximu]

really secure would be a root-jail but then you need to configure all programms so that the user can use them.
On the other hand: what should they allowed to do on the shell? if everything, then they also can install a password cracker and try to hack the database for example.

If you just enable login via ssh (with normal bash) then they are abler to inspect the server and maybe more.

So - it's up to you, how much you can trust your customers.

/J

[gilbert]

I trust this client

I would prefer to have root-jail but I guess that is too much to configure.

Thanks for your answer.

(07-20-2009 08:37 AM)joximu Wrote:  really secure would be a root-jail but then you need to configure all programms so that the user can use them.
On the other hand: what should they allowed to do on the shell? if everything, then they also can install a password cracker and try to hack the database for example.

If you just enable login via ssh (with normal bash) then they are abler to inspect the server and maybe more.

So - it's up to you, how much you can trust your customers.

/J

[joximu]

you can edit /etc/passwd - just put the right shell there (/bin/bash or /bin/my-root-jail instead of /bin/false). Then they can login. Passwd is the same as they got for login into ispcp. Username = first field in line (vu2001, vu2002 etc).

/J

[kilburn]

Quote:Passwd is the same as they got for login into ispcp.

AFAIK ispcp creates the users without password, so you'll have to assign one for them manually (just run "passwd vuXXXX").

[joximu]

(07-29-2009 11:15 AM)kilburn Wrote:  

Quote:Passwd is the same as they got for login into ispcp.

AFAIK ispcp creates the users without password, so you'll have to assign one for them manually (just run "passwd vuXXXX").

you're right.
sorry.

/J