Isolating Apache virtualhosts from the rest of the system

This can be done by enabling the mod_users module in Apache.

You will need to setup UserDir in your apache configuration. I suggest you do this in a separate config file and include it. Wrap the include in

<IfModule mod_users.c>
   Include conf/extra/userdir.conf
</IfModule>

I can give you the entire tutorial but this should get you started for configuring Apache:
http://www.techytalk.info/enable-userdir-apache-module-ubuntu-debian-based-linux-distributions/

Hint if you are running SELinux (and you should) you would have to give Apache read access to the user homes. You can do this by setting:

sudo setsebool -P httpd_enable_homedirs=On

It also needs file permissions to the user dirs public_html directory and r-x permissions on the parent directories up to root.

Obviously you need to setup chroot for the users for example in vsftpd. Install:

apt-get vsftpd

To configure chrooting open /etc/vsftpd/vsftpd.conf with vi or nano. Find and uncomment or add:
chroot_local_user=yes

You can get the same behavior for sftp which I recommend over FTP, open /etc/ssh/sshd_config and add a Match block and this line:

Subsystem   sftp    internal-sftp

Match Group web_users
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcpForwarding no
Match

This will chroot any user in the web_users group. Also you would need to deny access to the shell by setting it to /sbin/nologin:

useradd -G "web_users" -s /sbin/nologin new_user

If this is to be a public production server, I also strongly suggest you apply some hardening on the OS, OpenSSH, Apache, PHP, vsftpd and apply some strict iptables and TCP wrappers. I recommend you leave SELinux in place too.

Leave a Comment