Looking for advise on WWW/SSH/FTP Lockdown

nistelrooy · 10-10-2005, 02:08 AM

Hi

A learner here. I'll be running a basic WWW/SSH/FTP system for my family members to upload their own website on this debian box.

Each of them will have a user account:
- user1 (Samuel)
- user2 (Steven)
- user3 (Adeline)
- user4 (a friend of mine, unix guy)
- nistelrooy (root, myself)

I'll be running, FTP, SSH, WWW on this box. However, due to this user4 inclusion, it makes me want to secure my box.

I've already locked down SSH to myself only.

But how do i do FTP lockdown to the users above, and all the new users created infuture will not have a ftp account automatically created.

Secondly, i realise these users accounts i created are able to download the configuration files on the boxes. That includes very sensitive files like, /etc/proftpd.conf, /etc/apache2/*. There will be so many files&folders exposed to my users with this ftp opened. How do i make sure that i've locked down all these sensitive files and they're locked down to their own directory?

Are there any other things i need to see to?

Thanks!

anomie · 10-10-2005, 07:15 PM

There is not a short answer to this question.

There are many things to do to properly harden a Linux system, and each of the services you're running are potential holes. You need to read the documentation for the service and read about the ways to harden it as well.

For example, a quick google for 'debian hardening ftp' returned this as one of the results: http://es.tldp.org/Presentaciones/20...-services.html

Well, that's a start. This is a question of how much time and effort you want to spend vs. how valuable the data on that machine is.

ralvez · 10-10-2005, 07:37 PM

I guess that a more relevant question is: why use ftp at all?

If you are running ssh you can do file transfers (like you would do with ftp) with scp. It's secure, encrypted (passwords that is) and takes care of your security concerns.

Hope this helps.

Rick

primo · 10-10-2005, 09:42 PM

Yeah, don't use FTP. Use either SFTP or scp. To lock them down to their directories use chroot.

unSpawn · 10-11-2005, 05:21 AM

While I agree scp/sftp are more secure, I can imagine that you would need to run FTP for compatibility or other reasons. If you're bound to use FTP, at least use Vsftpd and not another ftpd. It has a near-perfect track record as far as security is concerned (unlike other ftpd's), is in use with many high volume hosts, is actively maintained, will allow you to use a separate password database and allows you to chroot people to their home etc, etc.