Linux User & File Management
From 2047Servers Support
| Line 22: | Line 22: | ||
nano /etc/sudoers | nano /etc/sudoers | ||
| − | [[File:sudoers.png| | + | [[File:sudoers.png|500px]] |
| + | |||
After you have finished adding the new account you will need to save the file "Ctrl + X" (To exit) it will then ask to save "y = yes" - "n = no" | After you have finished adding the new account you will need to save the file "Ctrl + X" (To exit) it will then ask to save "y = yes" - "n = no" | ||
| + | |||
| + | If you wish to fine tune the sudoers file visit here for advance uses - http://linux.die.net/man/5/sudoers | ||
| + | |||
| + | &nbps | ||
| + | &nbps | ||
| + | |||
| + | === Restricting SSH access === | ||
| + | |||
| + | To restric access to SSH for a user is very simple all you have to do is edit the "/etc/passwd" file | ||
| + | |||
| + | nano /etc/passwd | ||
| + | |||
| + | |||
| + | |||
| + | Once your are editing the file, you should notice the user you recently created is near or at the bottom of the list (Example line below) | ||
| + | |||
| + | newuser:x:1008:1008::/home/newuser:/bin/false | ||
| + | |||
| + | *The first part is the username, in this case "newuser" | ||
| + | *The "x" means a password is set for the user | ||
| + | *The two numbers have different meanings, the first number "1008" in this case is the User ID. The second number is the Group ID (Stored in /etc/group) | ||
| + | *The "/home/newuser" is the users current home directory (We will cover more about this in the FTP part below) | ||
| + | *The last part is the most important to this step "/bin/false" means they have "No" SSH access, it will be "/bin/sh" by default (Meaning they have SSH access), so change this from "/bin/sh" > "/bin/false" to disable SSH access for that user. | ||
| + | |||
| + | |||
| + | &nbps | ||
| + | &nbps | ||
| + | |||
| + | == Users & FTP Access == | ||
| + | |||
| + | By default we normally install ProFTPD as an FTP Server (The other common one is VSFTP) | ||
| + | |||
| + | The config files for ProFTPD are in /etc/proftpd | ||
| + | |||
| + | In this folder you will find the main config file "proftpd.conf" | ||
| + | |||
| + | This file is easy to navigate wrong, in here you can set things such as | ||
| + | |||
| + | * FTP Port | ||
| + | * FTP Hostname + Welcome Message | ||
| + | * Default Login Root Folder (Set to ~ if you wish to use Folder Jail (As mentioned below) | ||
| + | * How many users can connect at one time | ||
| + | * How many times they can try to connect (wrong password lockout) | ||
| + | * Who has access | ||
| + | * & many more | ||
| + | |||
| + | There is also a file in /etc called "ftpusers" - This file is a list of users that are "NOT" allowed FTP access, feel free to edit this file & add users you wish not to have FTP access to your server | ||
| + | |||
| + | nano /etc/ftpusers | ||
| + | |||
| + | |||
| + | === Jailing Users in a folder === | ||
| + | |||
| + | Jailing users in a folder is a very common technique for server sharing like web hosting, you can give users access to only their folder & they cannot get out of their folder. (Please read some of the points above if you wish to do this) | ||
| + | |||
| + | You will have to edit your "proftpd.conf" file (or the vsftpd.conf file if you are using vsftpd instead) within that file you will see an option for default login root folder (If it is hashed out "#" unhash it & set it as "DefaultRoot ~" | ||
| + | |||
| + | Command to add a new user "testftp" & create a home / login folder in "/home/testftp" | ||
| + | |||
| + | <pre>useradd -m -d /home/testftp testftp</pre> | ||
| + | |||
| + | Set the password for the user | ||
| + | |||
| + | <pre>passwd testftp</pre> | ||
| + | |||
| + | ===SSH Lockout=== | ||
| + | |||
| + | <pre>nano /etc/passwd</pre> | ||
| + | |||
| + | Edit this file, find at the bottom their user name | ||
| + | |||
| + | You will see something like | ||
| + | |||
| + | <pre>testftp:x:1001:1001::/home/testftp:/bin/sh</pre> | ||
| + | |||
| + | name:x:userid:groupid::login/folder:/ssh settings (bin/sh = SSH Access, change this to /bin/false to prevent SSH login for this user) | ||
| + | |||
| + | You can also change the login/folder to where you want (as long as they have permissions to get into that folder it will work) | ||
| + | |||
| + | |||
| + | Now if you have already created your user great, if not see the steps above on creating a user (useradd username), Once you have created a user edit the "/etc/passwd" file & edit the home directory to the folder location you want e.g. /home/newuser (Make sure that user has permission on that folder, otherwise they wont be able to login (because they dont have access to that folder) | ||
| + | |||
| + | You can check folder permissions either on PuTTy using "ls -l" or the GUI / easier way in WinSCP - http://winscp.net | ||
| + | |||
| + | When you are connected via http://winscp.net you can right click on a folder & it will give you an option to enter a UID (User ID, as spoken about above) enter the users id to view/set their permissions on the folder, they will need at least Read & Execute on the folder in order for them to access the folder (You can set them the owner if you want to) | ||
| + | |||
| + | [[File:winscpuserperm.png|350px]] | ||
| + | |||
| + | |||
| + | === Folders & Group Access === | ||
| + | |||
| + | As you see in the screenshot above, there are two permission types you can set on each file/folder, You can give groups access to folders you want e.g. a "TF2_Server" you want your "TF2Admins" to have access to, all you would do is create a group & add the users you want to be in that group to it. | ||
| + | |||
| + | You then set the permissions on that folder e.g. "TF2Admins" as owner of the "TF2_Server" folder, then anyone in your "TF2Admins" group will have the access they should. | ||
| + | |||
| + | You can get the group id from /etc/group (As said about above) | ||
| + | |||
| + | use these commands to add a group & add users into that group | ||
| + | |||
| + | groupadd TF2Admins | ||
| + | |||
| + | usermod -a -G TF2Admins newuser | ||
| + | |||
| + | ===FTP Permission Numbers Explained=== | ||
| + | |||
| + | 1st Number = Owner Access | ||
| + | |||
| + | 2nd Number = Group Access | ||
| + | |||
| + | 3rd Number = Public Access | ||
| + | |||
| + | |||
| + | 0 No Permissions - The User(s) can't do anything | ||
| + | |||
| + | 1 Execute Only - The User(s) can only execute the file) | ||
| + | |||
| + | 2 Write Only - The User(s) can only write to the file / folder) | ||
| + | |||
| + | 3 Write and Execute Permissions - The User(s) can only Write & Execute the file) | ||
| + | |||
| + | 4 Read Only - The User(s) can only read from the file / folder | ||
| + | |||
| + | 5 Read and Execute Permissions - The User(s) can only read from the file / folder & execute the file | ||
| + | |||
| + | 6 Read and Write Permissions - The User(s) can only read & write to the file / folder | ||
| + | |||
| + | 7 Read, Write and Execute Permissions - The User(s) can do everything - Read, Write & Execute the file / folder | ||
