I posted this on stackoverflow and was told to post here:
I am running a Ubuntu remote dev server, heavily restricted (due to compliance) environment which i previously had configured correctly for many devs a year ago but forgotten it.
On this sever i log in as root and have my own folder in
/var/www/me/laravel
and everything works fine, i am now adding new users to this server but can't get it working.
In this case i want to create a user called "mike" and allow him to have full read, write and execute permissions in his folder (to run multiple applications laravel and angular) located in
/var/www/mike
For applications served by apache.
mike will remote ssh onto the server using his ubuntu username / password and be restricted to his folder and only work on projects it's subfolders, not being able to move outside of his home directory but have full control all the folders in this directory to remotely develop.
So far i have:
sudo useradd -m -d /var/www/mike mike
sudo passwd mike
sudo chmod 700 /var/www/mike
sudo nano /etc/ssh/sshd_config
Then i add the below to the file and restart the ssh service:
add:Match User mike
PasswordAuthentication yes
AllowTCPForwarding no
#ForceCommand internal-sftp
ChrootDirectory /var/www/mike
sudo service ssh restart
if i enable
ChrootDirectory /var/www/mike
mike cannot log into the server, if i comment out ChrootDirectory mike can log in fine but still navigate into root, just not other users folders if i give them each chmod 700 but then it messes with apache to serve the application in those folders.
i've tired following this:
https://unix.stackexchange.com/questions/542440/how-does-chrootdirectory-and-a-users-home-directory-work-together
and i have set
/var/www/mike
as
chown root:root /var/www/mike
with
chmod 755 /var/www/mike
then created a folder
/var/www/mike/home
and gave it it
chown mike: /var/www/mike/home
chmod 750 /var/www/mike/home
usermod =d /var/www/mike/home mike
if i try then set
ChrootDirectory /var/www/%u
it allows me to log in but in the auth.log after the session opened for mike, i see
error: /dev/pts/0: No such file or directory
Also in regards to laravel set up with this chroot i cannot remember if i should add
usermod -a -G users www-data
Then i need to allow Apache www-data to serve this directories public folder and have the correct permissions for laravel storage, cache etc to execute by apache.
I tried
cd /var/www/mike/home/laravel
sudo chown -R mike:www-data
to give both the user and the webserver permissions:
sudo find . -type f -exec chmod 664 {} \;
sudo find . -type d -exec chmod 775 {} \;
so the webserver has rights to read and write to storage and cache
sudo chgrp -R www-data storage bootstrap/cache
sudo chmod -R ug+rwx storage bootstrap/cache
Can any one tell me what i am doing wrong?