Setting up a server for student developers

Question

I would like everyone's to have a folder in the home directory to accessible over the internet w/ password protected. I would also like to limit how much everyone can have in the home folder.

When they ssh on to the machine they also are only limited to viewing there files, and can see nothing beyond their home directory.

I am setting up a server for some students doing some coding and sharing of files. I would appreciate any help with this.

Please and thank you.

Answer 1

First of all, you should use key-based authentication for ssh, not password based. They need to learn how to do proper security from the start...

OpenSSH has the option to chroot users into their home directory, that should keep the students inside their own $HOME. Alternatively, you can use permissions / umask to restrict access to other student's $HOME.

More might/will be needed depending on what sort of development they need to do...

Answer 2

chroots are a little bit overkill given the parameters.

Simply setting the user's home dirs to 700 permissions, or more specifically "only the owner can do anything in the directory" will be sufficient. If you're worried about them knowing that eachother exist with ls /home you can go further and create a /home/students dir which is root owned and perms rwx--x--x and create the users inside of that.

Edit /etc/adduser.conf to set the DIR_MODE=0700, and DHOME=xxx to set the default home prefix.

Agreed with the person earlier who said that you should enforce SSH keys only for access to this machine. Rather than giving them a one time password, you should ask them to generate an ssh public key and give it to you via email.

ssh-keygen -t rsa -b 2048

Should be sufficient and will work on Linux and Mac. If they are on windows, PuTTY has a good tutorial for setting up ssh keys. After that command, they should send you ~/.ssh/id_rsa.pub only.