First, some background info about the server

Running latest ubuntu and nginx. Nginx is set up for virtual hosts. Users (100+ of them) are allowed to serve a website my placing their html at $HOME/site.domain.com/public/ If their site is security-sensitive, they can place a rsa key pair at $HOME/site.domain.com.pem $HOME/site.domain.com.key and this gets picked up by nginx and the html is served in https mode without certificate errors.

The problem: What (chmod) permissions should $HOME/site.domain.com.key have?

Here are the constraints

- Other linux (non-root) users should not be able to "steal" .key files.
- Nginx runs as user www-data and group www-data I believe. So nginx needs to be able to have read access to any users .pem file when nginx is rebooted with `service nginx restart`
- Root users (root and ubuntu) should have access to any file using sudo
- To make user management easy, the users we added (not the ones that comes with ubuntu install) all have their primary group set as "ourcompanygroup". I'm flexible on this.

References: http://nginx.org/en/docs/http/configuring_https_servers.html

  • As long as the users are not part of the www-data group just make all the files in question owned by user:www-data and permissions 640 . – Panther Jan 3 '18 at 22:49
  • I forgot to mention that a) users don't have sudo chmod access b) I prefer not to get involved, I do have sudo chmod powers. – american-ninja-warrior Jan 3 '18 at 22:57
  • users do not need sudo powers to chown or chmod files they own (as long as they are in the www-data group) – Panther Jan 3 '18 at 23:19
  • i find this an interesting question. I'm not sure if this is the right place for consulting advice on setting up 100 client website though. – WinEunuuchs2Unix Jan 4 '18 at 1:48
  • @WinEnuuchs2Unix it is easy to do with apache. See techytalk.info/… or similar. Works on other distros also. Then the second problem is the keys but again there are other options – Panther Jan 4 '18 at 2:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.