lol internet. fucked around with this message at 02:40 on Dec 4, 2012

lol internet. fucked around with this message at 08:58 on Dec 4, 2012

OnceIWasAnOstrich fucked around with this message at 20:26 on Dec 4, 2012

lol internet. fucked around with this message at 20:01 on Dec 4, 2012

Bob Morales fucked around with this message at 21:54 on Dec 4, 2012

Comradephate fucked around with this message at 18:33 on Dec 10, 2012

• make sftp group, add user1 user2 user3 etc to group
  
• add www-data to the groups user1, user2, user3
  
• lock down sshd apart from sftp/scp for members of the sftp group to their own home dir:
  

  code:

  Subsystem sftp internal-sftp   
  Match Group sftp
  ChrootDirectory %h
  ForceCommand internal-sftp
  AllowTcpForwarding no
  X11Forwarding no
  

  (unfortunately due to the way this "jailing" works, their home dirs have to be owned by root:root, so we make another dir inside each home called www, which they have rights on)
  
• for each user:
  /home/userN owned by root:root, chmod 755
  /home/userN/www owned by userN:userN, chmod 750
  
• run one instance of php5-fpm for each user. e.g. /etc/php5/fpm/pool.d/userN.conf
  

  code:

  [userN]
  user = userN
  group = userN
  listen = /var/run/php5-fpm-$pool.sock
  pm = dynamic
  pm.max_children = 5
  pm.start_servers = 2
  pm.min_spare_servers = 1
  pm.max_spare_servers = 3
  pm.max_requests = 200
  chdir = /
  

• for each virtual host in nginx, pass php files to the appropriate fastcgi pool
  

  code:

  location ~ \.php$ {
    fastcgi_pass unix:/var/run/php5-fpm-userN.sock;
    fastcgi_index index.php;
    include /etc/nginx/fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_param PATH_INFO $fastcgi_script_name;
    fastcgi_param SERVER_NAME $domain;
  }

  ($domain is a local variable in my conf, you'll need to change that)
  
• set the default umask to 027 in /etc/pam.d/common-session. do not omit to do this.
  

  code:

  session optional pam_umask.so umask=027

• files users upload will be owned by themself:themself with chmod 640, dirs will get 750
  
• nginx (www-data) gets read-only access for serving static content
  
• php scripts will be run as the appropriate user
  
• this allows them r+w access to their own files but no access to other users' files
  

vty fucked around with this message at 02:48 on Dec 12, 2012

• TUN/TAP devices without them having to be enabled in the hypervisor
  
• 
  

[root@Qtbox ~]# wget -O /dev/null cachefly.cachefly.net/100mb.test
--2013-01-02 02:23:37--  [url]http://cachefly.cachefly.net/100mb.test[/url]
Resolving cachefly.cachefly.net... 205.234.175.175
Connecting to cachefly.cachefly.net|205.234.175.175|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 104857600 (100M) [application/octet-stream]
Saving to: â/dev/nullâ

100%[======================================>] 104,857,600 84.8M/s   in 1.2s

2013-01-02 02:23:38 (84.8 MB/s) - â/dev/nullâ

[root@Qtbox ~]#

[root@Qtbox ~]# time dd if=/dev/zero of=/tmp/test-hd bs=1M count=1000
1000+0 records in
1000+0 records out
1048576000 bytes (1.0 GB) copied, 2.56856 s, 408 MB/s

real    0m2.759s
user    0m0.000s
sys     0m1.546s
[root@Qtbox ~]#

River fucked around with this message at 00:30 on Jan 2, 2013

River fucked around with this message at 05:26 on Jan 2, 2013

River fucked around with this message at 06:27 on Jan 2, 2013