I meant to files in directories like:
/root/*
/etc/*
/bin/*
and stuff...
Hello,
DirectAdmin relies on the linux security model to help out with keeping important files safe. You mention your /root directory is readable. Since users are running as "username", then you'd simply make sure your /root folder is chowned to root:root, and is chmod to 700. If it's 755, then change it 700.
It is normal for the /bin and /etc folders to be readable by system accounts. For example, the /etc/passwd should be 644 (readable) so that clients can get proper uid numbers for files on disk. The /etc/shadow should be 600 (not readable) since it contains the crypted passwords. Clients can see the contents of the /etc folder, but it doesn't mean they can get the data in each file (depending on permissions of the file)
In any case, chroot ssh is safer.. or better yet, no ssh.
This guide would be the solution to jail ssh if you want. You don't need to use the cgi-bin jailing if you don't want to. It makes things a bit messy and the guide is for apache 1.3. The guide is eternally in beta testing due to the complexity of it, and because each OS is different and has libraries in different locations. It may or may not work for you.
There are other things you can use to increase security though. Many are listed here:
http://help.directadmin.com/item.php?id=247
One good one is the secure_access_group, setup by DA:
http://www.directadmin.com/features.php?id=961
which sets the /home/username folders to 750, chown username:access.. where the "access" group is a list of system usernames that can see in. Other ssh users will not be able to see in.
Tip #14 of the id=961 guide is also a creative way of blocking specific usernames from accessing files or folders. A new group called "users" could be created.. where all ssh Users are in it.. and you'd simply set the group of a file or folder to "users" and chmod it to 604 or 705 (respectively) and anyone in "users" won't be able to see in that folder.
For example, if you wanted to block "users" from seeing in the /etc directory, create the "users" group, add your ssh account names to it.. and type
Code:
chgrp users /etc
chmod 705 /etc
and then anyone in users won't be able to read /etc. Note, I have not tested this.. so it may be a bad example and could break things.. but it should get the point across as to what I mean about using the negation permission (0) on files/folders with respect to groups.
John
