From Fedora Project Wiki
m (Clean up.)
m (Fix formatting of rewrite rule numbered list)
Line 77: Line 77:
The above is mostly:
The above is mostly:
1. match, except for www
# match, except for www
1. lowercase the first part of the server name
# lowercase the first part of the server name
1. if there is anything in the first part then take it and rewrite that path to:
# if there is anything in the first part then take it and rewrite that path to:<br><code>/home/fedora/$thatpart/public_html/whatever_else_was_on_the_url</code>
That's really it.
That's really it.

Revision as of 17:53, 26 May 2009 was set up to provide a place for fedora contributors/developers to host files/scm repositories/etc and easily exchange files with people as part of what they do for fedora. It's been very successful. In order to make it secure and sensible we needed to take some semi-extreme steps to keep people from abusing our generosity.

Getting the accounts on the box

We setup a new accountdb from the FAS named 'people'. This was a select of all the users in the db who are a member of any of the CLA_* groups and at least one other group. Then we used make-shell-accounts from the normal infrastructure to grab the nss_db files for the passwd/shadow/groups and the users dirs.

make-shell-accounts just grabs a tarball off of a central fedora server and unpacks it appropriately every hour. The server side job creates the tarball by querying the fas db for specific items and then creating 'fake homedirs' for the users that consist of a .ssh dir with their authorized_keys file. That way if a user modifies something in their homedir the only changes that get lost are ones to their authorized_keys file.

finally we modified /etc/nsswitch.conf to include 'db' for passwd, shadow and groups. This means that the system uses nss_db as an additional module to do user/group lookups.

polyinstantiated tempdirs

We wanted a way so that each user would have their own tmpdir and ONLY they could write to it. We also wanted the tmpdir to appear on the same filesystem as their homedir so we could make one set of quotas apply to all the places where the user could write. We used pam_namespace to configure /tmp and /var/tmp to point to a directory inside /home/tempdirs. In order to keep from having to make directories in advance for all of our users pam_namespace can make these on the fly at login.

/etc/pam.d/system-auth file:

session     optional revoke
session     required
session     [success=1 default=ignore] service in crond quiet use_uid
session     required
session     required


/tmp     /home/tempdirs/tmp/             user      root,adm,apache,puppet,nagios,rpm
/var/tmp /home/tempdirs/vartmp/          user      root,adm,apache,puppet,nagios,rpm

Make the dirs and protect them from snooping:

mkdir -p /home/tempdirs/tmp /home/tempdirs/vartmp
chmod 000 /home/tempdirs/*

Reboot and any login will have a dir made automatically in that path and they will not be able to distinguish /tmp from that path. It is bindmounted in place only for their login instance. Only they can see it and multiple logins do not conflict with each other.


We setup quotas in the normal way but with the user homedir and tempdirs all under one mounted location there's no place for the user to put files unsafely.

mount options

We mounted all partitions where a user could write with:


noatime is just for speed and less silly writes. Everything else is to keep them from doing anything sneaky. The above mount restrictions we also put on /dev/shm just to keep sneaky people from figuring out they could write there.

application set refinement

I sat for a while with yum shell open and purged any and everything there wasn't a compelling need for. I ended up adding back editors and most of the scms.

apache configuration for auto-setup

We wanted to provide hostname spaces like for all of the people with accounts on the machine. To do this and provide sane 404 or redirects when someone asked for

We got normal working as per normal UserDir option in apache.

Then we added in some serious rewriterule crack to make it all happen:

RewriteCond ${lowercase:%{SERVER_NAME}} ^www\.fedorapeople\.org$
RewriteRule ^/(.*)$$1 [R,L] 

RewriteCond ${lowercase:%{SERVER_NAME}} ^[a-z0-9-] +\.fedorapeople\.org$
RewriteRule ^(.+) ${lowercase:%{SERVER_NAME}}$1 [C] 
RewriteRule ^([a-z0-9-] +)\.fedorapeople\.org/(.*) /home/fedora/$1/public_html/$2 [L] 

RewriteRule   ^(.+)  -  [PT] 

The above is mostly:

  1. match, except for www
  2. lowercase the first part of the server name
  3. if there is anything in the first part then take it and rewrite that path to:

That's really it.