Infrastructure/FedoraPeopleConfig

fedorapeople.org

fedorapeople.org was set up to provide a place for Fedora contributors and developers to host files, scm repositories, etc. and easily exchange them with people as part of what they do for Fedora. It has been very successful. In order to make it secure and sensible, we needed to take some semi-extreme steps to keep people from abusing our generosity.

Getting the accounts on the box

We setup a new accountdb from the FAS named people. This was a select of all the users in the db who are a member of any of the CLA_* groups and at least one other group. Then we use make-shell-accounts from the normal infrastructure to grab the nss_db files for the passwd/shadow/groups and the users dirs.

make-shell-accounts just grabs a tarball off of a central Fedora server and unpacks it appropriately every hour. The server side job creates the tarball by querying the FAS db for specific items and then creating 'fake homedirs' for the users that consist of a .ssh directory with their authorized_keys file. That way, if a user modifies something in their homedir, the only changes that get lost are ones in their authorized_keys file.

Finally, we modified /etc/nsswitch.conf file to include 'db' for passwd, shadow and groups. This means that the system uses nss_db as an additional module to do user/group lookups.

Polyinstantiated tempdirs

We wanted a way so that each user would have their own tmpdir and ONLY they could write to it. We also wanted the tmpdir to appear on the same filesystem as their homedir so we could make one set of quotas apply to all the places where the user could write. We used pam_namespace to configure /tmp and /var/tmp to point to a directory inside /home/tempdirs. In order to keep from having to make directories in advance for all of our users, pam_namespace can make these on the fly at login.

/etc/pam.d/system-auth file:

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore]  pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     required      pam_namespace.so

/etc/security/namespace.conf:

/tmp     /home/tempdirs/tmp/             user      root,adm,apache,puppet,nagios,rpm
/var/tmp /home/tempdirs/vartmp/          user      root,adm,apache,puppet,nagios,rpm

Make the dirs and protect them from snooping:

mkdir -p /home/tempdirs/tmp /home/tempdirs/vartmp
chmod 000 /home/tempdirs/*

Reboot and any login will have a directory made automatically in that path and they will not be able to distinguish /tmp from that path. It is bindmounted in place only for their login instance. Only they can see it and multiple logins do not conflict with each other.

Quotas

We setup quotas in the normal way but with the user homedir and tempdirs all under one mounted location, there's no place for the user to put files unsafely.

Mount options

We mounted all partitions where a user could write with:

usrquota,noatime,noexec,nosuid,nodev

noatime is just for speed and less silly writes. Everything else is to keep them from doing anything sneaky. We also put mount restrictions above on /dev/shm just to keep sneaky people from figuring out they could write there.

Application set refinement

I sat for a while with yum shell open and purged any and everything there wasn't a compelling need for. I ended up adding back editors and most of the scms.

Apache configuration for username.fedorapeople.org auto-setup

We wanted to provide hostname spaces like username.fedorapeople.org for all of the people with accounts on the machine. To do this and provide sane 404 or redirects when someone asked for thisuserdoesnotexist.fedorapeople.org, we got normal fedorapeople.org/~username working as per normal UserDir option in Apache.

Then we added in some serious rewriterule crack to make it all happen:

RewriteCond ${lowercase:%{SERVER_NAME}} ^www\.fedorapeople\.org$
RewriteRule ^/(.*)$ http://fedorapeople.org/$1 [R,L] 

RewriteCond ${lowercase:%{SERVER_NAME}} ^[a-z0-9-] +\.fedorapeople\.org$
RewriteRule ^(.+) ${lowercase:%{SERVER_NAME}}$1 [C] 
RewriteRule ^([a-z0-9-] +)\.fedorapeople\.org/(.*) /home/fedora/$1/public_html/$2 [L] 

RewriteRule   ^(.+)  -  [PT] 

The above is mostly:

1. Match anything.fedorapeople.org, except for www
2. Lowercase the first part of the server name
3. If there is anything in the first part then take it and rewrite that path to: /home/fedora/$thatpart/public_html/whatever_else_was_on_the_url

That's really it.