Multiple shell users accessing a single app?

MattShepherd

This may be a dumb question, but can multiple shell users access the same application? I'm helping a friend out by hosting his (very simple HTML/CSS resume site for him, and as I'm setting up in OpalStack created a new shell user for his app. I'm now realizing I need to switch SFTP users to access 'his' account and make changes, which wasn't my original intent -- I wanted both of us to be able to access and modify the application.

sean

You can use filesystem access control lists (FACLs) to let one shell user grant permission to another.

For example, if user1 wants to give user2 permission to access app1 then user1 would run the following commands in a SSH session:

setfacl -m u:user2:--x $HOME
setfacl -R -m u:user2:rwx $HOME/apps/app1
setfacl -R -m d:u:user2:rwx $HOME/apps/app1
setfacl -m d:u:user1:rwx $HOME/apps/app1
chmod g+s $HOME/apps/app1

batlles

sean I've followed these intructions and they were working fine after adding the Symlink in the corresponding user2.

My question is about the kind or permissions the USER 2 would have over the USER1's app1?
Including "rwx", I was assuming that User 2 would have full rights over the App1 (like User1), does it work like this?

The purpose of my question is that I need User2 to performs the deploy for the App1 (including removing files, start/stop the app, etc...) so I hesitate whether USER 2 has all necessary access rights to do 'whatever USER 1 could do'?

Thank you

MattShepherd

Thanks, Sean -- should this create a shortcut or pathway in my SFTP program so user2 can then see app1 in /home/user2/apps? I didn't get any errors when running the commands in Putty, but user2 still can't see the app in the SFTP program.

(I also ran the commands as user1 in his home directory, but I don't think that makes a difference?)

For what it's worth, I tried (while logged in as user1):

ln -s /home/user1/apps/app1 /home/user2/apps/app1 to see if I could generate a link, but got a failed to access: permission denied error.

sean

MattShepherd Ok, please email our support address with the details (ie the users and app) so that we can take a closer look.

sean

Ok, the permission error happened because you were trying to directly modify the contents of your ~/apps directory (ie by trying to create a symlink there). The contents of that directory are managed by our control panel, so you can't directly modify anything in there.

You can create the symlink anywhere in your home directory with the exception of directly under ~/logs or ~/apps.

sean

batlles rwx on the files will give the user2 the ability to read, write, and execute those files.

Directory permissions work a bit differently: rwx on the directories will give user2 the ability to do the following:

List the contents of the directory (via r)
Create and delete files and directories within the directory (via w)
Navigate into the directory (via x)

However, none of these permissions will give user2 the ability to start and stop the app, because filesystem permissions don't give you control over another user's processes.

For the sort of collaboration you're describing we really recommend that you collaborate via git or some other version control system and then deploy via a post-commit hook or similar that copies the files into place and restarts the app automatically.

Will make a HOWTO for this as soon as I have a chance 🙂

batlles

sean understand - Thanks for the clarification about files, directories and apps.

Indeed we are using git for the deploy but we thought that using User2's credentials wouldn't work in order to restarts the app based on the persmission discussion above.

We will continue working on that strategy and we will be waiting for your super HOWTO whenever it is available 😉

lunarcreative

@sean Is there HOWTO ready?🙂
I have usecase when i need to give access to external dev to create and manage one application. But dont want him to have access to emails, dashboard and other apps. What is best way to do this?

sean

lunarcreative We don't have any way for someone to create applications without full access to the dashboard.

If you want to create the application yourself and then give them access to it via a different shell user then see: HOWTO grant access to a directory

pjrobertson

EDIT: my bad, I had a typo in the 'user2' email. All works now 🙂

I am currently trying to do this, and I'm getting the following errors:

setfacl: Option -m: Invalid argument near character 3

I used the code in the 2nd post, and as listed here: https://docs.opalstack.com/topic-guides/tips/#howto-grant-access-to-a-directory. Server is opal2