Add cookbook

[carlalexander]

It'd be good to add some recipes for some known situations:

• [x] Overriding the default WordPress configuration
• [x] Creating another sudoer user and locking down root
• [ ] Creating an FTP user
• [ ] Migrating an existing site

[carlalexander]

Might not need to do a guide to create another sudoer user. debops bootstrap -u root created a sudo account for the account of my local machine.

[carlalexander]

After talking with @drybjed a while ago, locking down root isn't ideal because some DebOps role need the root user.

[carlalexander]

Started researching how to handle SFTP users with debops.sftpusers. The main issue is that you still need SSH keys to connect to the server. It's hardcoded into sshd_config in debops.sshd.

It's more secure, but has some serious draftbacks. The average WordPress user needs to give SFTP access to their clients. These clients aren't tech-savy and asking them to supply a SSH key isn't realistic.

Will have to take a look into how we can bypass that for that guide.

[drybjed]

@carlalexander If clients aren't tech-savvy, why do they need access to a UNIX account in the first place? You can create an account in WordPress CMS for them, which probably will end up with a password, hopefully random. But WordPress application should be reasonably secured by running php5-fpm daemon on separate user account. More security options, like AppArmor, will probably help as well in the future.

If you really want to use passowrds for SSH, you can enable password authentication in debops.sshd role, but I advise strongly against that. It's 2015, there are plenty of guides on how to create SSH keys, they can even be easier to use than passwords by using ssh-agent to keep the passphrase handy for the user.

[carlalexander]

I want passwords for SFTP users. Not regular Unix users. That I understand, but you force it even for SFTP. It's this sections that can be loosened as far I could tell from looking around:

Subsystem sftp internal-sftp
Match group sftponly
        ChrootDirectory %h
        X11Forwarding no
        AllowAgentForwarding no
        AllowTcpForwarding no
        PasswordAuthentication no
        AuthorizedKeysFile {% if monkeysphere is defined and monkeysphere %}{{ sshd_authorized_keys_monkeysphere | default('/var/lib/monkeysphere/authorized_keys/%u') }} {% endif %}{% if sshd_authorized_keys_global is defined and sshd_authorized_keys_global %}{{ sshd_authorized_keys_global | default('/etc/ssh/authorized_keys/%u') }}{% endif %}

        ForceCommand internal-sftp

[drybjed]

@carlalexander Yeah, you're right, it cannot be changed right now. I guess debops.sshd is overdue for an update, I wanted to convert the sshd_config file to be assembled from parts; that way other roles could drop in their own Match sections, for example. I'll try to update it soon.

[carlalexander]

@drybjed Yeah, that'd be great. I think it would be fair if debops.sftpusers could create regular passwords for the users too.

[cezarneaga]

any progress on the ftp users? i use root to upload and then have to chown -R www-data:www-data the uploaded files

[carlalexander]

No progress yet @cezarneaga. Trying to wrap up all my other documentation issues first 😞