If I provide SSH access to users who has paid webhosting service, what security measures should be applied ?
What I can think of:
- SSH keys RSA of 4096 size (shall be secure for a while)
- Apache MPM-ITK (separating each domain/subdomain) via separate user/group according to business (who paid for which service)
- Permissions to each web root (0750) recursively
- Checking for dangerous/invalid SUID/SGID binaries in $PATH
- umask (027) so new files are covered by default
Similar answer is Securing restricted shell environments, but in my opinion doesn't cover the specific use-case of mine.