Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

This is what I did:

  1. CentOS 6.2 server
  2. installed nginx
  3. installed vsftpd
  4. in vsftpd.conf I set chroot_local_user=YES
  5. created a new user "bleh"
  6. created directory /home/bleh/public_html/
  7. in virtual.conf I set location / { root to /home/bleh/public_html/
  8. and finally did chmod 755 /home/bleh/

Is this safe? Is this acceptable?

I ran into all sorts of permission problems when I tried to use /var/www/ as root. The above worked and the server is delivery data.

share|improve this question

1 Answer 1

That may be bad security for a few reasons.

  1. If /var or /var/www is on its own partition, it may have been mounted with special restrictions. For example, it may have been mounted with options such as noexec or nosuid. /home might not have these restrictions.

  2. In many cases, the directory from which you are hosting your website should not be world-readable. You should generally make your content only readable by its owner and group. Your webserver should be run as a user that can read those files.

  3. Mixing server data in with user data might lead to the accidental hosting of sensitive data. For example, you might accidentally host the user blah's data.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.