1

My websites are currently hosted on a Debian non LVM VPS in the /dev/vda1 partition in /var/www directory.

The root partition /dev/vda1 on my VPS is for 99% full. The home/ partition on /dev/vda6 however shows only 8% disk usage.

Resizing the /dev/vda1 partition and shrinking /dev/vda6 is to risky in my opinion, certainly when it concerns non-LVM partitions I think.

So I tried to think 'out of the box' on a workaround and copied all my websites verbatim to /home/user/web. I configured the webserver (cq Lighttpd) to point to the new location and restarted the webserver.

All is working fine, no problems arose for the last days.

I know that /home/user/web/ is not a ideal place to store websites, at least no one will encourage such a configuration I think.

My question is: Why is /home/user/web not an ideal web-root?

  • What makes you think it isn't ideal? It's no more or less ideal than any other directory, and as long as the perms on the dirs and files and the server config details are correct, it's exactly as secure as /var/www. It really doesn't matter what directory a vhost's DocumentRoot is in, as long as the web server (apache or whatever) is configured correctly. My own vhost setup scripts use /home/WEB/$vhost/htdocs by default, with other directories under /home/WEB/$vhost/ for logs, vhost-specific CGI scripts, etc...so that everything related to a vhost is under the same directory tree. – cas Apr 27 '16 at 0:52
  • I assumed it is not ideal, based on...yeah what? One thing that comes in mind is that as far as now, I never encountered a situation where a webroot was in /home/user dir. So that 'knowledge' made me assume /home/user was not appropriate for deploying a webserver. – kzpm Apr 27 '16 at 1:03
  • I've expanded my comment into an answer with some more details. – cas Apr 27 '16 at 1:03
  • @PersianGulf userdir is something entirely different. we're talking about virtual hosts, with their own domain names, not http://.../~username/ URLs. – cas Apr 27 '16 at 3:39
1

What makes you think it isn't ideal?

It's no more or less ideal than any other directory, and as long as the perms on the dirs and files and the server config details are correct, it's exactly as secure as /var/www.

It really doesn't matter what directory a vhost's DocumentRoot is in, as long as the web server (apache or whatever) is configured correctly.

My own vhost setup scripts use /home/WEB/$vhostuser/htdocs by default, with other directories under /home/WEB/$vhostuser/ for logs, vhost-specific CGI scripts, etc so that everything related to a vhost is under the same directory tree.

I also use apache-mpm-itk so that each vhost runs under it's own user id. This has security benefits (e.g. scripts from vhost1 can't touch files belonging to vhost2), and other benefits (e.g. log files can be chown-ed to the user, so they're part of the web site's quota, not owned by root...it's their responsibility to download and delete them regularly).

Of course, much of this is obsolete now because you get even better isolation from VMs and containers - but none of that existed when i first started writing my vhost automation scripts in the 90s.

| improve this answer | |
1

Read Debian Slice Configuration via Slicehost. Use a full fledged VPS Setup with Apache, and there is nothing wrong with using a users home directory as a webroot. The issue is that the users directory must be properly secured using Apache's security rules, not the base security rules.

| improve this answer | |
1

Potential security risk, you might be able to solve this with chroot (or jails or zones).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.