Up to know, I used a sandbox server for myself only, and websites were in subdirectories of /home/www/:

drwxr-xr-x  5 root root 4096 Nov 30 14:45 www
|--- drwxr-xr-x  3 www-data www-data 4096 Oct 14 22:04 mywordpress  (subdir of /home/www/)

The only users/groups I saw were root and www-data.

Now I'd like to allow a friend to host a website on this sandbox server. I created a user account abcd, and his home is /home/abcd/. In /home/, I currently have:

drwxr-xr-x  3 abcd abcd 4096 Dec 10 12:02 abcd
drwxr-xr-x  5 root root 4096 Nov 30 14:45 www

Problem: if I log-in via SSH with the account abcd, I can still browse /home/www/, which I don't want! Then I thougt I should just give drwxr-xr-- permission to this directory, but then I fear that Apache/PHP-related things, often using www-data, won't be able to browse /home/www/ anymore!

Question: can you recommend a simple directory structure of /home/ of this sandbox server, allowing myself and a friend abcd to host Apache+PHP websites, without abcd being able to see my files in /home/www/? (NB: www-data should still be able to see the files, I think this is necessary?)

  • I already know wiki.archlinux.org/index.php/… but I don't know how to do it in a clever way here. – Basj Dec 10 '18 at 13:04
  • @Downvoter: can you leave a note about how to improve this question? Thank you in advance. – Basj Dec 10 '18 at 14:24

The question does not have a strait forward answer because there are additional details to address. However, the permissions portion is quite simple.

chgrp www-data /home/www
chmod 0750 /home/www

This maintains rwx for root, provides r-x for www-data, and removes all access for all others. This is not a recursive change, so the Word Press websites still have the write access that they need.

One might also give the user, abcd, a little privacy from any future users that are created in the same way.

chgrp www-data /home/abcd
chmod 0750 /home/abcd

Note that any user with access to the Web server might also be able to use it to read files in /home/www. For example, via a file inclusion of any kind... using the Web server itself or via a programming technology that the Web server uses, such as PHP. Further restriction may be required in the Web server configuration and in any Web programming language that has been installed, even CGI. Remember that the abcd user has access to the www-data user; thus, this portion of the overall goal is a beginning, but not an end.

To get a good answer on the remaining portion, please ask a new question with all of the details about the Web hosting environment.

  • Operating system name and version
  • Web server name and version
  • Name and version of any Fast CGI software
  • Fast CGI configuration
  • The Apache configuration file
  • The PHP version and configuration file(s)
  • Other relevant information

Providing as much pertinent information as possible (without providing too much detail) will help the one who answers provide a detailed response. Perhaps subtract comments from posted files to eliminate as much "noise" as possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.