This question already has an answer here:

I am currently learning PHP, and I am new to Ubuntu. When I was practicing PHP on Windows, I used XAMPP and create files in htdocs. Now that I am using a Linux machine, I have installed the LAMP package, but I did not initially have access to create files in the var/www/html folder.

I used sudo nautilus to give myself access to create and delete files for testing purposes. Is this OK? Does it open me up to any risk? This is all local work on a local machine. Another difference from XAMPP is the ability to turn MySQL and Apache on and off/open and close the ports. Do I need to worry about this now that I am using LAMP? I just want to be secure; I'm new to this.

Thank you in advance.

marked as duplicate by Panther, muru, karel, David Foerster, user535733 Mar 12 '18 at 13:24

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


I think there are a couple of things you should check out first which will serve you as an introduction.

What you have in /var/www/html is what is called a "Directory" for a Virtual Host in Apache.

What does this mean? It means this directory has been created and defined by default for you. It also means you can create a directory anywhere in your filesystem and assign it as the directory for this Virtual Host.

Where does this Virtual Host definition live? In LAMP, you have this called Virtual Hosts. This means you can host many websites and resources in your same server/machine. These virtual hosts are usually defined under /etc/apache2/sites-available/

If you check that folder you'll find this file: 000-default.conf

There's where /var/www/html is defined. You are actually free to modify this, and place it, let's say somewhere beneath your /home/{user} directory.

I recommend you as a next step for your introduction to LAMP (in Linux) to take a look at Virtual Hosts. How to create them, and how to make them work.

You will find some Apache commands like a2ensite a2dissite to make the new virtual host sites available or disable them and many other interesting things in the way.

Security Issues:

About your security concerns if you want to be sure no-one has access to your /var/www/html you should have an active firewall. The firewall would block any non-requested communication to port 80, which is the port wide open for /var/www/html

You should notice that the Virtual Host defined by default has the widest possible access. It's defined like this <VirtualHost *:80>. This definition makes anyone guesssing your IP in your LAN to have access to see your /var/www/html. That's actually the purpose of a server, to serve things to the outside world. So that's basically ok.

But if you want to protect that, you have to either created a new VirtualHost, aka a named Virtual host, and probably use a Firewall to protect your ports (port 80, and whatever other port you wanna use)

  • Thank you. I will study up on virtual hosts. In the meantime, I have not put myself at any risk or disadvantage by creating files in the director? And I do not need to worry about disabling apache and MySQL (the ports) when I am not using them? – Zach Mar 12 '18 at 3:33
  • @Zach Yes, Virtual Hosts knowledge is definitely the way to feel comfortable at building sites and scripts in your apache environment. – MarkSkayff Mar 12 '18 at 3:35
  • @Zach About your security concerns, I recommend you check you have installed some firewall like ufw or install a GUI for ufw called firestarter. A firewall would protect you from non-requested intromissions. What you must understand is that if someone has access to your network and guesses your IP, if you have port 80 open, they will be able to see what's under your /var/www/html – MarkSkayff Mar 12 '18 at 3:37
  • Thanks! I will look into ufw and firestarter. My WiFi network has a passcode also. – Zach Mar 12 '18 at 3:40
  • 1
    FYI - There is already an outstanding community answer to the security issues here - askubuntu.com/questions/46331/… . Second, I disagree with serving out content from a users home directory in this way, I advise you use the userdir module - techytalk.info/… – Panther Mar 12 '18 at 5:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.