Thanks in advance for any help you may provide. I've self taught myself using linux (ubuntu), apache, virtual hosts and a few bits with regards to security, though I've yet to put these all together seamlessly.
I've also learnt the hard way from mistakes made in the past with regards to not setting up user accounts and sites/virtualhosts correctly. I ssh into the server as root (I know, very bad), and created all the virtual hosts and files manually, thus all being owned by root. I've had an old version of joomla exploited and malicious spam code inserted in all my other virtual hosts.
I'm in the process of moving to a new server and am looking for the correct steps to follow with regards to setting up virtual hosts and users accounts that can access them. Because we use 3rd party software, we have on a occasion needed someone else to ftp into the site to investigate their website files.
Our current server is version 10.04, however the new server is version 12.04. All website files are setup under
In short, I guess this is what I'm after.
How do I correctly setup a virtual host and user, so that it only has access to its own files, and not any other virtual host on the server. For example, should that site get exploited with malicious code, it can't infect other sites on the server
How would I setup users so that they can only ftp into their given files and not access any of the other sites.
As mentioned before, there are numerous articles detailing how to do any one of these steps, but nothing that brings them seamlessly together.
Really appreciate the help anyone can offer. Please feel free to ask for any additional information you may need to give advise. I'm currently following tutorials to setup chroot, however I fear I'm not doing this correctly as I've picked up a few inconsistencies along the way. Am also investigating jailkit.