I've recently been asked to help out a friend with some server and website issues they have been having, nothing major really.

However I found out that since the day they got their VPS everything, including uploading files, installing wordpress, all FTP, everything has been done through root.

So I am wondering what is the best way to fix everything to make it more secure?

The reason im asking is because im assuming its more than just make a new non-root user to use for day to day stuff? Due to how everything has been set up and ownerships already with every other file etc


That is a bad mess.

  • I think you should create three users: one for day-to-day use (lets call this user, one for the web server (usually one is created when you install Apache, usually called www-data) and one for the FTP server (call this ftp), all with accompanying groups of the same name.
  • Add user to both www-data and ftp groups. chown the web directory to be owned by user:www-data, and make it setgid and setuid (chmod ug+s). Do the same for the FTP upload directory, but with user:ftp.
  • If the FTP upload and Wordpress media directory are the same, make a third group with all three users in it (call it upload, and chown the directory user:upload.
  • The web server is usually running as www-data, unless they deliberately went and changed it. You will have to configure the FTP server (usually vsftpd) to run as the ftp user.
  • Make sure all the relevant directories are setgid so that they inherit group permissions. You can make the setuid as well. (Only the directories, note!)
  • Restrict day to day stuff to user. Make sure www-data does not have write permissions where it has no business having them.

Beyond this, I am not really qualified to give security advice.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.