1

Is it secure to change DocumentRoot path to some folder in user's Home directory?

Or it's better to leave it be and using a shared group between your user and Apache server as you can see it in the following solution: https://serverfault.com/a/65416

I've read a thing or two and my solution would be as follows:

  1. Create a new user and a new group for Apache only (ideally, restrict shell access for that user)

  2. In httpd.conf change User and Group directives to newly created user and group

  3. Create new folder in your Home directory for your websites e.g Websites\Project1\public_html

  4. Change the public_html's ownership to created earlier user and group

  5. Set chmod 2775 (wtih SETGID) to folders and chmod 664 to files (recursively, if needed)

  6. Set umask 0002

  7. Finally, add yourself to group created in the first step

  • I like the SO method. My experience is to harden this even more. See if below makes sense to you :) – Rinzwind Jun 26 '16 at 15:00
1

The best way (my opinion) is to use a different user for apache (www-data, apache) and use the following method:

  1. create an FTP location that has the subdirectories of your website. Chroot this location. For traceability I would use different users if there is more than 1.

  2. setup a cronjob (/etc/crontab with the apache user as the one executing this) with a script that scans the directory for new content every few minutes. If new content found let it make a backup of the files on the apache side (compressed tar file with username and a timestamp in the filename) of the files found on the ftp side.

  3. let the cronjob copy the files over. You could finish this off with a confirmation mail that this was done by 'user' and include a diff of the differences.

In case something goes wrong you can

  1. track who did it.
  2. what this person did.
  3. undo what he did.

Do not use the documentroot for development. 1 typo can kill the website and then someone has to find this typo and fix it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.