Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Config: Debian Lenny Apache2

I have configured SSH to "PermitRootLogin no" and have created another user to login with and the do "su".

Now I want to connect with e.g. Filezilla via SFTP. I can do that by creating a user that only has access to "/var/www" (all my website are located there e.g. "/var/www/")

But doesn't that kinda defeat the idea of using "su"? Of course "su" in this case will secure everything else but "/var/www" will not get the added protection. The reason I created the "su" setup in the first place was to protect my websites better.

By the way, I am the only one that will be uploading stuff to the server.

What am I missing?

share|improve this question
If you need just to download/upload files you can look at ProFTPD (mod_sftp) with /sbin/nologin as user shell and chroot. – ALex_hha Feb 21 at 22:50
up vote 1 down vote accepted

Here my compendium for optimal configuration in both clients and servers:

(special care of users and permissions)

share|improve this answer

What you're missing is an understanding of what it means to su while logged in via ssh and what it means to transfer files in an encrypted manner. You're confusing several ideas here.

You've done the correct thing by denying root login via ssh. That will limit brute force attacks and keep you (since you'll need to elevate your privileges by using sudo or su) from making needless mistakes.

Having access via sftp does not give you the same privileges of su via ssh. It guarantees that your password will not be sent in the clear and that your files transfers are secure.

I'm going to go out on limb here and also suggest that you do a search on linux file permissions (for users and groups). Understanding those will help you secure your webserver and will help you understand why having a user that can su doesn't mean that your server is inherently insecure.

share|improve this answer

You could use extended ACLs to allow only your user write access to the directories (with setfacl). This also has the benefit of being easy to add future users to it.

Or, you could go with making the directory owned by your UID's group, and then make it group-writable, but I think this isn't as clean a solution as the above, and you might run into problems if your website needs to write to anything as the (presumably) Apache user.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.