Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was just wondering how you do your FTP on your webserver. I've always created a folder in /var/nameofwebsite.com and added a system user with their home directory there.

To me, this looks a bit hackish as files such as .bash_logout are in there and sometimes, the folder permissions don't even work correctly as I set the owner of the folder to <nameofwebsite><tld> and their group to ftp which all accounts intended for FTP are in.

Is what I am doing secure and right? I'm setting up a fresh new web server to host my sites on and wanted to know if this setup would last me long.

share|improve this question

migrated from stackoverflow.com May 3 '11 at 10:48

This question came from our site for professional and enthusiast programmers.

2 Answers 2

Not a solution to your question, but a suggestion to change your approach. No matter how you setup your server and users, FTP is never secure. FTP transmits your userid and password in plain text. Use secure FTP (SFTP) instead.

share|improve this answer
1  
It's also messy to manage the network connections. –  symcbean May 3 '11 at 12:30
    
You can use FTP with SSL (FTPS) to avoid transmission of plain text passwords. But yah, depending upon how your network is setup it can be messy. Still, there is a surprisingly big chunk of the corporate world that uses FTP. –  HTTP500 May 3 '11 at 22:28

As Vasu says, stop using FTP. There are lots of simple web based file managers you can run on top of HTTPS, but SCP is much preferable.

Leaving the transport aside for the moment, the main thrust of your question is all about network paths and permissions. We'd need to know an awful lot more information about the security model and constraints before any sensible discussion of permissions. At a guess, you might consider setting up a group for each vhost and making that the users default group (and setting umask accordingly). You should definitely consider making the vhost document root something other than the users home directory - a subdirectory is one way to do that.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.