1

I was just wondering how you do your FTP on your webserver. I've always created a folder in /var/nameofwebsite.com and added a system user with their home directory there.

To me, this looks a bit hackish as files such as .bash_logout are in there and sometimes, the folder permissions don't even work correctly as I set the owner of the folder to <nameofwebsite><tld> and their group to ftp which all accounts intended for FTP are in.

Is what I am doing secure and right? I'm setting up a fresh new web server to host my sites on and wanted to know if this setup would last me long.

2 Answers 2

5

Not a solution to your question, but a suggestion to change your approach. No matter how you setup your server and users, FTP is never secure. FTP transmits your userid and password in plain text. Use secure FTP (SFTP) instead.

2
  • 1
    It's also messy to manage the network connections.
    – symcbean
    May 3, 2011 at 12:30
  • You can use FTP with SSL (FTPS) to avoid transmission of plain text passwords. But yah, depending upon how your network is setup it can be messy. Still, there is a surprisingly big chunk of the corporate world that uses FTP.
    – HTTP500
    May 3, 2011 at 22:28
1

As Vasu says, stop using FTP. There are lots of simple web based file managers you can run on top of HTTPS, but SCP is much preferable.

Leaving the transport aside for the moment, the main thrust of your question is all about network paths and permissions. We'd need to know an awful lot more information about the security model and constraints before any sensible discussion of permissions. At a guess, you might consider setting up a group for each vhost and making that the users default group (and setting umask accordingly). You should definitely consider making the vhost document root something other than the users home directory - a subdirectory is one way to do that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .