up vote 0 down vote favorite
share [g+] share [fb]

I have a Debian 6 VPS which I want to host a few sites for myself and a friend. Is it a good idea to host our own sites in our home directory such as /home/user/sites/mysite.com and creating this as a virtual host?

Would I have to let the www-data account be also part of the 'users' group so that it'll be able to execute/create directories for example for wordpress?

Or would you recommend that instead we host the sites out of /var/www/?

Any feedback or advice would be greatly appreciated as I am eger to learn a simple/effective way to achieve this.

link|improve this question
73% accept rate
1  
Although it doesn't constitute as an answer; I have always used the latter of the two setups (/var/www) and any servers I have used that someone else has setup have been configured the same way. – dannymcc Jul 11 '11 at 21:03
feedback

2 Answers

up vote 2 down vote

Hosting sites inside your home directory isn't insecure; all you have to do is a+x the user's home directory to allow Apache in there, which isn't a security risk in any meaningful sense. For even better security, create separate users for any dynamic content, so a security problem in one dynamic site doesn't cause a defacement risk for all of your other sites.

Also, don't use mod_php for any system that's running more than one site, because (as you note) you then need to play games with permissions to make the webserver capable of writing dynamically generated content. Instead, use something like suPHP (or FCGI or suExec for general CGI content) to run each user's PHP code as themselves, not as the webserver. This provides better isolation and avoids the need for complicated permissions games (like putting www-data in the users group, which is just unclean).

link|improve this answer
I am relatively new to using Linux - but am eager to learn more. I have never heard of suPHP - is it difficult to configure and setup to configure? So if the sites are hosted in our user directories and permissions are user1:users - would php be running as user1 and thus be able to do everything required... I hope that makes sense. – Malachi Jul 12 '11 at 7:58
Yes, your understanding of how suPHP works is correct. I would recommend some independent research to discover suPHP and how it is installed and configured. – womble Jul 12 '11 at 10:31
feedback
up vote 1 down vote

For security reasons it's better to put the files outside the /home directory. You won't be able to read the directory /home/user/sites/mysite.com without changing the permissions for /home directory. What you may do is to do a symlink for example:

/var/www/html/user1 -> /home/user1/sites

And your DocumentRoot would be /var/www/html/user1 with allowsymlinks flag.

link|improve this answer
Thanks for your advice... I will look into this setup :) - What is the allowsymlinks flag? – Malachi Jul 11 '11 at 21:19
What should the permissions be on the folder /var/www/html/user1? – Malachi Jul 11 '11 at 21:58
Read permissions for others will suffice. Don't change the owner to apache or you will have to do 777 to edit the files. Make 777 only for the directories that need write permissions (cache, upload for example) – ghm1014 Jul 11 '11 at 22:04
2  
Global write for directories? I would consider that to be a terribly dangerous idea. – womble Jul 11 '11 at 23:19
You can also do chown to apache but will need root permissions to change writeable directories (cache, upload). For the rest of directories 755 and 644 for files – ghm1014 Jul 12 '11 at 13:56
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.