Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're setting up a CentOS 6.2/ Apache web server with higher security requirements than I'm used to.

I've set up a user group called "web" and I want to limit it's members to only being able to read, write and execute in /var/www/html/ and subdirectories.

Members of the "web" group should not be able to access any other part of the server (although individual user home directories are fine).

I thought this would be straight forward but have been going around in circles for the past half hour.

What bash commands do I need to use to achieve this?

share|improve this question
up vote 2 down vote accepted

Well, it seems to me that you'll need to jail the members of your group, otherwise they'll be able to see the content of your file system.

If you're going to allow ssh access to the users, you probably want to check this tutorial for chrooted ssh/sftp access:

Also, if this is the group apache will run under and you're going to host PHP applications, check out the php open_basedir directive in order to achieve such restriction:

Finally, if you're going to provide FTP access, I believe ftp servers such as vsftpd and proftpd will chroot its users by default, but the restriction will take place by their respective home directory.

Hope this helps you achieve your goal.

share|improve this answer
Thank you Luis. I'm heading home for the day but will crack into this tomorrow. – BaronGrivet Feb 15 '12 at 3:03
Hi Luis. I found this link about chrooting in CentOS which almost exactly matched my situation: - might be worth adding to your answer. – BaronGrivet Feb 16 '12 at 1:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.