I have two conflicting needs. I'd like to serve files with Apache out of /home/steve/public_html/ which according to the documentation I've read, requires me to set a+rwx on /home/steve/.

I'd also like to use SSH to connect to this account, but if I set my home directory to world-readable, SSH complains (rightly so), and doesn't let me connect.

Is there a way that I can serve files from public_html while still allowing SSH access?

EDIT: After reading the answers and doing a bit of critical thinking, I realized I was asking the wrong question. What I should have been asking was:

  • how do I safely develop and test php code in my home directory, when this code requires Apache to write to an SQLite database. The answer, obviously, being: put the database under /var/www/ and everything else in public_html.
  • Which ssh complains about that? – Ignacio Vazquez-Abrams Jan 20 '11 at 1:22
  • 1
    I think OpenSSH will, because write access (note the a+rwx) to /home/steve means any user can mv /home/steve/.ssh /home/steve/.ssh.old then create a new /home/steve/.ssh and corresponding authorized_keys. But in that case, checking that steve owned authorized_keys should still be sufficient, so I'm not sure why. – Mikel Jan 20 '11 at 2:01

I have two conflicting needs. I'd like to serve files with Apache out of /home/steve/public_html/ which according to the documentation I've read, requires me to set a+rwx on /home/steve/.

If you're reading documentation that suggests you need to give everyone write permission to your home directory in order to serve read-only files from public_html, I would suggest you find the nearest fire and burn the documentation.

If your home directory is /home/steve, then in order for the web server to access your public_html directory, you need the following:

  • Anonymous execute access on your home directory (chmod a+x /home/steve). This allows the web server user to change directory to your public_html directory (but notably does not allow the web server user to see a list of files in your home directory).

  • Anonymous read and execute access to your public_html directory (chmod a+rx /home/steve/public_html).

To preserve the security of your .ssh directory, you need the following:

  • Only allow you (and nobody else) access to the directory: chmod 700 /home/steve/.ssh
  • Only allow you read/write access to critical files: chmod 600 /home/steve/.ssh/{authorized_keys,id_rsa}
  • 3
    Umm, a+... means "all..", not "anonymous...". Apache really only needs o+x (other execute) on your home directory. – staticsan Jan 20 '11 at 1:52
  • 1
    I think the difference between a+x and o+x is insignificant (quick, what does it mean if you have a+x and o+x but not g+x? The answer is "occasionally confusing behavior"). And I'm using "anonymous" as a gloss for "it doesn't matter who you are", and I'm going to stand by the phrasing. – larsks Jan 20 '11 at 1:54
  • +1, but please correct "Anonymous" to "All", as noted by staticsan. – Mikel Jan 20 '11 at 2:05
  • Please read my reply to staticsan. – larsks Jan 20 '11 at 2:09
  • "Anonymous" is simply wrong. If you are looking for a succinct way to say it, how about "Grant all users search access on your home directory (chmod a+x /home/steve)." – Mikel Jan 20 '11 at 3:26

You don't want a+rwx on /home/steve/: that would let everyone on the system do anything, even change, your home directory. It's correct for ssh to complain.

What you need is for Apache to be able to get to /home/steve/public_html; in order to do that, it needs to be able to access things inside /home/steve, which is the execute bit. So "chmod a+x ~" should be sufficient.

(If you're not familiar with it, "~" is shorthand for your home directory.)

You probably want to set the permissions on your home like this:

chmod u=rwx,go=x ~    # go+rx if you want others to be able to ``ls /home/steve``

And grant everyone the ability to {read files, read directories, and traverse directories} on everything in public_html recursively:

chmod -R a+rX ~/public_html

Happy web serving!


  • The question I asked wasn't the question I should have been asking (see my edit), but I wouldn't have figured that out without your help. +1 and thanks very much. – Steve V. Jan 20 '11 at 3:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.