How to host files from public_html while still preserving security of ~/.ssh/

Question

I have two conflicting needs. I'd like to serve files with Apache out of /home/steve/public_html/ which according to the documentation I've read, requires me to set a+rwx on /home/steve/.

I'd also like to use SSH to connect to this account, but if I set my home directory to world-readable, SSH complains (rightly so), and doesn't let me connect.

Is there a way that I can serve files from public_html while still allowing SSH access?

EDIT: After reading the answers and doing a bit of critical thinking, I realized I was asking the wrong question. What I should have been asking was:

• how do I safely develop and test php code in my home directory, when this code requires Apache to write to an SQLite database. The answer, obviously, being: put the database under /var/www/ and everything else in public_html.

Answer 1

I have two conflicting needs. I'd like to serve files with Apache out of /home/steve/public_html/ which according to the documentation I've read, requires me to set a+rwx on /home/steve/.

If you're reading documentation that suggests you need to give everyone write permission to your home directory in order to serve read-only files from public_html, I would suggest you find the nearest fire and burn the documentation.

If your home directory is /home/steve, then in order for the web server to access your public_html directory, you need the following:

• Anonymous execute access on your home directory (chmod a+x /home/steve). This allows the web server user to change directory to your public_html directory (but notably does not allow the web server user to see a list of files in your home directory).

• Anonymous read and execute access to your public_html directory (chmod a+rx /home/steve/public_html).

To preserve the security of your .ssh directory, you need the following:

• Only allow you (and nobody else) access to the directory: chmod 700 /home/steve/.ssh
• Only allow you read/write access to critical files: chmod 600 /home/steve/.ssh/{authorized_keys,id_rsa}

Answer 2

You don't want a+rwx on /home/steve/: that would let everyone on the system do anything, even change, your home directory. It's correct for ssh to complain.

What you need is for Apache to be able to get to /home/steve/public_html; in order to do that, it needs to be able to access things inside /home/steve, which is the execute bit. So "chmod a+x ~" should be sufficient.

(If you're not familiar with it, "~" is shorthand for your home directory.)

You probably want to set the permissions on your home like this:

chmod u=rwx,go=x ~    # go+rx if you want others to be able to ``ls /home/steve``

And grant everyone the ability to {read files, read directories, and traverse directories} on everything in public_html recursively:

chmod -R a+rX ~/public_html

Happy web serving!

~jon.