We're setting up a CentOS 6.2/ Apache web server with higher security requirements than I'm used to.

I've set up a user group called "web" and I want to limit it's members to only being able to read, write and execute in /var/www/html/ and subdirectories.

Members of the "web" group should not be able to access any other part of the server (although individual user home directories are fine).

I thought this would be straight forward but have been going around in circles for the past half hour.

What bash commands do I need to use to achieve this?


Well, it seems to me that you'll need to jail the members of your group, otherwise they'll be able to see the content of your file system.

If you're going to allow ssh access to the users, you probably want to check this tutorial for chrooted ssh/sftp access: http://www.howtoforge.com/chrooted-ssh-sftp-tutorial-debian-lenny

Also, if this is the group apache will run under and you're going to host PHP applications, check out the php open_basedir directive in order to achieve such restriction: http://www.php.net/manual/en/ini.core.php#ini.open-basedir

Finally, if you're going to provide FTP access, I believe ftp servers such as vsftpd and proftpd will chroot its users by default, but the restriction will take place by their respective home directory.

Hope this helps you achieve your goal.

  • Thank you Luis. I'm heading home for the day but will crack into this tomorrow. – BaronGrivet Feb 15 '12 at 3:03
  • Hi Luis. I found this link about chrooting in CentOS which almost exactly matched my situation: meshfields.de/sftp-chroot-centos - might be worth adding to your answer. – BaronGrivet Feb 16 '12 at 1:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.