I have a shared hosting account with justhost, what i need is to give an FTP access to a site operator, to his website.
The website is a sub-folder under the www folder. I know how to limit his FTP access to the folder only, but i need a way to isolate the files that he will upload as well, to prevent a script from accessing the parent folders ETC.

is there any way to do it?

  • 1
    Why don't you get that client their own shared hosting account? Sure, it'll cost a couple bucks a month, but that's well worth it to protect your stuff. – ceejayoz Nov 11 '13 at 14:41
  • You are correct, but it's not a client, it's an operator of a single site, on a shared account - owned by the client.. – yossi Nov 11 '13 at 15:10

As often, it depends...

You can't really prevent the site operator from uploading badly written scripts or even malicious scripts unless you create something like a staging area and have somebody do a code revision before publication on the webserver itself.

Since often that's not feasable, you can configure your webserver to be very restrictive with the content in that website, effectively you'll only allow static content:

  • disbale .htaccess overrides
  • disable script handlers i.e. php scripts won't run and the code is displayed instead of executed.
  • etc.
  • thanks, but the thing is that they operate a wordpress site and can change the theme. meaning, php files... – yossi Nov 11 '13 at 15:11
  • I figured as much. Not running PHP as an apache module but as as a fast_cgi executable and suexec under a seperate UID can work pretty secure as well. – HBruijn Nov 11 '13 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.