Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hi guys I have set up a small shared hosting set up for friends.

I have set the file chmod permissions to

chmod 711 /home 
chmod 711 /home/testuser 
chmod 755 /home/testuser/public_html 
chmod o+r /home/testuser/public_html/index.htm 

How do I stop the user connected to their own ftp from deleting the html.htm file and also with the public dir set to chmod 755 I find they can't do anything in the directory such as upload/delete?

Additional info: I have run

setsebool -P httpd_enable_homedirs true
chcon -R -t httpd_sys_content_t /home/testuser/public_html

but no effect?

share|improve this question
make somebody else own it but I suppose if they have write access then they could delete it. so you could make a script so if the file doesn't exist it recreates it. – barlop Feb 2 '13 at 15:57
If the permision on the file is 755 you can't prevent the user from removing the file. – Ramhound Feb 5 '13 at 20:00
up vote 1 down vote accepted

Traditional unix permissions mean that if a user can create files in a directory, they can also delete files in it-- even if the file itself is read-protected and doesn't belong to them. So you can't protect html.htm (whatever that is) if it's in a directory they should have write/execute access to. Perhaps ACLs can help, as @vonbrand suggests (but I'm not familiar with them, and @vonbrand isn't promising it'll work).

  1. There's no need to make the directory global-writable or global-executable, but you do need to ensure that your webserver daemon has read access to the files. (It probably runs as group www-data--but check). So, ensure that the directory owner matches the uid that the user gets on connecting, and you can keep it to mode 750.

  2. If you need to let multiple uids write to the same directory, you'll need to enable group-write access (g+w). In that case I'd use a group other than www-data, and grant apache read-only access as "other". In other words, mode 775.

  3. Also keep an eye on your umask, which controls the permissions of new files created by the users. If you have individual accounts, use umask 022 to match. If you have a shared group directory, use umask 002 to allow users to edit each other's files. (Since they'll be able to delete and replace files, there's no point in protecting them).

share|improve this answer

Who is the user connecting as? The way you have it set up, only the owner can write to public_html.

Also, you currently have it set up so that users can enter /home/testuser but not read it. You might want something like :

chmod 711 /home 
chmod 755 /home/testuser    
chmod 777 /home/testuser/public_html 
chmod 644 /home/testuser/public_html/index.htm  
chown root /home/testuser/public_html/index.htm  
share|improve this answer

Look for ACLs, that might solve your problem. Relevant manual entries are acl(5), setfacl(1), and getfacl(1). Support depends on the filesystem, though.

share|improve this answer
Could you expand your answer with details instead of just links? – Canadian Luke Feb 2 '13 at 16:25
@Luke - What links would that be :-) – Ramhound Feb 5 '13 at 19:59
@Ramhound I saw no style sheet on my cell when I posted that – Canadian Luke Feb 5 '13 at 20:16
@Luke - I almost positive there was links. – Ramhound Feb 6 '13 at 3:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .