0

My document root path is the following:

/Users/myname/Sites/

I've created 2 virtual host, like so:

<VirtualHost *:80>
    ServerAdmin [email protected]
    DocumentRoot "/Users/myname/Sites/example1.com"
    ServerName example1.com
    ErrorLog "/usr/local/var/log/httpd/example1.com-error_log"
    CustomLog "/usr/local/var/log/httpd/example1.com-access_log" common
</VirtualHost>

<VirtualHost *:80>
    ServerAdmin [email protected]
    DocumentRoot "/Users/myname/Sites/example2.com"
    ServerName example2.com
    ErrorLog "/usr/local/var/log/httpd/example2.com-error_log"
    CustomLog "/usr/local/var/log/httpd/example2.com-access_log" common
</VirtualHost>

My directory scheme looks like so:

...
-- Sites
   |-- example1.com
   |-- example2.com

I want to create a directory (bckup_gallery) to keep original pictures for save keeping.

I've read that the best way to achieve that is to create the directory outside the document root so nobody has access to it.

Question 1: Is that the beat approach?

Question 2: If yes, outside the document root means outside the directory 'Sites'? or outside the virtual host directories? Like so

...
-- bckup_gallery
-- Sites
   |-- example1.com
   |-- example2.com

or

...
-- Sites
   |-- example1.com
   |-- example2.com
   |-- bckup_gallery

2 Answers 2

1

There is no single best answer to this question as it depends on your usage case. One common solution which I would argue is particularly useful would be to change the structure like

  DocumentRoot /Users/Myname/Sites/example1.com/public_html   

You can then have other things associated with that site like logging to

  ErrorLog /Users/Myname/Sites/example1.com/logs/error.log
  Customlog /Users/Myname/Sites/example1.com/logs/access.log common
  

And you can also create /Users/Myname/Sites/example1.com/Backups etc for placing backups.

It may also be worthwhile not using /Users/Myname and use instead something like /data/Sites - and then having each site with a different user - this can provide more granular control.

0

for save [sic] keeping

Storing a backup on the same device as your primary data is far from safe and only offers a very small advantage over no backup at all. On a separate device is slightly better. On a separate device attached to a different host improves. Ideally it would be on an immutable backup system remote from the primary data.

But assuming you are constrained to provision the backup on the same host as the primary data, then achieving the best possible level of security depends a lot on the OS. Outside the document root is preferable to inside, but the important thing is denying access to modifying the content. Your first line of defence is permissions. Set up your users, groups, paths and backup job so that the (exposed) webserver has no access to the directory where the backups exist. Most modern OS will provide some mandatory access control (filesystem namespaces configured via systemd, SELinux and AppArmor are obvious candidates on Linux) however that you have put your document root inside your home folder suggest that these are either not present or you've disabled them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.