n00b needs a little guidance

[tylerknowsthis]

Ive only been using linux for about a week and the main reason i decided to try and set up a LAMP server in the first place is theres a mission on Hack this Site (realistic 11) where u need a free PHP host, well i decided i might as well do it myself with LAMP and learn a whole lot more at the same time, So heres my questions....when setting up Virtual Hosts it wants a root for "xxx.example.com" is that in /var/www/ (where i have a index.html) or /home/$USER/public_html? when i make a test.php or test.html in the public_html and go 127.0.0.1/~USER i can see them and everything works,but it seems strange to have something potentially viewed by other people located in my /home/$USER folder? I made it thru the LAMP install okay but i need a good article or some advice on making sure everything is where it should be and configured right, sorry for the short-story length question

[atreyu]

it seems that you have the mod_userdir Apache module enabled.

mod_userdir - Apache HTTP Server

yes, you are right in thinking that - for it to work properly, your home directory needs to be world readable. per the apache config file:

#
# UserDir: The name of the directory that is appended onto a user's home
# directory if a ~user request is received.
#
# The path to the end user account 'public_html' directory must be
# accessible to the webserver userid.  This usually means that ~userid
# must have permissions of 711, ~userid/public_html must have permissions
# of 755, and documents contained therein must be world-readable.
# Otherwise, the client will only receive a "403 Forbidden" message.
#
# See also: http://httpd.apache.org/docs/misc/FAQ.html#forbidden
#

so browsing to 127.0.0.1/~user does not touch your Virtual Hosts or anything in /var/www/.

what i would probably do to protect the pages via a browser is to create Apache users and groups files (using the htpasswd utility), then protect the Virtual Host directories using them by specifying the authorized users/groups in .htaccess files.

also, from a filesystem perspective, you can control read/write access to the files using ACLs (setfacl/getfacl). Or you could even get away with it using standard Unix permissions on the filesystems.