active web folders should not be deletable by customer

Replying to joximu:

we maybe should have the /var/www/virtual/customer folder read only for the customer itself - only some subfolders should be writeable...

This is a bad idea. E.g. some customers put there private backups, which should not be accessible through http. I have a php-script which uses this space for files, because it's a very secure space. Years ago when I had my first webspace with a ftp-access above www-root I was very happy because of the new possibilities.

ok, I can follow the idea.

Let's add a folder "private" which is out of webspace and can be filled with private data (plesk does it like this - and I like the idea).

I think it's possible to have both: some private folders (well, they have fix names) *and* no more write access in domain-home...

Next objection: there are the .htpasswd and .htgroup files. More experienced users prefer editing them directly than using the GUI (if it would work).
It's a pity, that Linux has not a flexible rights management like Windows. There it is possible to set separate rights for deleting.

The .htaccess files are ok in the htdocs folder - no need for write access further above.

Windows: you don't relly want that much of windows an your linux machine. The permissions are rather complex there and I think (I don't know) with linux acls this should also be possible - but we really don't need write access in the domain-folder.

I'm not speaking about .htaccess but about .htpasswd and .htgroup.

Web password files (...) should not be within the Web server's URI space -- that is, they should not be fetchable with a browser.
(from the Apache documentation)

ok, so there can be a folder for this files.

Seems to be not very popular to restrict the access...

It's just because of the many users who just delete everything they don't know.

what about chattr +u (makes a file/folder undeletable)

Replying to rats:

what about chattr +u (makes a file/folder undeletable)

I just saw that 'u' is not implemented in ext2/3

I see only one way: setting /var/www/virtual/domain to root:root with 755 (or 775) permissions. Then all alias and subdomain folders underneath: also root:root with 755 perm. The htdocs (also in subdomain and alias dirs) should not be world readable (-> vu2xxx:www-data with 750)... Of course we need at least one more directory for private data...

Let's see, what others do (Plesk 7.5x):

drwxr-xr-x  20 root root    4096 25. Okt 2005  .
drwxr-xr-x  47 root root    4096 20. Mär 11:40 ..
drwxr-x---   5 user psaserv 4096 26. Sep 2005  anon_ftp
drwxr-xr-x   2 root root    4096 26. Sep 2005  bin
drwxr-x---   2 user psaserv 4096 26. Sep 2005  cgi-bin
drwxr-x---   2 root psaserv 4096 20. Mär 11:40 conf
drwxr-xr-x   2 root psaserv 4096 26. Sep 2005  error_docs
drwxr-xr-x   2 root root    4096 26. Sep 2005  etc
drwxr-x---   9 user psaserv 4096 18. Mai 2007  httpdocs
drwxr-x---   4 user psaserv 4096 26. Sep 2005  httpsdocs
drwxr-xr-x   2 root root    4096 26. Sep 2005  lib
drwxr-x---   2 root psaserv 4096 26. Sep 2005  pd
drwx------   2 user root    4096 26. Sep 2005  private
dr-xr-x---   7 root psaserv 4096 26. Sep 2005  statistics
drwxr-xr-x   2 root psaserv 4096 26. Sep 2005  subdomains
drwxrwxrwt   2 root root    4096 26. Sep 2005  tmp
drwxr-xr-x   5 root root    4096 26. Sep 2005  usr
drwxr-xr-x   3 root root    4096 26. Sep 2005  var
drwxr-xr-x   3 root psacln  4096 25. Okt 2005  vault_scripts
drwxr-xr-x   2 root psaserv 4096 26. Sep 2005  web_users

It's an absolut bad job to correct the config when users have removed the subdirs of subdomains and aliasdomains manually by ftp without removing them in the gui. And you all know what all the users like most to do...

backup directory will be re-created. For sub and alias domains this Problem will be solved, if the mount point is free to choose.

Replying to rats:

For sub and alias domains this Problem will be solved, if the mount point is free to choose.

What is solved with a free choice? As a client I can choose /xyz for sub abc.domain.tld - but I still can remove the flder xyz without removing the sub in the config.

There is possible solution with proftpd-directves:

<Directory ~/>
PathDenyFilter "^/(backups|cgi-bin|htdocs|errors|logs|phptmp|statistics)/?$"
</Directory>

This directive forbids to delete, rename, create, chmod etc. the standard directories. The user will still have the possibility to add own directories and to edit .htpasswd and .htgroup.

A solution for subdomains has to be found. Perhaps ispCP could generate a specific ptoftpd-config for each subdomain.

Seems good idea ... should be create another ticket ?

Cube's fix will be in r1089. For subdomains -> moved to another release