Gfilui

I am currently learning PHP, and I am new to Ubuntu. When I was practicing PHP on Windows, I used XAMPP and create files in htdocs. Now that I am using a Linux machine, I have installed the LAMP package, but I did not initially have access to create files in the var/www/html folder.

I used sudo nautilus to give myself access to create and delete files for testing purposes. Is this OK? Does it open me up to any risk? This is all local work on a local machine. Another difference from XAMPP is the ability to turn MySQL and Apache on and off/open and close the ports. Do I need to worry about this now that I am using LAMP? I just want to be secure; I'm new to this.

Thank you in advance.

I think there are a couple of things you should check out first which will serve you as an introduction.

What you have in /var/www/html is what is called a "Directory" for a Virtual Host in Apache.

What does this mean? It means this directory has been created and defined by default for you. It also means you can create a directory anywhere in your filesystem and assign it as the directory for this Virtual Host.

Where does this Virtual Host definition live? In LAMP, you have this called Virtual Hosts. This means you can host many websites and resources in your same server/machine. These virtual hosts are usually defined under /etc/apache2/sites-available/

If you check that folder you'll find this file: 000-default.conf

There's where /var/www/html is defined. You are actually free to modify this, and place it, let's say somewhere beneath your /home/user directory.

I recommend you as a next step for your introduction to LAMP (in Linux) to take a look at Virtual Hosts. How to create them, and how to make them work.

You will find some Apache commands like a2ensite a2dissite to make the new virtual host sites available or disable them and many other interesting things in the way.

Security Issues:

About your security concerns if you want to be sure no-one has access to your /var/www/html you should have an active firewall. The firewall would block any non-requested communication to port 80, which is the port wide open for /var/www/html

You should notice that the Virtual Host defined by default has the widest possible access. It's defined like this <VirtualHost *:80>. This definition makes anyone guesssing your IP in your LAN to have access to see your /var/www/html. That's actually the purpose of a server, to serve things to the outside world. So that's basically ok.

But if you want to protect that, you have to either created a new VirtualHost, aka a named Virtual host, and probably use a Firewall to protect your ports (port 80, and whatever other port you wanna use)