I migrated my hosting setup from DirectAdmin to Virtualmin a few months ago, and I’ve encountered an issue regarding the private_html directory.
I’ve noticed that only the virtual servers that were migrated from DirectAdmin have a private_html directory, and these directories contain outdated duplicates of files that existed at the time of migration. In contrast, the files in the public_html directories are updated and current.
Given this situation, I would like to know if it is safe to remove the private_html directories from these virtual servers. If so, should I create a symlink to public_html, or is that unnecessary?
I don’t see anyone answering, so I’ll write from myself. it should be safe to remove the private_html directories as long as you no longer use private SSL content for these virtual servers. If you want to avoid confusion, then it is worth creating a symbolic link to public_html, which will help simplify such a procedure.
I have no idea what private_html would be for, so I don’t know.
Migration would keep the whole home directory, though, so it’s not surprising that it came over. Might be worth figuring out what it was for, to make sure there aren’t security implications to moving files around.
My guess is maybe it’s for stuff that would be outside of the document root, like config files or whatever, that might get used by applications, but shouldn’t be visible to the world (there are many ways to do that, and I’m just guessing). But, maybe it’s a default location for password protected files (Virtualmin puts those in public_html and just adds a section for them in the config file with the auth details).
In short, make sure you’re not accidentally exposing something that should be private. (And, if we’re copying stuff out of that directory into public_html automatically, I’d want to make sure we’re treating it appropriately. I mean, if it is for actually private data.)
I believe that in DirectAdmin, the private_html directory is used to host a version of the website accessible only via HTTPS, while public_html serves both HTTP and HTTPS requests.
I no longer have access to the old DirectAdmin VPS, so I cannot investigate further, but I’ve never used a different website version in private_html. If I remember correctly, there was a symlink between private_html and public_html.
I only recently noticed this issue because some of the sites were using almost double the space. Upon investigation, I found that the private_html directory contains an outdated copy of the website, which is no longer in sync with the updated files in public_html.
But, I guess in the olden days (like 20+ years ago), it was common to split off the security sensitive stuff into its own directory so it could be served over HTTPS from the primary domain of the hosting provider, since SNI didn’t exist yet, so every HTTPS VirtualHost needed its own IP. But, that’s so long ago, seems weird to hang on to a split model today.