21

I understand that magento says to have /var and /media at 700 for folders and 600 for files but when I do this, it breaks certain parts of my site. I am curious to see what permissions most people use for these folders.

Improve this question
2

6 Answers 6

Reset to default
19

I haven't see many mentions of using 700 and 600 but it is generally good advice. Unfortunately every server set up is different and needs to be weighed up against convenience (user access to update/edit files).

The underlying approach should be to only give away as little as possible and lock it down as much as you can (700/600 is good for this). In that respect the "official" advice on the wiki wants to apply to as many circumstances as possible and suggests read permissions for everyone (which means any compromised other service on the server will then for example be able to read app/etc/local.xml with your db configuration).

In your case it currently sounds like the files are owned by a different user than what your webserver/php process runs under. Changing the ownership of the files to the webserver should solve your original issue.

Please note that using 700 / 600 and assigning the files to the webserver means your normal user would not be able to edit the files.

The below I feel is a good compromise for convenience vs lock down. All files are owned by user:webservergroup

var and media 770 / 660
The server and your user is allowed to read and write from the var and media folders (session/cache/images).

the rest 750 / 640
Your user is able to edit/update the code.
The webserver is able to read the files for execution/display.

Improve this answer
2
  • 2
    Nearly two years later and I now agree with this more than my own answer.
    – philwinkle
    Commented Apr 15, 2015 at 18:26
  • I realized I never provided a response to this and the issue I was having was that files were not owned by the webserver. I also was asking to clear up the permissions to get more of a standard practice as I was reading different things.
    – Egregory
    Commented May 28, 2015 at 20:14
18

In general all files should be 644 and all folders should be 755 and should be owned by the user your web server runs under. The mage executable should be given 550 permissions to allow execution.

This shell script should patch things up if run from your Mage root:

#!/bin/sh
find . -type f -exec chmod 644 {} \;
find . -type d -exec chmod 755 {} \;
chmod 550 mage

Source: http://www.magentocommerce.com/wiki/groups/227/resetting_file_permissions

Improve this answer
5

While Phil's solution is good I use a little bit different approach. In addition to making the "php/webserver user" owner of files I create additional group. Usually it's called dev. And I add "php user" and myself and other developers to that group dev. Then I do chgrp so that all files in Magento project subtree have group dev. I add +s bit to folders that ensures the newly created subfolders get the same permissions.

I've created a public gist with my fix_permissions.sh script. Feel free to use it:) It helps you to keep your whole Magento project subtree with good permissions.

https://gist.github.com/svenvarkel/8062778#file-fix_permissions-sh

The original question - var and media must have such permissions that "php user" can read and write to these folders. It must be able to write cache, session files etc under var and it must be able to write product image cache and images under media. So do as Phil advises: chown or chgrp these to "php user" and give rw permissions to "php user".

I think it's more correct to refer to "php user" in context of FPM (CGI). Webserver user can be different of that one that's running PHP.

Improve this answer
1
  • 3
    You are absolutely correct with regard to the terminology regarding webserver user vs. php user. Great point. Though, one has to wonder if a person asking how to change permissions would know whether they were running PHP FPM or not...
    – philwinkle
    Commented Dec 20, 2013 at 23:30
1

/var - magento use to write cache, session etc data.

/media - magento use to updload product image, category image (any type of image).

So these two folders you should have to use read+write permission. Other file you should to use read+execution permission.

Improve this answer
1

File permission is 644. Run below code in the root directory using ssh. find . 

-type f -exec chmod 644 {} \;

Folder permission is 755. Run below code in the root directory using ssh. find . 

-type d -exec chmod 755 {} \;

Var folder permission is 777. Run below code in the root directory using ssh.

chmod -R 777 var

Static folder permission is 777. Run below code in the root directory using ssh.

chmod -R 777 pub/static

Media folder permission is 777. Run below code in the root directory using ssh.

chmod -R 777 pub/media
Improve this answer
1
  • 2
    Above is not what OP asked, this is for Magento 2.x not for Magento 1.7
    – Frank Groot
    Commented Feb 22, 2017 at 10:49
0

From here: http://devdocs.magento.com/guides/m1x/install/installer-privileges_after.html

find . -type f -exec chmod 400 {} \;
find . -type d -exec chmod 500 {} \; 
find var/ -type f -exec chmod 600 {} \; 
find media/ -type f -exec chmod 600 {} \;
find var/ -type d -exec chmod 700 {} \; 
find media/ -type d -exec chmod 700 {} \;
chmod 700 includes
chmod 600 includes/config.php
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.