8

From the Magento wiki I found the file and folder permissions to be set to:

#for magento 1.5+
find . -type f -exec chmod 644 {} \;
find . -type d -exec chmod 755 {} \;
chmod o+w var var/.htaccess app/etc
chmod 550 mage
chmod -R o+w media

Question:

I'm trying to set the permissions using an ftp-client. The first two rows are pretty self explanatory, however

chmod o+w var var/.htaccess app/etc

Does this mean that I should apply write permissions to the "others" class, hence change the permissions to be 775 for the var folder and etc folder and the .htaccess file permissions to be 664?

Same thing applies to the last line of code.

Please note that I am aware that there is a similar thread, however the permissions suggest there does not compare to the ones suggested in the wiki, and I would like to follow the wiki.

2

The command chmod o+w will add writes for other. Since file permissions are user, group and other respectively, this will actually change the file permissions to be 646 and 757 respectively. In my opinion these are odd permissions for those particular files, but note that the wiki explicitly states if PHP is running as a module. Since the installer generates local.xml in the app/etc folder and possibly generates the .htaccess file (it's been that long since I've done a fresh install, I can't remember), the purpose behind this would therefore seemingly be for if the installer is running as a user that is neither the owner nor in the group for the files.

  • Just found out that PHP is not running as a module but with CGI/FastCGI as API. So the first block of code on the wiki page must be the one I'm looking for. All files to 644 and folders to 755 with the exeption of pear and mage folders. Am I right? How is your permissions set? – Attaque Feb 3 '14 at 1:33
  • That is basically how we set ours on most servers. There is actually a newer knowledge-base post, which uses much more restrictive permissions, but IMO it's overkill. – Peter O'Callaghan Feb 3 '14 at 8:55
  • I found that post as well, however if I apply those permissions, my site simply doesn't work. I think I'll keep the 644 and 755. Thank you for your help! – Attaque Feb 3 '14 at 14:08
2

In conclusion:

If you wan't to ensure that your files are secure, you have to first find out what server API your PHP is using. You can find this by creating a phpinfo-page on your webserver. If your API is CGI/FastCGI as mine the following permissions seems like the right way to go:

Folder permissions:   755
File permissions      644
Mage permissions:     550

As pointed out by Cags, there is a newer knowledge-base post suggesting folder permissions to be set to 700 and file permissions to be set to 600. I tried these permissions, however my site did not work afterwards.

  • 1
    The likelihood is, if your site wasn't working, that the owner of your files wasn't your webserver and hence Apache / nginx couldn't read the files. Since you are FTP'ing anyway which is assumably not done as the webserver user, this is probably impractical for you. – Peter O'Callaghan Feb 4 '14 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.