A rule of thumb is: Be as restrictive as possible while allowing as much as necessary.
This suggestion is the most restrictive:
chown -R web-server-user-name .
find . -type f -exec chmod 400 {} \;
find . -type d -exec chmod 500 {} \;
find var/ -type f -exec chmod 600 {} \;
find media/ -type f -exec chmod 600 {} \;
find var/ -type d -exec chmod 700 {} \;
find media/ -type d -exec chmod 700 {} \;
chmod 700 includes
chmod 600 includes/config.php
- web server user is owner
- files can be read only by the owner, written only by root
- directories can be read and opened only by the owner, written only by root
- except var, media and includes - these directories can also be written by the owner
But this setup only works if
- the Magento cronjob is run by the web server user as well (this is not a problem, use
crontab -u web-server-user -e
as root to set up the crontab
- you can deploy the files with root permissions and then set ownership and permissions. This means, you have to set up SSH access for the root user which opens a different possible attack vector.
For that last reason, I'd consider the following setup more secure:
Full write access to owner, restrictive access to web server user
chown -R ssh-user-name:web-server-user-name .
find . -type f -exec chmod 640 {} \;
find . -type d -exec chmod 750 {} \;
find var/ -type f -exec chmod 660 {} \;
find media/ -type f -exec chmod 660 {} \;
find var/ -type d -exec chmod 770 {} \;
find media/ -type d -exec chmod 770 {} \;
chmod 770 includes
chmod 660 includes/config.php
Now the web-server-user-name
group has the same permissions as before, but additionally the ssh-user-name
user has write access. other users still have zero permissions, and it is not necessary to deploy the files as root user.
How to secure the app folder and the local.xml?
These are already secured against access from the web via .htaccess
. On a file system level, they get the same protection as any other file (see above).
How to secure the downloadable folder files?
Delete it. Seriously. Or read: Recommended method to protect /downloader?
And what are the privileges for run cron?
Run the cron as web server user (see above)