Recommended File System Ownership and Privileges

Question

I need help for recommended privileges on my dedicated server.

My dedicated server is installed with Debian and on the official documentation of Magento it's recommended to follow the following instructions :

Dedicated Magento server only. As a user with root privileges :

chown -R web-server-user-name .

Enter the following commands to set permissions:

find . -type f -exec chmod 400 {} \;
find . -type d -exec chmod 500 {} \; 
find var/ -type f -exec chmod 600 {} \; 
find media/ -type f -exec chmod 600 {} \;
find var/ -type d -exec chmod 700 {} \; 
find media/ -type d -exec chmod 700 {} \;
chmod 700 includes
chmod 600 includes/config.php

On stackexchange posts, the main users use the following privileges:

find . -type f -exec chmod 644 {} \;
find . -type d -exec chmod 755 {} \;
find var/ -type d -exec chmod 777 {} \;

What is the most secure configuration?

How to secure the app folder and the local.xml?

How to secure the downloadable folder files?

And what are the privileges for run cron?

Answer 1

A rule of thumb is: Be as restrictive as possible while allowing as much as necessary.

This suggestion is the most restrictive:

chown -R web-server-user-name .

find . -type f -exec chmod 400 {} \;
find . -type d -exec chmod 500 {} \; 
find var/ -type f -exec chmod 600 {} \; 
find media/ -type f -exec chmod 600 {} \;
find var/ -type d -exec chmod 700 {} \; 
find media/ -type d -exec chmod 700 {} \;
chmod 700 includes
chmod 600 includes/config.php

• web server user is owner
• files can be read only by the owner, written only by root
• directories can be read and opened only by the owner, written only by root
• except var, media and includes - these directories can also be written by the owner

But this setup only works if

• the Magento cronjob is run by the web server user as well (this is not a problem, use crontab -u web-server-user -e as root to set up the crontab
• you can deploy the files with root permissions and then set ownership and permissions. This means, you have to set up SSH access for the root user which opens a different possible attack vector.

For that last reason, I'd consider the following setup more secure:

Full write access to owner, restrictive access to web server user

chown -R ssh-user-name:web-server-user-name .

find . -type f -exec chmod 640 {} \;
find . -type d -exec chmod 750 {} \; 
find var/ -type f -exec chmod 660 {} \; 
find media/ -type f -exec chmod 660 {} \;
find var/ -type d -exec chmod 770 {} \; 
find media/ -type d -exec chmod 770 {} \;
chmod 770 includes
chmod 660 includes/config.php

Now the web-server-user-name group has the same permissions as before, but additionally the ssh-user-name user has write access. other users still have zero permissions, and it is not necessary to deploy the files as root user.

How to secure the app folder and the local.xml?

These are already secured against access from the web via .htaccess. On a file system level, they get the same protection as any other file (see above).

How to secure the downloadable folder files?

Delete it. Seriously. Or read: Recommended method to protect /downloader?

And what are the privileges for run cron?

Run the cron as web server user (see above)