6

I need help for recommended privileges on my dedicated server.

My dedicated server is installed with Debian and on the official documentation of Magento it's recommended to follow the following instructions :

Dedicated Magento server only. As a user with root privileges :

chown -R web-server-user-name .

Enter the following commands to set permissions:

find . -type f -exec chmod 400 {} \;
find . -type d -exec chmod 500 {} \; 
find var/ -type f -exec chmod 600 {} \; 
find media/ -type f -exec chmod 600 {} \;
find var/ -type d -exec chmod 700 {} \; 
find media/ -type d -exec chmod 700 {} \;
chmod 700 includes
chmod 600 includes/config.php

On stackexchange posts, the main users use the following privileges:

find . -type f -exec chmod 644 {} \;
find . -type d -exec chmod 755 {} \;
find var/ -type d -exec chmod 777 {} \;

What is the most secure configuration?

How to secure the app folder and the local.xml?

How to secure the downloadable folder files?

And what are the privileges for run cron?

Improve this question
7

A rule of thumb is: Be as restrictive as possible while allowing as much as necessary.

This suggestion is the most restrictive:

chown -R web-server-user-name .

find . -type f -exec chmod 400 {} \;
find . -type d -exec chmod 500 {} \; 
find var/ -type f -exec chmod 600 {} \; 
find media/ -type f -exec chmod 600 {} \;
find var/ -type d -exec chmod 700 {} \; 
find media/ -type d -exec chmod 700 {} \;
chmod 700 includes
chmod 600 includes/config.php
  • web server user is owner
  • files can be read only by the owner, written only by root
  • directories can be read and opened only by the owner, written only by root
  • except var, media and includes - these directories can also be written by the owner

But this setup only works if

  • the Magento cronjob is run by the web server user as well (this is not a problem, use crontab -u web-server-user -e as root to set up the crontab
  • you can deploy the files with root permissions and then set ownership and permissions. This means, you have to set up SSH access for the root user which opens a different possible attack vector.

For that last reason, I'd consider the following setup more secure:

Full write access to owner, restrictive access to web server user

chown -R ssh-user-name:web-server-user-name .

find . -type f -exec chmod 640 {} \;
find . -type d -exec chmod 750 {} \; 
find var/ -type f -exec chmod 660 {} \; 
find media/ -type f -exec chmod 660 {} \;
find var/ -type d -exec chmod 770 {} \; 
find media/ -type d -exec chmod 770 {} \;
chmod 770 includes
chmod 660 includes/config.php

Now the web-server-user-name group has the same permissions as before, but additionally the ssh-user-name user has write access. other users still have zero permissions, and it is not necessary to deploy the files as root user.

How to secure the app folder and the local.xml?

These are already secured against access from the web via .htaccess. On a file system level, they get the same protection as any other file (see above).

How to secure the downloadable folder files?

Delete it. Seriously. Or read: Recommended method to protect /downloader?

And what are the privileges for run cron?

Run the cron as web server user (see above)

Improve this answer
5
  • Perfect and detailed answer, thanks for your help !! – phpschool Dec 22 '16 at 22:47
  • It's not the downloader folder to the root. I have a downloadable products in media/downloadable. What is the most secure configuration for protect my downloadable products? – phpschool Dec 22 '16 at 22:52
  • Oh, I misread that, sorry. For those, the same applies as to the rest of media: the web server user has to be able to write them (except if you never change them anymore in the admin panel, once set up, then you could revoke the write permissions) – Fabian Schmengler Dec 22 '16 at 22:56
  • I just did a test on my dedicated server and all works perfectly. Just one last point, the folder skin should allow to read the images but how to block access to the skin root directory. What is the best solution? .htaccess? – phpschool Dec 27 '16 at 17:25
  • If I understand you correctly, you want to prevent a directory listing to be shown if example.com/skin is opened in the browser. This should already be handled by the line DirectoryIndex index.php in the default htaccess file of Magento. If not, add Options -Indexes. More info: stackoverflow.com/questions/2530372/… (this has nothing to do with file permissions anymore) – Fabian Schmengler Dec 27 '16 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.