We run what I feel is pretty standard Magento setup:
- Deployed via rsync (it should also be deployable with
scp/SFTP for simpler server configurations and to make developers' lives easier. Unfortunately, standard git only allows the setting of the exectuable flag and not the full Unix permission like group writability)
- Running on Apache
- Only running on machines that support
And we have pretty standard goals:
- Deploy to a variety of customer-facing environments (dev, prod, CI, etc.) continually
- Deploy easily to dev boxes
- Have all operational (no need to support Magento Connect Manager or initial Magento installation) Magento features working fully and compatible with all major plugins
Within those goals, how can I set up file permissions to deploy (and set up dev and CI boxes), restricting permissions (as in principle of least privilege) as much as possible?
An outline of sources I've looked at already:
- A Magento wiki page that recommends a 700/600 setup with all files owned by the Apache user but with core files (all files except
/var) set as 400.
- A Magento StackExchange answer that mentions the 700/600 approach by concludes recommending a group-based 770/660 and 750/640 setup.
- Another Magento wiki page that recommends 775/664 initially. It further includes some discussion of what permissions are required, but doesn't explicitly recommend a setting.