7

We run what I feel is pretty standard Magento setup:

  • Deployed via rsync (it should also be deployable with git pull and scp/SFTP for simpler server configurations and to make developers' lives easier. Unfortunately, standard git only allows the setting of the exectuable flag and not the full Unix permission like group writability)
  • Running on Apache
  • Only running on machines that support setgid sticky bit

And we have pretty standard goals:

  • Deploy to a variety of customer-facing environments (dev, prod, CI, etc.) continually
  • Deploy easily to dev boxes
  • Have all operational (no need to support Magento Connect Manager or initial Magento installation) Magento features working fully and compatible with all major plugins

Within those goals, how can I set up file permissions to deploy (and set up dev and CI boxes), restricting permissions (as in principle of least privilege) as much as possible?

An outline of sources I've looked at already:

  • A Magento wiki page that recommends a 700/600 setup with all files owned by the Apache user but with core files (all files except /media and /var) set as 400.
  • A Magento StackExchange answer that mentions the 700/600 approach by concludes recommending a group-based 770/660 and 750/640 setup.
  • Another Magento wiki page that recommends 775/664 initially. It further includes some discussion of what permissions are required, but doesn't explicitly recommend a setting.
3

I'm working on a solution that feels right, but this is by no means authoritative. I'd love to get feedback or questions. Here it is:

The setup involves two users:

  • The deploy user in the deploy group: the user who writes to the server during deployments via rsync/SSH.
  • The apache user in the apache group: the user that Apache runs Magento as.

The general philosophy is to have the entire Magento directory chowned as deploy:apache and have the folders that require operational write access be group-writable. Step-by-step that should get you there:

  1. As root, create the virtual host's HTTP root, say, /var/www/html and chown it as deploy:apache, setting the setgid sticky bit:

    mkdir /var/www/html
    chown deploy:apache /var/www/html
    chmod g+s /var/www/html
    
  2. Deploy the Magento code via rsync/SSH using the deploy user. All files and folders should now be owned deploy:apache.

  3. As the deploy user, set /var and /media to group-writable.

    chmod g+w /var/www/html/var
    chmod g+w /var/www/html/media
    
  4. Remove umask(0) in the Magento code to use the OS's default 022 or set explicitly to umask(022).

  5. New temp files and folders should be owned by apache:apache and be 755 or 644.
  6. Your setup is good and shouldn't require additional actions during future deploys.

This approach is consistent with the Magento wiki article that recommends the group permissions and fleshes it out a bit. It also seems to be rather close to what this gist by svenvarkel I found does. I see its advantages over the approach to setting the files as owned by the Apache user in that that approach requires you to use the Apache user to deploy and depending on implementation, it either requires constant toggling of write permissions for deployments or leaves the core writable by the Apache user.

I'd love to receive comments or critiques on my proposed approach.

  • Hi Steven this matches fairly closely to what I tried to describe in the linked answer. The only thing I would question is why you need 755 or 644 in 5.) unless you know that you will need world read. – Kristof at Fooman Jun 24 '14 at 3:29
  • serverfault.com/questions/357108/… – B00MER Jun 24 '14 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.