How to set proper permissions for Magento on server?

Question

I'm getting lot of issues with permissions.

In magento admin panel:

Your web server is configured incorrectly. As a result, configuration files with sensitive information are accessible from the outside. Please contact your hosting provider.

When I upload images from cms:

The directory is not writable by server.

If anyone access this url: http://example.com/app/etc/modules/

they can see easily configuration settings.

Using FTP account: I'm not able to override any file and some times I'm not able copy any local folder to server through FTP.

My application place is /var/www/html.

with senior developer advice I execute following commands:

find <foldername> -type d -exec chmod 755 {} \; 
find <foldername> -type f -exec chmod 664 {} \;

and below are present permissions for each folder.

drwxr-xr-x 12 root     root     4096 Jun 10 13:06 var
drwxr-xr-x  3 root     root     4096 Jun 10 13:06 www
drwxr-xr-x 15 www-data www-data 4096 Jun 18 07:29 html

root@web-server-magento:/var/www/html# ls -l

total 14644
-rw-rw-r--  1 www-data www-data     2834 Nov 26  2013 api.php
drwxr-xr-x  6 www-data www-data     4096 Jun 17 11:16 app
-rw-rw-r--  1 www-data www-data     2831 Nov 26  2013 cron.php
-rw-rw-r--  1 www-data www-data      717 Nov 26  2013 cron.sh
-rw-rw-r--  1 www-data www-data  2454234 Oct 26  2011 data.sql
drwxr-xr-x  8 www-data www-data     4096 Jun 11 07:21 downloader
drwxr-xr-x  3 www-data www-data     4096 Nov 26  2013 errors
-rw-rw-r--  1 www-data www-data     1150 Nov 26  2013 favicon.ico
-rw-rw-r--  1 www-data www-data     5979 Nov 26  2013 get.php
drwxr-xr-x  2 www-data www-data     4096 Nov 26  2013 includes
-rw-rw-r--  1 www-data www-data    11510 Jun 10 13:06 index1.html
-rw-rw-r--  1 www-data www-data     2642 Nov 26  2013 index.php
-rw-rw-r--  1 www-data www-data     2366 Nov 26  2013 index.php.sample
-rw-rw-r--  1 www-data www-data     6441 Nov 26  2013 install.php
drwxr-xr-x 12 www-data www-data     4096 Jun 18 06:28 js
drwxr-xr-x 13 www-data www-data     4096 Nov 26  2013 lib
-rw-rw-r--  1 www-data www-data    10421 Nov 26  2013 LICENSE_AFL.txt
-rw-rw-r--  1 www-data www-data    10679 Nov 26  2013 LICENSE.html
-rw-rw-r--  1 www-data www-data    10410 Nov 26  2013 LICENSE.txt
-rw-rw-r--  1 www-data www-data    10327 Jun 11 14:48 logo.png
-rw-rw-r--  1 www-data www-data     1319 Nov 26  2013 mage
drwxr-xr-x 13 www-data www-data     4096 Jun 18 07:29 media
-rw-rw-r--  1 www-data www-data      886 Nov 26  2013 php.ini.sample
drwxr-xr-x  2 www-data www-data     4096 Nov 26  2013 pkginfo
-rw-rw-r--  1 www-data www-data   585086 Nov 26  2013 RELEASE_NOTES.txt
drwxr-xr-x  2 www-data www-data     4096 Nov 26  2013 shell
drwxr-xr-x  5 www-data www-data     4096 Nov 26  2013 skin
drwxr-xr-x  9 www-data www-data     4096 Jun 18 06:57 var

Please comment if any extra information needed.

Thanks for your response.I tried magento cleanup.still same problem.I think problem with apache configuration or htacces file. — sivakumar, Jun 19, 2014 at 9:43

7ochem · Accepted Answer · 2016-05-10 08:35:52Z

14

Please check and verify below steps:

Check if your server is compatible with Magento. Download file from this link Magento Server Compatibility check and follow the instructions given.
Check for the .htaccess in each folder and in root too. Magento has .htaccess in almost all folders. Verify it for media folder in case the problem is with image
Execute the following server commands going into your project folder:
```
find ./ -type f | xargs chmod 644
find ./ -type d | xargs chmod 755
```
This gives 644 permission to files and 755 to folders.
Next give 777 permission to var and media folder if the problem still persists, use the following commands for it:
```
chmod -Rf 777 var
chmod -Rf 777 media
```
Also check the html folder permission of your server. It should be 755.

Hope this should resolve your problem.

edited May 10, 2016 at 8:35

7ochem

7,50214 gold badges51 silver badges79 bronze badges

answered Jun 19, 2014 at 7:58

Dexter

3,6134 gold badges28 silver badges60 bronze badges

A note about .htaccess files. These are only required if Apache web server is used. .htaccess files in each folders are bad for Apache performance because it has to check these for each folder. For more information see httpd.apache.org/docs/2.2/howto/htaccess.html In the beginning there's a warning: You should avoid using .htaccess files completely if you have access to httpd main server config file.
– Sven
Jun 19, 2014 at 8:57
Thanks for that... but i have noticed its present in almost every main folder of Magento...
– Dexter
Jun 19, 2014 at 9:46
Only required for apache => which means you need to take appropriate steps to off-limit these folders by whatever means the other flavors of web server use. The .htaccess files all are there to protect the contents or even more importantly, prevent script execution out of folders that have global RWX. Most people using Apache don't have access to the http server config so it's kind of a red herring to mention removing something needed to secure the file access without properly acknowledging why they're there. Also important is giving alternatives to properly replacing that security model.
– Fiasco Labs
Jul 20, 2014 at 5:16
getting Operation not permitted on all files when running find ./ -type f | xargs chmod 644 . Tried with sudo as well.
– Amit Patel
Dec 19, 2017 at 9:56
It seems to be a problem with your server permission
– Dexter
Jan 24, 2018 at 8:21

Add a comment |

Anna Völkl · Accepted Answer · 2014-07-20 16:12:03Z

Please check if your FTP and SSH user are in the www-data group.

Your files and folders belong to the www-data user and group:

-rw-rw-r--  1 www-data www-data     2642 Nov 26  2013 index.php
drwxr-xr-x 13 www-data www-data     4096 Jun 18 07:29 media

Your FTP error message (I'm not able to override any file) makes me believe your FTP user is not in the www-data group.

From the command line, run and check which groups your ftp and ssh user belong to:

$ groups [username]

If there's no www-data listed, adjust the settings with your server-admin.

Spencer Williams · Accepted Answer · 2015-10-20 19:16:58Z

At your discretion, you should either assign all web server files to the www-data user and group, or just the group. It is often convenient, and still secure, to make the owner of the files yourself so you can more easily edit them, especially if you wanted to manage such files via a repo.

If you decided to make all web server files owned and group-owned by www-data, I recommend the following permissions:

find /var/www/html -type d -exec chmod 755 {} \; 
find /var/www/html -type f -exec chmod 644 {} \;

find /var/www/html/var -type d -exec chmod 755 {} \; 
find /var/www/html/var -type f -exec chmod 644 {} \;

find /var/www/html/media -type d -exec chmod 755 {} \; 
find /var/www/html/media -type f -exec chmod 644 {} \;

If you want to have the files owned by another user that should be able to edit everything, you can do 775 and 664 instead. Whatever you do, never set anything to 777. You rarely, if ever, have any reason to do that. In this case, you know who should and shouldn't access the files, and with what permission level, so you can explicitly set what you need, rather than let any and everyone read/write/execute everything.

Finally, and this is the most important step, you will want to make the /app directory and contents inaccessible for serving by allowing the .htaccess files to regulate access. Simply add something like the following, if using httpd:

<Directory /var/www/html>
  AllowOverride FileInfo Indexes Options Limit
</Directory>

I also just found their ownership settings guide.
– Spencer Williams
Oct 9, 2015 at 21:33 — Spencer Williams, Oct 9, 2015 at 21:33

Shails · Accepted Answer · 2014-06-19 07:50:11Z

I have used the magento cleanup code for resetting the permissions, it has worked for me. Can you please try using the cleanup code as below :-

<?php

## Function to set file permissions to 0644 and folder permissions to 0755

function AllDirChmod( $dir = "./", $dirModes = 0755, $fileModes = 0644 ){
   $d = new RecursiveDirectoryIterator( $dir );
   foreach( new RecursiveIteratorIterator( $d, 1 ) as $path ){
      if( $path->isDir() ) chmod( $path, $dirModes );
      else if( is_file( $path ) ) chmod( $path, $fileModes );
  }
}

## Function to clean out the contents of specified directory

function cleandir($dir) {

    if ($handle = opendir($dir)) {
        while (false !== ($file = readdir($handle))) {
            if ($file != '.' && $file != '..' && is_file($dir.'/'.$file)) {
                if (unlink($dir.'/'.$file)) { }
                else { echo $dir . '/' . $file . ' (file) NOT deleted!<br />'; }
            }
            else if ($file != '.' && $file != '..' && is_dir($dir.'/'.$file)) {
                cleandir($dir.'/'.$file);
                if (rmdir($dir.'/'.$file)) { }
                else { echo $dir . '/' . $file . ' (directory) NOT deleted!<br />'; }
            }
        }
        closedir($handle);
    }

}

function isDirEmpty($dir){
     return (($files = @scandir($dir)) && count($files) <= 2);
}

echo "----------------------- CLEANUP START -------------------------<br/>";
$start = (float) array_sum(explode(' ',microtime()));
echo "<br/>*************** SETTING PERMISSIONS ***************<br/>";
echo "Setting all folder permissions to 755<br/>";
echo "Setting all file permissions to 644<br/>";
AllDirChmod( "." );
echo "Setting pear permissions to 550<br/>";
chmod("pear", 550);

echo "<br/>****************** CLEARING CACHE ******************<br/>";

if (file_exists("var/cache")) {
    echo "Clearing var/cache<br/>";
    cleandir("var/cache");
}

if (file_exists("var/session")) {
    echo "Clearing var/session<br/>";
    cleandir("var/session");
}

if (file_exists("var/minifycache")) {
    echo "Clearing var/minifycache<br/>";
    cleandir("var/minifycache");
}

if (file_exists("downloader/pearlib/cache")) {
    echo "Clearing downloader/pearlib/cache<br/>";
    cleandir("downloader/pearlib/cache");
}

if (file_exists("downloader/pearlib/download")) {
    echo "Clearing downloader/pearlib/download<br/>";
    cleandir("downloader/pearlib/download");
}

if (file_exists("downloader/pearlib/pear.ini")) {
    echo "Removing downloader/pearlib/pear.ini<br/>";
    unlink ("downloader/pearlib/pear.ini");
}

echo "<br/>************** CHECKING FOR EXTENSIONS ***********<br/>";
If (!isDirEmpty("app/code/local/")) { 
    echo "-= WARNING =- Overrides or extensions exist in the app/code/local folder<br/>";
}
If (!isDirEmpty("app/code/community/")) { 
    echo "-= WARNING =- Overrides or extensions exist in the app/code/community folder<br/>";
}
$end = (float) array_sum(explode(' ',microtime()));
echo "<br/>------------------- CLEANUP COMPLETED in:". sprintf("%.4f", ($end-$start))." seconds ------------------<br/>";
?>

7ochem · Accepted Answer · 2016-05-10 08:40:15Z

MAGENTO 2 Centos 7 Server

See https://github.com/magento/magento2/issues/2882#issuecomment-217661873

To fix the message

Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider
SSH - Run the following command from your root account.
chown -R accountuser:accountusergroup /path-to-root-folderl/
SSH - Run the following command from the domain account user(not your web server account such as apache etc).
find . -type d -exec chmod 770 {} \; & find . -type f -exec chmod 660 {} \; && chmod u+x bin/magento

chmod -R g+w /path-to-root-folderl/{pub,var}
chmod -R g+w /path-to-root-folderl/{app/etc,vendor}
chmod -R g+s pub/static pub/media .
find var/generation -type d -exec chmod g+s {} \;
find var/session -type d -exec chmod g+s {} \;
SSH - Run the following command from your root account.
chown -R domain_account_user:webservergroup /path-to-root-folderl/var
chown -R domain_account_user:webservergroup /path-to-root-folder/app/etc
chown -R domain_account_user:webservergroup /path-to-root-folderl/pub
chown -R webserverUSER:webservergroup /path-to-root-folder/var/session
This will fix this error and many other error. Note: disable SUPHP when using magento 2, you will save yourself a lot of headache. Currently I'm running mod_mpm_event with ea-apache24-mod_cgid and PHP 7 and ea-php70-php-fpm.

I had my magento 2 running with just mod_mpm_event with ea-apache24-mod_cgid and PHP 7 before I added PHP-FPM.

If you are running cpanel/ apache and you don't want to use easyapache to move to mod_mpm_event + ea-apache24-mod_cgid you can use shell from ssh . Run the command bellow from ssh . yum shell remove ea-apache24-mod_mpm_worker remove ea-apache24-mod_cgi install ea-apache24-mod_mpm_event install ea-apache24-mod_cgid run quit

Your answer applies to Magento 2? This question is about Magento 1... — 7ochem, May 10, 2016 at 8:40
Where in the question do you see Magento 1 or Magento 2 ? I found this page looking for magento 2. That is why I clearly say MAGENTO 2 Centos 7 Server to make it clear. — willy alejo, May 11, 2016 at 12:38
The question itself is clearly tagged "magento-1.8", also the file structure show in the question is clearly Magento 1. Please feel free to Ask this Question again yourself for Magento2 and answer it yourself with the answer you have posted here. — 7ochem, May 11, 2016 at 12:56

Quan Le · Accepted Answer · 2017-11-04 04:12:58Z

1

set app/etc/config.xml and app/etc/local.xml files to 644

make sure that you have all .htaccess files exist in magento's default locations, like you will have that file at root, app folder etc

edited Nov 4, 2017 at 4:12

Quan Le

1,6881 gold badge13 silver badges18 bronze badges

answered Jan 4, 2015 at 14:01

Alam Zaib

1891 silver badge11 bronze badges

Add a comment |

Teja Bhagavan Kollepara · Accepted Answer · 2019-03-11 05:25:37Z

1

You can refer to this link to check the permissions for your Magento installation

http://www.magentocommerce.com/wiki/1_-_installation_and_configuration/magento_filesystem_permissions

You can download Magento clean up tool , and run it on your server.

also lastly check the group/owner of your files on server, and the ftp user you are using has sufficient update/delete rights.

edited Mar 11, 2019 at 5:25

Teja Bhagavan Kollepara

3,8065 gold badges32 silver badges66 bronze badges

answered Jun 19, 2014 at 7:55

huzefam

2,5764 gold badges18 silver badges32 bronze badges

The link is dead now.
– bfontaine
Nov 25, 2020 at 14:13

Add a comment |

Stack Exchange Network

How to set proper permissions for Magento on server?

7 Answers 7

Your Answer

Not the answer you're looking for? Browse other questions tagged
magento-1.8
server-setup
permissions
or ask your own question.

Linked

Hot Network Questions

How to set proper permissions for Magento on server?

7 Answers 7

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged magento-1.8server-setuppermissions or ask your own question.

Linked

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
magento-1.8
server-setup
permissions
or ask your own question.