1

I work at a company where I noticed that most of our Magento 2 file system is owned by www-data and in the www-data group on our Ubuntu server.
Furthermore, the docroot directory /var/www/<websitename> has the same ownership, and an exceeding amount of directories in the Magento file system have both www-data ownership and 777 permissions, e.g. app, bin, pub and var amongst others.
The main user that is used for CLI work is not in the www-data group.

Is this an acceptable practice in some situations? Or is it always bad practice? Should I tell the webmaster to consider changing this? I consider this to be unnecessary and a dangerous security vulnerability, but I want to know whether it's permissible in some cases.

Improve this question

1 Answer 1

Reset to default
0

It is bad practice in a production environment for the Magento file owner / command-line user and the web server user to use the same account (i.e. www-data) and may cause security issues and problems when running cron jobs.

Some web servers run as www-data. Web content should not be owned by this user, or a compromised web server would be able to rewrite a web site. Data written out by web servers will be owned by www-data.

Follow the recommendations in the development documentation and configure separate users and permissions for the Magento 2 file owner and web server.

  • The file owner / command-line user user should always be a member of the web server user group.
  • Ensure that you run Magento 2 cron jobs as the file owner user.
  • Always run Magento system commands such as setup:upgrade as the file owner / command-line user.

More info here: https://devdocs.magento.com/guides/v2.4/install-gde/prereq/file-sys-perms-over.html

Improve this answer
2
  • Thank you for your answer! Would you mind adding some info about how using www-data ownership can compromise the server?
    – audio-engineer
    Dec 15, 2020 at 11:58
  • 1
    Thank you, I found your quote in /usr/share/doc/base-passwd/users-and-groups.html!
    – audio-engineer
    Dec 15, 2020 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.