2

I have a question about best practice for running a dedicated Magento server. We have a security consultant who want to run the site as APACHE while the Magento documentation says we should run as a web user

http://devdocs.magento.com/guides/m1x/install/installer-privileges_after.html#privs-after

Dedicated Magento server only. As a user with root privileges, enter the following command to set ownership of the Magento installation directory and all its subdirectories: chown -R web-server-user-name .

I am trying reconcile the reasoning on running as the apache user compared to a different user? Is running as the apache user more secure?

3
  • Interesting, I'd read your highlighed text as the web-server-user-name being the username the web-server runs as. I.e. Apache. Am I mis-reading this? – Douglas Radburn Apr 9 '15 at 13:26
  • The high lighted text is from the Magento site – brentwpeterson Apr 9 '15 at 14:12
  • 2
    As you are on a dedicated server, running as apache should be the same as running as another web-user. I guess you are not running any other website/CMS on the server and only Magento? If so, running as apache user should be fine. In this case it should be enough to set file permissions only for the user (apache) and you can refrain from setting group or others rights. – Anna Völkl Apr 11 '15 at 17:10
1

I just add my comment as an answer here:

As you are on a dedicated server, running as apache should be the same as running as another web-user. I guess you are not running any other website/CMS on the server and only Magento? If so, running as apache user should be fine. In this case it should be enough to set file permissions only for the user (apache) and you can refrain from setting group or others rights.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.