In the past I’ve often run into trouble with permissions and ownership of Joomla files/directories on linux systems.
Problems included
What are the recommended best practices for setting permissions and ownerships in Joomla on linux systems?
There are a few potential causes for file and folder permission issues on Linux hosting.
1. File and Folder Permissions
Check folder permissions are set to 0755 and file permissions are set to 0644. Note that file and folder permissions can be reset to these standard secure settings on a site wide basis using the free or the paid version of Akeeba Admin Tools.
2. PHP Parameters
Check the upload_max_filesize parameter in the PHP Information tab in the System Information is sufficient. You can often override the default setting in a shared hosting environment via the PHP settings in cPanel or a custom php.ini file.
3. Incorrect Paths in configuration.php
You may have incorrect paths specified for the tmp and logs folders. These are specified in the System Configuration or can be updated directly in the configuration.php file if you are comfortable editing system files directly. If you are unsure of what the path should be, create and upload a file whereami.php (or similar) to the root folder of your website with the following content:
<?php
print 'Current folder is ' . dirname(__FILE__);
?>
Browse to [mywebsite].com/whereami.php to see the path to the root folder.
Once you have the correct path, remember to delete the whereami.php file.
4. Unsuitable PHP File Handler
Your web hosting may be configured with the default PHP file handler but should ideally be using suPHP or FastCGI or similar so that Joomla can upload and execute files using secure file permissions.
You can see what PHP handler is being used at System -> System Information -> WebServer to PHP Interface.
There is a good article on the relative merits of PHP file handlers at: http://boomshadow.net/tech/php-handlers
In a shared hosting environment you don't usually have access to change which PHP file handler is enabled but your web hosting company may be able to change this for you.
Sometimes as a work-around, file and folder permissions are changed to 0777 but this puts your website in a vulnerable state and 0777 file permissions should generally be avoided.
If your web hosting company can't enable suPHP or FastCGI, the only other option might be to find a new web hosting company.
5. Disk Space
Check you have not exceeded your disk space quota.
TROUBLESHOOTING CHECKLIST
What are the recommended best practices for setting permissions and ownerships in Joomla on linux systems?
See 1 and 4.
Not being able to transfer files to the server using programs such as WinSCP.
See 1, 2, possibly 4, and 5.
Not being able to install Joomla extensions, plugins etc.
See 1, 2, 3, 4 and 5.
Insecure files and folders due to dangerous permissions and ownership settings.
See 1 and 4.
Please check the permission levels, it should be 644 and 755 for files and folders respectively.
Many times the permission levels are just fine, even when some issues are faced. It means that you will have to check the the ownership and group of the specific files and folders. Normally the group and ownership can be changed to www-data for apache (used in ubuntu based web servers).
Feel free to check out this interesting Joomla document based upon verifying the file permissions.
An easy solution for me is to often let PHP run in (Fast-)CGI mode and to set the ownership of the Joomla directory to the FTP user. So you will be able to upload and overwrite files via FTP and Joomla will be able to write files too.
A way to do this on a shared hosting environment (if it is allowed), is to add something like this to your .htaccess file:
AddHandler php53-cgi .php
Also see an overview about the different modes.
Permissions should be 644 and 755 as explained by Shyam.
In Joomla you can avoid all the problems you mentioned ,with following methods.
Not being able to transfer files to the server using programs such as WinSCP.
configuration.php have this permission its doesn't allow by default(for security).Not being able to install Joomla extensions, plugins etc.
This will happen due to temp/log folder bad permission.(It required 755)
Or another reason is temp/log path is wrong in configuration.php
Insecure files and folders due to dangerous permissions and ownership settings.
Hope its helps..
Permissions should be 644 and 755 as explained by Shyam.
The problems you are facing are most likely related to the way your server is set up. Most of the time this happens on shared hosts where Apache runs under a different user than your FTP account. Since you usually upload Joomla using FTP, Apache isn't the owner of the file and thus doesn't have the needed permissions to change it.
There is a FTP mode within Joomla which allows you to bypass this problem. You can enable it in the Joomla global configuration. It will then do all file accessing using the FTP user instead of the regular Apache user.
A better way however is to ask your host to fix the issue. They can set up PHP (Apache) to run under a special user, which in such a case should be your FTP user. Then everything will work fine.
Yes, the permissions should be 644 and 755 as explained by Shyam, but the other posters forget to mention that this is if the file is owned by your webserver, and the group is the group you belong to.
For instance, in FileZilla you will see permissions something like this:
Filename Size Filetype Last Modified Permissions Owner/Group
somefile.txt 11KB txt file 2014-04-23 3:43:00 AM www-data myGroup
The permissions drwxr-xr-x are 755 (just ignore the leading dr so it's wxr-xr-x). Read permissions are worth 4, Write permissions are worth 2 and execute permissions are worth 1.. so having them all add up to 7, and that's what the owner of this file has. The group has read and execute permissions but not write, so they have 5, and everyone also has 5.. making the permissions 755.
754 would be owners having read, write, execute. Group having read and execute, and everyone only having read permissions.
In the example above, you can see that the file owner is www-data (which is the default web server group for many Apache servers) and the Group is the group myGroup, which is the Group (admins) that I belong to.
The first number is the owners permissions, the second is the groups' permissions, and the third number is everyone's permissions. Obviously, you have to be careful to give the web server the permissions it needs... and make sure the files that need to be locked down can't be written or executed by just anyone (the third number). Below is what the numbers mean:
Assuming the Webserver owns the files, your admin is in the group, and of course, everyone is the third number.
644: Files with permissions set to 644 are readable by everyone and writeable only by the file/folder owner.
755: Files with permissions set to 755 are readable and executable by everyone, but only writeable by the file/folder owner.
777: Files with permissions set to 777 are readable, writeable, and executable by everyone. Don’t use this set of permissions, for security reasons, on your web server unless absolutely necessary, and only temporarily. It's a disaster waiting to happen, especially if a directory has those permissions.. it means anyone can upload files and execute them.
Here are the Linux commands to setup the Joomla! recommended permissions from the command line. Recommended Joomla File Permissions
Set ownership: sudo chown -R www-data:myName /path/to/your/domain.com
Set Directories: sudo find /path/to/your/domain.com -type d -exec chmod 755 {} \;
Set files : sudo find /path/to/your/domain.com -type f -exec chmod 644 {} \;
NOTE - many people will show you these commands without the path, but I prefer to ALWAYS use the complete path, because if you forget to change directories to the root Joomla! installation directory and run them without the path, you have just changed permissions for every file and directory in that top directory, and created a huge mess.
After you run these commands, you will need to fix permissions for any directories that need more permissions... for instance...users uploading images etc.
IF YOU ONLY USE THE JOOMLA! interface, and you don't have admin or FTP access to the server, then USE THE OWNERSHIP and PERMISSIONS ABOVE.
STOP HERE IF YOU ARE A NOVICE.. the Below is only for people that truly understand what permissions and ownership do.
However, I find having the ownership and permissions that way very unhandy because I like to use FileZilla and a Terminal session command line most of the time, and I upload a lot of files manually. But I can't overwrite any files because I don't own them and I don't have permissions to write. I could have FileZilla log in under the web server account, BUT... I want FileZilla to log in under my account, so I can browse other directories also, not just the files the webserver has access to... SO... I change the ownership and permissions to this:
Filename Size Filetype Last Modified Permissions Owner/Group
somefile.txt 11KB txt file 2014-04-23 3:43:00 AM drwxr-xr-x myName www-data
I make myself the owner, and put the web server in the Group... and I change the permissions for directories to 775, and for files to 664. Makes my life a lot easier... but I don't recommend it for everyone.
If you do it my way, these are the commands:
Set ownership: sudo chown -R myName:www-data /path/to/your/domain.com
Set Directories: sudo find /path/to/your/domain.com -type d -exec chmod 775 {} \;
Set files : sudo find /path/to/your/domain.com -type f -exec chmod 664 {} \;
The other answers provides a good explanation of what should be done, I only want to add a script to fix the permissions if you already uploaded a component and can't access the files with ftp.
In this case I would upload this file as fix.php to the FTP server and open it in the browser: http://example.com/fix.php
<?php
file_fix_directory(dirname(__FILE__));
function file_fix_directory($dir, $nomask = array('.', '..')) {
if (is_dir($dir)) {
// Try to make each directory world writable.
if (@chmod($dir, 0777)) {
echo "<p>Made writable: " . $dir . "</p>";
}
}
if (is_dir($dir) && $handle = opendir($dir)) {
while (false !== ($file = readdir($handle))) {
if (!in_array($file, $nomask) && $file[0] != '.') {
if (is_dir("$dir/$file")) {
// Recurse into subdirectories
file_fix_directory("$dir/$file", $nomask);
}
else {
$filename = "$dir/$file";
// Try to make each file world writable.
if (@chmod($filename, 0666)) {
echo "<p>Made writable: " . $filename . "</p>";
}
}
}
}
closedir($handle);
}
}
This script sets all the file's permissions to 666 and all directory's to 777. World writable is not the best set of permissions for a shared host but you will be able to access your files again and can then set it to the correct values with FTP.
Late to the party. I came here looking as well as other places for a definitive guide on what folders need to be writeable for joomla.
Sorry folks to be the harbinger of bad news.
The advice to use the permissions 755 for all directories and 644 for all folders is irresponsible at the very least.
Making all your folders and files owner writeable is fine as long as the owner is not the web server (apache et al).
I know this is common recommended practice but I can assure you its not good practice. The last piece of software you want to give the ability to write to folders is the web server itself. Its the web server that is used by hackers to take advantage of that exploit that hasn't been patched yet (or even found).
Do you think .htaccess will save your Kevin? Forget it because you allowed the web server write access, our dear hacker friends can create their own .htaccess files giving them whatever permissions they want! like Oh I don't know Umm make .jpg files executable by the server. And you thought protecting against .php execution was going to cover your A.
But make sure only the folders requiring write access actually have it. 755 and 644 for the following folders.
public_html/images
public_html/cache
public_html/tmp
And make sure you turn OFF .htaccess files with AllowOveride none for all writeable folders (like those above)
For those of you on shared hosting good luck as this is a configuration element you cannot control.
Dont think making the .htaccess file read only will help. If our hacker friends can create a new folder (they can) then they can create their own .htaccess.
For those of you running shared hosting for all that is sacred please get a clue about security.
If you do not understand security please get out of the hosting business you are making it tough for the rest of us.
Now back to my search for the definitive guide on folders needing write access...
