So everyone and there cat is on about permissions in the web folder structure. Popular question is the one about Recommended Practices. Great post and I understand the importance of setting 755 for directories and 644 for files. Even the Joomla Recommended Settings refer to those permission sets. I have done this and that is easy.
This is very related to another question of mine where I was trying to get the Directory Permissions permissions set to writable. Initially I set the owner of my entire website to 'apache' which worked. However I have since learned that is a bad practice even on a dedicated hosting environment.
A blog post by Dionysopoulos talks about how to change this using the owner and .htaccess files. On the off change that post is ever broken the steps he suggests are listed below:
The correct approach is painful and time consuming. You need all your files and directories owned by your account’s user (i.e. use FTP to upload them) except those you need to be able to write to. Since we’re talking Joomla! here, do the following:
Remove the cache, tmp and logs directories
Install Joomla! eXtplorer or NinjaXplorer on your site. These file managers run inside Joomla!, ergo under the same user and group as your web server.
Create the cache, tmp and logs directories using either of these file managers. These directories are now owned by the web server user.
Give them temporarily 777 permissions, again using these file managers.
Use your favourite FTP program to create a .htaccess file inside each of these directories with the following contents:
order deny, allow
deny from all
Give that file 0644 permissions using the FTP program.
Go back to the file manager (eXtplorer or NinjaXplorer) and give the cache, tmp and logs directories 0700 permissions. Note: you may need to give 0744 permissions to the cache directory and remove the .htaccess file for some CSS/JS aggregation & compression plugins to work. I consider this an awful practice, but it seems to be the only workaround… If you ask for myopinion, uninstall the plugin in question.
Go to Joomla!’s Global Configuration and enable the FTP layer. Do not store your password!
Getting to the point
As of this moment the only writable directories I have are cache, tmp and log which are protect by .htaccess based on the above instructions. The part I'm fuzzy on is: You need all your files and directories owned by your account’s user. Currently that is set to root. I want to do this right. It hasn't taken long to see that Joomla Security is very important. Below is the
wood are my tmp and log respectively. I read they should be changed from their defaults.)
drwxr-xr-x. 10 root apache 4096 Oct 1 06:52 administrator drwxr-xr-x. 2 root apache 4096 Oct 1 06:52 bin drwxr-xr-x. 2 apache apache 4096 Jan 18 20:07 cache drwxr-xr-x. 2 root apache 4096 Oct 1 06:52 cli drwxr-xr-x. 19 root apache 4096 Jan 18 19:39 components -rw-r--r--. 1 root apache 2750 Jan 16 20:39 configuration.php -rw-r--r--. 1 root apache 2859 Oct 1 06:52 htaccess.txt drwxr-xr-x. 5 root apache 4096 Oct 1 06:52 images drwxr-xr-x. 2 root apache 4096 Oct 1 06:52 includes -rw-r--r--. 1 root apache 1013 Oct 1 06:52 index.php -rw-r--r--. 1 root apache 1910 Oct 1 06:52 joomla.xml drwxr-xr-x. 2 apache apache 4096 Jan 18 20:04 jrt drwxr-xr-x. 4 root apache 4096 Oct 1 06:52 language drwxr-xr-x. 4 root apache 4096 Oct 1 06:52 layouts drwxr-xr-x. 14 root apache 4096 Jan 17 23:38 libraries -rw-r--r--. 1 root apache 17816 Oct 1 06:52 LICENSE.txt drwxr-xr-x. 20 root apache 4096 Jan 17 23:38 media drwxr-xr-x. 28 root apache 4096 Oct 1 06:52 modules drwxr-xr-x. 15 root apache 4096 Jan 17 23:28 plugins -rw-r--r--. 1 root apache 4310 Oct 1 06:52 README.txt -rw-r--r--. 1 root apache 842 Oct 1 06:52 robots.txt.dist drwxr-xr-x. 5 root apache 4096 Oct 1 06:52 templates -rw-r--r--. 1 root apache 86 Jan 17 16:49 test.php -rw-r--r--. 1 root apache 1609 Oct 1 06:52 web.config.txt drwxr-xr-x. 2 apache apache 4096 Jan 18 20:06 wood
Who should the owner be of directories that don't need to be writable all the time?