3

So everyone and there cat is on about permissions in the web folder structure. Popular question is the one about Recommended Practices. Great post and I understand the importance of setting 755 for directories and 644 for files. Even the Joomla Recommended Settings refer to those permission sets. I have done this and that is easy.

This is very related to another question of mine where I was trying to get the Directory Permissions permissions set to writable. Initially I set the owner of my entire website to 'apache' which worked. However I have since learned that is a bad practice even on a dedicated hosting environment.

A blog post by Dionysopoulos talks about how to change this using the owner and .htaccess files. On the off change that post is ever broken the steps he suggests are listed below:

The correct approach is painful and time consuming. You need all your files and directories owned by your account’s user (i.e. use FTP to upload them) except those you need to be able to write to. Since we’re talking Joomla! here, do the following:

  • Remove the cache, tmp and logs directories

  • Install Joomla! eXtplorer or NinjaXplorer on your site. These file managers run inside Joomla!, ergo under the same user and group as your web server.

  • Create the cache, tmp and logs directories using either of these file managers. These directories are now owned by the web server user.

  • Give them temporarily 777 permissions, again using these file managers.

  • Use your favourite FTP program to create a .htaccess file inside each of these directories with the following contents:

order deny, allow deny from all

  • Give that file 0644 permissions using the FTP program.

  • Go back to the file manager (eXtplorer or NinjaXplorer) and give the cache, tmp and logs directories 0700 permissions. Note: you may need to give 0744 permissions to the cache directory and remove the .htaccess file for some CSS/JS aggregation & compression plugins to work. I consider this an awful practice, but it seems to be the only workaround… If you ask for myopinion, uninstall the plugin in question.

  • Go to Joomla!’s Global Configuration and enable the FTP layer. Do not store your password!

Getting to the point

As of this moment the only writable directories I have are cache, tmp and log which are protect by .htaccess based on the above instructions. The part I'm fuzzy on is: You need all your files and directories owned by your account’s user. Currently that is set to root. I want to do this right. It hasn't taken long to see that Joomla Security is very important. Below is the ll (jrt and wood are my tmp and log respectively. I read they should be changed from their defaults.)

drwxr-xr-x. 10 root   apache  4096 Oct  1 06:52 administrator
drwxr-xr-x.  2 root   apache  4096 Oct  1 06:52 bin
drwxr-xr-x.  2 apache apache  4096 Jan 18 20:07 cache
drwxr-xr-x.  2 root   apache  4096 Oct  1 06:52 cli
drwxr-xr-x. 19 root   apache  4096 Jan 18 19:39 components
-rw-r--r--.  1 root   apache  2750 Jan 16 20:39 configuration.php
-rw-r--r--.  1 root   apache  2859 Oct  1 06:52 htaccess.txt
drwxr-xr-x.  5 root   apache  4096 Oct  1 06:52 images
drwxr-xr-x.  2 root   apache  4096 Oct  1 06:52 includes
-rw-r--r--.  1 root   apache  1013 Oct  1 06:52 index.php
-rw-r--r--.  1 root   apache  1910 Oct  1 06:52 joomla.xml
drwxr-xr-x.  2 apache apache  4096 Jan 18 20:04 jrt
drwxr-xr-x.  4 root   apache  4096 Oct  1 06:52 language
drwxr-xr-x.  4 root   apache  4096 Oct  1 06:52 layouts
drwxr-xr-x. 14 root   apache  4096 Jan 17 23:38 libraries
-rw-r--r--.  1 root   apache 17816 Oct  1 06:52 LICENSE.txt
drwxr-xr-x. 20 root   apache  4096 Jan 17 23:38 media
drwxr-xr-x. 28 root   apache  4096 Oct  1 06:52 modules
drwxr-xr-x. 15 root   apache  4096 Jan 17 23:28 plugins
-rw-r--r--.  1 root   apache  4310 Oct  1 06:52 README.txt
-rw-r--r--.  1 root   apache   842 Oct  1 06:52 robots.txt.dist
drwxr-xr-x.  5 root   apache  4096 Oct  1 06:52 templates
-rw-r--r--.  1 root   apache    86 Jan 17 16:49 test.php
-rw-r--r--.  1 root   apache  1609 Oct  1 06:52 web.config.txt
drwxr-xr-x.  2 apache apache  4096 Jan 18 20:06 wood

Who should the owner be of directories that don't need to be writable all the time?

Improve this question
6
  • 2
    I think Nicholas is describing a painful work-around for a less than ideal hosting set-up. My recommendation is to avoid this in the first place and choose a suitable hosting company using suPHP or FastCGI or similar so you likely need never worry about file ownership issues and everything just works as expected.
    – Neil Robertson
    Jan 19, 2015 at 5:56
  • It does not seem that painful as it is just a matter of setting permissions and creating some files. If indeed I move to or someone else has a less than ideal hosting set-up it would be nice to know the missing piece here. suPHP is definately an alternate to this but not everyone has that at their disposal. If my site ever goes to primetime I would need to consider another host. That host might not support suPHP and my budget might force me to use them.
    – Matt
    Jan 19, 2015 at 14:49
  • The work-around describes how to make Joomla function in a basic fashion but there will likely be ongoing issues e.g. when and if you ever want to install a new extension. The difference in the cost between poor quality hosting and good quality hosting is likely minimal compared to the time required to force Joomla to function on inadequate hosting.
    – Neil Robertson
    Jan 19, 2015 at 22:35
  • It sounds like you are trying to discourage this practice albeit for my benefit. Having to temporarily change permissions to install extensions does not sound like a big hassle. Do you have another example of why this is not a good idea as it does seem like a valid approach. If not for me then maybe someone else.
    – Matt
    Jan 20, 2015 at 0:30
  • Hi Matt, I have had to maintain websites using the default Apache file handler and found it very frustrating. In some cases, I've had to backup the website, restore it to alternative hosting, perform the required change and then restore the amended version of the website back to the original location. This is not a trivial exercise and a 2 minute change can end up taking an hour by the time you backup, FTP, perform the change, FTP back and run a restore. To be honest, banging my head against a brick wall is probably a more pleasant experience but your mileage may vary.
    – Neil Robertson
    Jan 20, 2015 at 2:34

1 Answer 1

Reset to default
3

The files should be owned by your FTP user, which may be root for you if you are setting up a dedicated server manually.

The entire goal of the article was to allow you to still be able to change the files, with "you" in this case expected to be someone accessing a shared host over FTP. You're not expected to have root access to the server.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.