Drupal 6 file permissions on shared host

I think the note for hosted installations apply to people who run shared servers (and provide Drupal to their customers/users). It
It'll be different if you are managing your own Drupal installation within a shared hosting environment. The advice above that would be more likely to apply.

Hosting providers vary in their set-up, so it's difficult to give clear instructions other than to say you should have the most restrictive permissions possible while still having everything working.

Ideally I think you should have:

• You, as owner of the site have rwx (4+2+1=7) on directories and rw- (4+2=6) on files. At some point you will want to view and make changes or add files. You need (x) to view contents of a directory, but you don't need x on files (to execute programs/scripts). If you're concerned about accidentally writing over stuff, you can remove write permissions for yourself.
• The server has r-x(4+1= 5) on directories and r-- (4) on files. It's insecure to have it write to anywhere except for the directory you specify for uploads (where it needs rwx). You give the server (usually named www-data) group ownership for all Drupal files and directories.
• Everyone else has no permissions (---).

That makes (Dir) 750, (File) 640
If you can apply this, that's fine, however...

One potential problem with shared hosts is they might only provide you with one user/ group account (no root or www-data). They configure it so the web server runs with the permissions of your account. This makes complete sense from their point of view and protects customers from each other. However, it means you can't have separate permissions for you and the server. In such cases, you need to restrict write permissions for yourself to prevent write access for the server.
ie. Directories: 550, Files: 440, Upload Directory: 770

This means that you have to change permissions whenever you modify or add files. Perhaps make changes on a copy then set perms on the copy and replace the old one.

Another potential problem is that if php is run as cgi rather than an apache module, you might need to give r /x permissions to 'other' to get it working. In this case you can't restrict permissions as recommended.

(Note these problems are specific to certain hosts not to Drupal. )

Hi,

My issue is similar in that I have run the Security Review and the recommendation was to correct the permissions for dozens of files and directories. But, I am thinking the message isn't accurate.

Checking Apache (using ps aux | grep apache) I saw the server is running with the user (and group) 'nobody'.

There are multiple sites set up on the site (via cPanel I understand) with each site having a dedicated 'users' with its own root directory (and child directories and files) being owned by the site's owner.

Security Review says "it is dangerous to allow the web server to write to files inside the document root of your server" but, to me, the web server (user nobody) doesn't have access to these files, only the site owner does.

Can anybody tell me if I can safely ignore this Security Review message or am I missing something.

Thanks,

Geoff

here's how i would access the my file permissions on a shared hosting (apache web servers), and i'll use a cpanel hosting as example.

there are 3 components of file/directory ownership that we need to remember.
- owner (read, write, execute)
- group (read, write, execute)
- others (read, write, execute)

from the above you only need to find out what the web server user is (on redhat family you have "apache", on debian you have "www-data", on cpanel they have "nobody"). this user need to have "read" access to your files/folder and "write" access as needed - in the case of Drupal this user needs to have "write" access only to your "sites/default/files" or whereever you drupal files directory is.

most hosting servers (ex: cpanel) they assign the web server user to "others", and owner/group components is yours. so on my cpanel server, i would set my users this way:

[root@localhost]cd /path_to_drupal_installation
[root@localhost]chown -R cpanel_user:cpanel_user .
[root@localhost]find . -type d -exec chmod u=rwx,g=rx,o=rx {} \;
[root@localhost]find . -type f -exec chmod u=rw,g=r,o=r {} \;
[root@localhost]chmod -R o+w sites/default/files

line 1: tell you to go inside your drupal install path
line 2: sets the "owner" and "group" of all files and directories
line 3: find all directories and set the permission of "owner" to "read/write/execute" and "group"/"others" permission to "read/execute" - no "write".
line 4: find and set permissions to files, which gives "others" a "read" access. this "read" access allow the web server to read your code/site files.
line 5: grants "write" access to "others" (which refers to your web server user) for you drupal files directory. this allows your site to create imagecache, save aggregated css/js files, upload files/images/etc of your site.

basically, you only want to limit where the web server can write or upload files.

what about the parent directory and subdirectories? It could be that the web server can't get into the /files/ directory, or it can't write to a subdirectory within in /files/

I found the issue to be linked to a module. Sorry for the confusion. You may ignore my previous post.

Thank you.