By gwideman on
Folks:
The installation page at http://drupal.org/node/260 (which is basically the INSTALL.txt file) omits any mention of how to set the user and group for the unzipped directories and files, and if this is not set, then "Run the install script" won't work.
So, could someone please describe what to do here (or point to a page where this is described)?
I'm assuming at a minimum something like:
chown -R apache:webadmin mydrupaldir
Is that all, or are there further permissions that need to be set? Is it even the right thing to give apache ownership of the files --
the existing permission settings clearly provide different owner and group permissions.
Needless to say, some light on this area would be helful,
Graham
Comments
perms
Basically it all depends on how your server is configured in terms of which user Apache is etc. eg phpsuexec makes Apache run as your FTP account.
But generally for most set ups, don't set the ownership to the web server - it should stay as your personal account. That way Drupal can't be manipulated into overwriting it's own files.
Apache should only have read permissions for everything except the directory Drupal uses for file uploads and during installation the settings file needs to be writable but changed back to read only for the web server after installation.
So (on the average leaky security sieve shared hosting setup) perms could be summarised like this:
The files directory: 777 (you might be able to get away with tighter perms)
settings.php during installation: 666
settings.php after installation: 644
All other Drupal files: 644
All other directories: 755
The assumes that everything is owned by you, and that Apache runs as something else (eg nobody, www-data etc) and accesses the files through the world permissions.
Some more info:
http://drupal.org/node/34025
Personally when I have a dedicated server I like to set that Apache account as the group owner for all the files and directories and set the world permissions to 0 eg 750 and 640 etc. That generally needs root powers though - you may or may not be able to get your webhost to do that for you. But it doesn't add much security on a shared server though when all the other users can get Apache to run their code anyway.
Shared hosting will always be less secure than dedicated (physical or virtual machines) hosting.
--
Anton
New to Drupal? | Troubleshooting FAQ
Example knowledge base built with Drupal
Thanks for your reply,
Thanks for your reply, styro, it's a start. And FWIW, I am using a dedicated server for testing.
For you and any other more savvy drupallers: What I distill from this and elsewhere is:
1. Drupal's php code, activated by the apache web server and hence running with user and groups(s) of the web server, needs:
a. Read access to all files and dirs in the drupal directory hierarchy (not a surprise)
b. Write access to all dirs (ie: so that files can be deleted and added).
2. settings.php is special, and needs to provide write access during initial install (how about install of modules later?)
3. The files directory (involved in file upload/download) is also special -- I haven't got to the bottom of this yet.
4. Drupal's files and dirs generally should not be *owned* by the apache user, as that would potentially undermine the permissions. That means that the apache user should be a member of the group to which group permissions (on drupal's files/dirs) pertain.
----
Styro: Your point about dedicated server permissions impinges on my point 4 here: what do you mean by "set that Apache account as the group owner for all the files and directories". I don't understand the meaning of a "user being a group owner".
Perhaps you mean that you have both a user called "apache" and also a group called "apache"? Let's call these the apacheuser account and and the apachegrp group.
Should I read you as saying that you are setting group of drupal's files/dirs to apachegrp, and that's how the webserver gets permissions, but you are NOT setting owner of drupal's files/dirs to apacheuser?
Hope I have this straight.
BTW, for anyone else reading along trying to understand initial hurdles that new installers face -- this situation is confounded by all the alarming warning notices drupal produces by default during the install script -- which look like possible permissions issues but probably aren't. I'm pursuing those separately.
Graham
a. Read access to all files
Yes
No - the files directory is the only directory Drupal (ie Apache) will need write access to.
This is where Drupal (ie Apache) tries to save files you (or your visitors) upload through Drupals web interface. If Apache can't write to this directory, it won't be able to save the files.
Just to use the more explicit terminology for clarity: files and directories in unix have two ownership fields - the user owner and the group owner. People often casually refer to the 'user owner' field as 'owner' or 'user' and the 'group owner' as the 'group'.
Yep. But just to put some persepctive on this...
This allows you to remove world read permissions from your files. In reality though, that doesn't buy you a lot of security as Drupals file contents are public knowledge - it's only really the settings.php file that benefits from that as it contains your database password. And the only time on a dedicated server you need protection from world permissions is when some other software has been compromised - which in the case of potential local root exploits and rootkits you've probably got much more to worry about.
You'll need to decide whether the hassle of resetting the permissions and changing the group ownership back to Apache everytime you upload new files is worth it just to protect your database password from a threat that either doesn't exist or is probably powerful enough to bypass your permissions anyway :)
--
Anton
New to Drupal? | Troubleshooting FAQ
Example knowledge base built with Drupal
Thanks Anton, that was a
Thanks Anton, that was a helpful clarification.
Graham