Linux Permissions for Wordpress (LAMP)

Go To StackoverFlow.com

2

I'm trying to configure a Linux server with secure permissions in /var/www. I've read that you shouldn't add your user account to the www-data group for various reasons. Instead, it's best (I'm told) to create a separate developer's group.

Here's what I came up with:

group add developers
usermod -a -G developers my_account
chown -R root:developers /var/www
find /var/www/ -type d -exec chmod 775 {} \;
find /var/www -type d -print | xargs chmod g+rwxs
find /var/www/ -type f -exec chmod 664 {} \;

Also, edit /etc/apache2/envvars and add:

umask 002

Questions:

(a). Is this reasonably secure? (b). Is any of this redundant? (c). Does this setup require any change of the default umask? If so, to what?

2012-04-04 20:03
by Trent Scott
(a) define reasonably. (b) define redundant. (c) no, chmod ignores the umask, so there's no point - Chris Eberle 2012-04-04 20:09
(a) will these work as intended or am I missing something (opening up holes); (b) are each of those commands needed or can I simplify it a bit; (c) does the default umask of 022 undo any of these changes and, if so, what should it be to uphold these permissions - Trent Scott 2012-04-04 20:10


4

On redundancy, these lines nearly duplicate each other:

find /var/www/ -type d -exec chmod 775 {} \;
find /var/www -type d -print | xargs chmod g+rwxs

the first sets all permissions, the second is just changing the group permissions. For this part, it's setting everything the same as the first except for the sticky bit.

I'd suggest using the former (as this sets permissions absolutely), but modify it to include the sticky bit, using either of these:

find /var/www/ -type d -exec chmod 2775 {} \;

or alternatively:

find /var/www -type d -print | xargs chmod 2775

they do exactly the same thing, but the second is more efficient: the former calls chmod for every file, the latter calls chmod on a group of files, so starts chmod less often.

On the umask, I assume you want the developers group to have write access, but have the files world readable? In which case, you'll want umask 002. I don't know what your default umask is, so don't know if this needs changing.

2012-04-04 20:09
by Chris J
Thanks! And anything needed with that umask to uphold these settings on newly created files - Trent Scott 2012-04-04 20:14
I don't know what your default umask is :-) But the answer has been updated accodingly - Chris J 2012-04-04 21:02
Yea that's what I was looking to do. Thanks : - Trent Scott 2012-04-04 21:22
Ads