More than 1000+ satisfied clients and counting, since 2010

Blog

How to secure Magento file and directory permissions?

Most software packages are installed with the most lenient file/directory ownership and permissions by default. This is normally done for the sake of the software developer as they want that their software must be installed on a range of diverse systems with varying configurations. This article gives an overview of how to setup Magento installation with the strictest of permissions for overall security’s sake. So read through to know how to secure Magento file and directory permissions.

There are two environments that one finds while running Linux

  • PHP scripts which runs via mod_php or equivalent and all scripts are executed as the webserver user which means that when your script is running it can read with the same privilege level as the web server. This is not ideal in a shared environment especially when it comes to e-commerce and could allow cross-account snooping in shared hosting setups.
  • PHP scripts that run as the user who owns the files themselves via an intermediate construct such as PHP suEXEC ,suPHP, PHP-FPM etc. Here your scripts run as you and is a more secure overall configuration when running on a shared server.

Running As the Webserver User

Many dedicated and shared hosting companies run your scripts as the webserver user itself by default. On most Linux systems it is the default operating system and it’s not secure while in a shared environment, it can be partially remedied. This is done by limiting access via stricter file permissions which mitigates some of the inherent security issues. This method is actually desirable in dedicated hosting environments, mainly for performance reasons, and all of the clustered and dedicated Magento SIP plans use this method. When the server is serving a single client none of the shared hosting caveats apply for dedicated servers.

These are the steps we take, followed by the script commands

  • Set the user and group ownership of all files in the Magento directory to your local user, if you have access to change the ownership of files and directories. This may already be done in your environment and is simply a precaution to flush out any webserver owned files or directories
  • Change the Linux permissions for all files in your Magento base directory to readable and writable by the owning user and readable only by everyone else.
  • Change the Linux permissions for all directories in your Magento base directory to file editable, list-able and navigable for the owning user and simply navigable for everyone else.
  • The “media” and “var” directories require special handling since the webserver itself must be able to both read and create/edit files. This is where most instructions go straight for world editable permission on files and directories. Change the Linux permissions for all directories to file editable, list-able and navigable by the owning user and just navigable by everyone else.
  • Take an extra step of setting the Linux “group” permissions on the file so that anyone in the group can edit files, list and navigate the directories as well. Do this in the “media” and “var” directories as well. This will allow the user to read and write permissions, the group user to read and write permissions and everyone else simply read permissions.
  • Finally, change the file permissions on the core Magento configuration files to be readable and writable by the file owner and readable by the group only for a minimal amount of added protection against snoopers.
  • If you have access to change the ownership of files and directories then set the user and group ownership of all files in the Magento directory to your local user.
  • Change the Linux permissions for all files in your Magento base directory to readable and writable by the owning user and readable only by everyone else.
  • Change the Linux permissions for all directories in your Magento base directory to file editable, list able and navigable for the owning user and simply navigable for everyone else.
  • Close down permissions for all PHP scripts so that only your user can read them as only your user should need to know the contents of scripts.
  • Finally, disable all access to your local configurations files for Magento except as the PHP scripts are the only thing that need to read these files and PHP is running as you so you can disable access to all others.

Running As Your Local User

This method is preferred in shared environments given the extra level of security provided by Linux, if the permissions are configured correctly.

Written by

The author didnt add any Information to his profile yet