1

So I'm trying to understand the correct permissions for file directories in order to install a module. I've installed drupal, and I try to install a module, which looks like so: module installation page

But When I click install it takes me here:

update manager page

I then wanted to test if it was permissions preventing it from installing, so I chmod'd everything to 777 in the sites folder just to see, and yes, the module then installed easily and correctly. But of course, 777 on everything is insecure, so I quickly installed drupal again from scratch. So now when I check the permissions they look like this

html/sites$ ls -l
total 16
drwxr-xr-x 5 6226 6226 4096 Jun 17 18:38 all
dr-xr-xr-x 3 6226 6226 4096 Jul 19 20:08 default
-rw-r--r-- 1 6226 6226 2365 Jun 17 18:38 example.sites.php
-rw-r--r-- 1 6226 6226  904 Jun 17 18:38 README.txt

So after an installation the all folder has r-x permissions and the default has r-x as well for group and other. (A side question being, what do I make of the user and group, "6226", "4096","2365", and "904"?)

The "modules" folder, inside "all" folder where they get downloaded is also set to r-x.

html/sites/all$ ls -l
total 12
drwxr-xr-x 2 6226 6226 4096 Jun 17 18:38 libraries
drwxr-xr-x 2 6226 6226 4096 Jun 17 18:38 modules
drwxr-xr-x 2 6226 6226 4096 Jun 17 18:38 themes

I don't know if this seems right to me. Shouldn't it be able to write to the folder to download the module from an external source?

Thanks for all the feedback in advance, I look forward to hearing what people have to say.

Edit, more details:

Linux myhostname 3.13.0-24-generic #46-Ubuntu SMP Thu Apr 10 19:11:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

ubuntu@myhostname:/var/www/html/sites/all/modules$ ls -la total 12 drwxr-xr-x 2 www-data 6226 4096 Jun 17 18:38 . drwxr-xr-x 5 6226 6226 4096 Jun 17 18:38 .. -rw-r--r-- 1 www-data 6226 952 Jun 17 18:38 README.txt

Okay! So. after reinstalling and repeatedly chowning folders until I made it past that request for FTP details, I finally got it to ATTEMPT to download the file. All I had to do after a fresh install was sudo chown www-data /var/www/html/sites/default. What confuses me is why that would work. Beause before and after chowning, the permissions were dr-xr-xr-x 3 www-data 6226 4096 Jul 20 09:03 default for the default folder. So my understanding is that the owner, group, and others could all all read and execute, so why would changing the owner even matter? Now when attempting to "Install from a URL" after chowning default, a loading bar appears and says "Completed 100%", and then this screen appears instead of the FTP login request:

Install failed but at least it downloaded it

2
  • Welcome to Drupal Answers! I don't know why you get it's a file permission issue. The first screen tells you the Update module is going to use FTP; the second screen is telling you passwords are visible, since you are using FTP, not FTPS. it is asking you the user ID and the password to use for FTP; it's not giving you errors, but a warning about the passwords being visible. That would be true also when you log in on a site using HTTP instead of HTTPS.
    – apaderno
    Jul 20, 2015 at 9:47
  • The modules directory needs to be owned by your ftp user. Jul 20, 2015 at 9:59

1 Answer 1

0

The module directory has contested ownership. In your case, using the FTP set up from the browser, the modules directory (and subdirectories and files) need to be owned by the FTP user you are logging in with.

For example: if you are ftp-ing in with myusername then the ownership on the directories and files are most likely be myusername. That is the default configuration for most FTP servers (ProFTPd for example).

$ chown -R [myusername] [pathtomodules]

If you are updating Features (or configuration in Drupal 8) from the Drupal backend you'll want the modules directory owned by the same user as your web service runs as. Then you can have your permissions set to something more reasonable. If you grep ps for Apache, nginx or httpd you should discover the user that's running the process.

$ ps aux | grep -i 'www\|apache\|nginx'
$ chown -R [username] [pathtomodules]

And finally if you are using drush dl you'll need the owner to be your SSH user.

In all cases you can set the strongest permissions with the following. Remember the webserver needs read on all files and execute on all directories. This command will give you 755 on directories and 644 on files.

$ chmod -R u+rwX,go+rX,go-w [pathtomodules]

The first two numbers in your ls command are user and group. That may be a numeric match for your web service user above. The third column is size.

9
  • there was no "httpd" process, only an apache2 process, so grepping for "apache2" gave me the user "www-data". So I applied "sudo chown -R www-data ./modules". But it still didn't allow me to install the modules. Even if it had worked, if www-data owns the module folders, that means that it will have read, write and excute access? I read that that is not a good thing. Is that an okay thing for modules?
    – ADJenks
    Jul 19, 2015 at 23:33
  • In order for the install module feature to work from the web server it needs to write to the directory. In order for the web server to read modules installed it needs read on files and execute on directories (so it can see within them). So your permissions should be rw-r--r-- for files and rwxrx-rx- for directories. I don't disagree with you that there is a security implication in that. If you are still having issues please send through a sample of the output of ls -la [pathtomodules] and ideally let us know what OS your server is. If you have shell you could uname -a Jul 20, 2015 at 2:47
  • I've included the details for you. The modules folder has drwxr-xr-x permissions and is owned by www-data. This seems correct to me, it has no files in it though.
    – ADJenks
    Jul 20, 2015 at 7:46
  • Okay, so, it's not the permissions... Because I just chmodded everything to 777 recursively and it's still taking me to that update manager FTP login page...
    – ADJenks
    Jul 20, 2015 at 8:27
  • Try making a directory within modules called contrib Jul 20, 2015 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.