3

Just to prevent hacks, can I remove write protection in all files and directories in my installation, except for in sites/default/files?

I mean I want to chmod to 555 and chown them all to root:root except for files within sites/default/files. For installation/uninstallation I use Drush.

I'm talking about the "Config 1: Web server is running as owner" as described as in What are the most appropriate users and permission levels for Drupal sites on shared hosting?

It seems my four sites are working fine with this. Is it OK?

This is because to ward off hack attacks which place php files in within site folders. This almost saved my site from this Highly Critical hack attack but the hacker was able to place php and execute file within sites/default/files as my .httacces was not protected from running php scripts within the files directory.

Improve this question
4
  • 1
    "remove write protection" would mean to make all files writable. I assume you mean the opposite?
    – Letharion
    Commented Oct 25, 2014 at 18:14
  • I've updated my answer.
    – AgA
    Commented Oct 25, 2014 at 18:27
  • As long as the files are readable by the web server, and the files (and tmp) folder is writeable by the same, yes, it's ok. Beyond that, what sort of information are you looking for? Anything that isn't covered here, for example?
    – Clive ♦
    Commented Oct 30, 2014 at 18:21
  • @Clive Are there any (custom) modules, themes which create files in areas other than sites/default/files?
    – AgA
    Commented Nov 6, 2014 at 6:20

1 Answer 1

Reset to default
9

Yes, although it will disable the installation of modules through the web interface (it writes in sites/all/modules), but I would consider that a feature.

You also probably want to use 0644 for files (rw/r/r), and 0755 for directories (rwx/rx/rx). By convention, you don't want files to be executable unless they are really meant to be.

Here is the official Drupal documentation on the issue:
https://www.drupal.org/node/244924

And this answer also has good advice:
What is the suitable file permission for 'files'?

Improve this answer
1
  • I want to give write permission to only those files/folders which are required to support anonymous/authenticated users for example sites/default/files. I'd use drush with root account to do site maintenance.
    – AgA
    Commented Nov 4, 2014 at 5:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.