3

Just to prevent hacks, can I remove write protection in all files and directories in my installation, except for in sites/default/files?

I mean I want to chmod to 555 and chown them all to root:root except for files within sites/default/files. For installation/uninstallation I use Drush.

I'm talking about the "Config 1: Web server is running as owner" as described as in What are the most appropriate users and permission levels for Drupal sites on shared hosting?

It seems my four sites are working fine with this. Is it OK?

This is because to ward off hack attacks which place php files in within site folders. This almost saved my site from this Highly Critical hack attack but the hacker was able to place php and execute file within sites/default/files as my .httacces was not protected from running php scripts within the files directory.

  • 1
    "remove write protection" would mean to make all files writable. I assume you mean the opposite? – Letharion Oct 25 '14 at 18:14
  • I've updated my answer. – AgA Oct 25 '14 at 18:27
  • As long as the files are readable by the web server, and the files (and tmp) folder is writeable by the same, yes, it's ok. Beyond that, what sort of information are you looking for? Anything that isn't covered here, for example? – Clive Oct 30 '14 at 18:21
  • @Clive Are there any (custom) modules, themes which create files in areas other than sites/default/files? – AgA Nov 6 '14 at 6:20
9

Yes, although it will disable the installation of modules through the web interface (it writes in sites/all/modules), but I would consider that a feature.

You also probably want to use 0644 for files (rw/r/r), and 0755 for directories (rwx/rx/rx). By convention, you don't want files to be executable unless they are really meant to be.

Here is the official Drupal documentation on the issue:
https://www.drupal.org/node/244924

And this answer also has good advice:
What is the suitable file permission for 'files'?

  • I want to give write permission to only those files/folders which are required to support anonymous/authenticated users for example sites/default/files. I'd use drush with root account to do site maintenance. – AgA Nov 4 '14 at 5:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.