What is the suitable file permission for 'files'?

Question

I have written this small bash script to rebuild D6.22 file permissions:

#!/bin/bash
cd /path/to/drupal

chown -R bob:www-data .

find . -type d -exec chmod u=rwx,g=rx,o= {} \;
find . -type f -exec chmod u=rw,g=r,o= {} \;

cd /path/to/drupal/sites

find . -type d -name files -exec chmod ug=rwx,o= '{}' \;
find . -name files -type d -exec find '{}' -type f \; | while read FILE; do chm$
find . -name files -type d -exec find '{}' -type d \; | while read DIR; do chmo$

chmod -R 777 /path/to/drupal/sites/default/files  #bad idea??
chmod -R 755 /path/to/drupal/tmp                 


echo "Permissioin rebuild is done!"

Of course prior to executing the script 'bob' should have been added to www-data group using

usermod -G www-data bob

I know that a security-aware admininstrator should avoid giving 777 permission to web server, however when I assign 755 to files, users can not upload image/avatars and I get a warning that says sites/default/files/pictures/picture is not writable.

So what alternative permission do you use for 'files' (and works)?

Thanks

Answer 1

This really depends on how you have Apache configured.

I almost always run Apache in prefork mode. When I do this, I

chown -R apache.apache sites/default/files
find sites/default/files/ -type d -exec chmod 755 {} \;
find sites/default/files/ -type f -exec chmod 644 {} \;

This lets Apache write to that directory. Note that the owner/group depends on the setting from httpd.conf.

When I use FastCGI, then I use the user that Apache runs as.

The main key is that your files/ directory is owned and writable by just Apache, and that the rest of the files in docroot are owned and writeable by someone else, and not writable by Apache. Normally this is the user I run drush as.

One quirk has to do when drush runs things that write to this directory, like bam-backup.

Then I will add my drush user to the Apache group, and do

chown -R apache.apache sites/default/files
find sites/default/files/ -type d -exec chmod 775 {} \;
find sites/default/files/ -type f -exec chmod 664 {} \;

so that drush can write to files, but Apache can't write to the rest of docroot.