Last month, I encountered an issue where I could not edit
settings.php as it was read-only.
I asked this question and learned how to change the permissions to edit the file, and then harden them again. The result was that vim would warn me a file is read-only until I used
chmod a+w settings.php. After this, vim would no longer warn me about this and I could make the changes I need. Finally, I used
chmod go-w settings.php to harden the permissions again, and once again, vim gave me a warning that it is read-only.
Today I created two more Drupal sites and have to edit multiple
settings.php files. I repeated the same process, but this time I noticed that I no longer got the warning from vim that the file is read-only after hardening the permissions. Furthermore, I could edit the files freely.
I started digging to see why the permissions weren't blocking me from editing the file and discovered that the file permissions are
-rw--r--r-- so that I, as the owner, could edit the file. This is different from the default permissions on the
settings.php file that instead look like
-r--r--r--. I asked about this on the unix stack exchange and was informed that this is the expected outcome of the
chmod go-w settings.php command.
My main concern now is if this poses the same security risk for the site as having a writable
settings.php file? Should I instead be using
chmod a-w settings.php to get
-r--r--r-- permissions, or is
-rw--r--r-- sufficiently secure for a live Drupal site?