4

I've searched the drupal docs and all over the internet, but I don't find a concrete answer regarding what file permissions the drupal directory should have.

I've been redirected to this page: http://drupal.org/node/244924

On almost every search, but this page doesn't actually tell me what each file's permission should be. I'm trying to pass "Security Review's" permission test, but it literally says ALL my files have wrong permissions.

I know its a very specific question, but can anyone give me a specific CHMOD number for each directory and files in the directories?? I've spent a good portion of the day looking for this with no success..

  • That page doesn't tell you what they should be because it's not a simple answer. Unfortunately this is a case where you need to understand what is happening and decide for yourself. – greggles Aug 14 '12 at 12:58
4

If your webserver user is the same as your account user that you use to login and update the files, then the files should be 440 and folders 550. However, this will make it hard to edit or update the code of the site as you will have to change the permissions back to 755/644 before doing the update.

Note, also, that using anything other than 0 as the final digit in the three is likely the wrong value on a shared server where you do not know/trust every user of the server.

The security review test is about "defense in depth" that prevents a poorly coded file-upload tool from becoming a way to overwrite executable files in Drupal's installation. Sometimes it's OK to ignore some of the reviews from security_review module.

  • 1
    I know this is quite old but files should be 555 and folders 444 is the wrong way round, files should be 444 and folders 555 – Clive Feb 18 '16 at 11:55
2

You should have 755 on directories and 644 on files, try this on your root directory:

Directories,

find /path/to/base/dir -type d -exec chmod 755 {} \;

Files:

find /path/to/base/dir -type f -exec chmod 644 {} \;

another important thing is ownership which is depend on your server configuration. please update your question and add more details about your server.

  • This configuration still fails the "Security Review" test. I use FileZilla to recursively set all directories to 755 and all files to 644 and it still fails the test. – dmor574 Aug 13 '12 at 0:18
  • any information about your server? – Mohammad Ali Akbari Aug 13 '12 at 0:24
  • I'm using shared hosting through NetworkSolution – dmor574 Aug 13 '12 at 0:28
  • which files/directories has permission error? – Mohammad Ali Akbari Aug 13 '12 at 0:31
  • Took me a while to find a good file sharing website, but I don't get an "error" per-say, but it tells me a list of files that have incorrect permissions for security reasons. wikisend.com/download/529528/review.txt. Go to the link to download the text file with the "errors" – dmor574 Aug 13 '12 at 0:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.