Joomla! Discussion Forums

I'm really frustrated because I have been dealing with security issues since installation through Fantastico.

Some required files were not writeable by Joomla. I read on the forums that it is possibly an ownership issue.

Since I had these problems I asked my ISP (Dotable) to change all file and directory ownership to my account.

Joomla System info looks at my directories and reports that all files are properly writeable.  Now I can't upload images, can't install plugins for JCE etc.

I'm not sure I understand what ownership Joomla requires to make all of this work.  The file permissions all look appropriate.  I don't want to change everything to 777 but i'm getting close, and if I lose more hair there will be none left.

Thanks,

Peter

Hi Peter

If your hosting offers phpsuexec, and the joomla files are under your user account, then Joomla/Webserver will be able to write on the folders and files, provided that those folders/files have at least 644 permission (An ideal setup IMO is 755 for folders and 644 for files).

If your hosting does not offer any means to make files/folder owned by your user account to be also readable/writable by the webserver, the files and folders need to be owned by the same user running the Webserver process. So for example if the Webserver process is being run by "apache" user, the joomla folders and files should be at least owned by "apache" so 755 for folders and 644 for files will work with no problems.

Kindly inquire to your webhost which is the best approach so that php applications residing on your space will be able to have write/read access to the folders and files.

Setting your folder and files to be owned by the user running the webserver "could" be the best bet.

Thank you for your reply.  I have had my hosting provider make all the files owned by me.  Unfortunately it still doesn't work, so now I'm trying to find out what the apache server expects for a user/group.  I have another site that works fine with the user/group owned by my account.  It has no problems with permissions. 

I found that the phpSuExec script is not practical from the hosting provider perspective, so I'd like to stay with Apache.

It is not clear to me what permissions the Joomla code sees.  For example, when you edit css of a template, it shows it  as unwriteable in Joomla administrator until I raise it at least to 666 - indicating to me that ownership between Joomla and me intersects only at the highest level.

How can I and the server share the same group at least?

thanks,
Peter

I would check the security FAQ that RusW wrote called What does Joomla! have to do with file permissions? It is very good at explaining permissions and what yours normally are and what Apache's normally are.  It helped me better understand.

Hey there Arpee....

Hopefully the Security FAQ's on the Joomla! Help Site will provide you with the information you are looking for, also the following post might be of interest, ( http://forum.joomla.org/index.php/topic ... #msg964665 )  Not all of the post is relevant to this discussion, but the ensuing general permissions discussion adds to the FAQ above.

FAQ: Joomla! Permissions Overview
http://help.joomla.org/component/option ... temid,268/

FAQ: Avoiding 777
http://help.joomla.org/component/option ... temid,268/

FAQ: More about permissions
http://help.joomla.org/component/option ... temid,268/

The Joomla! Tools Suite (HISA) utility might assist you in understanding the security and management of your site in a little more detail also;
http://forum.joomla.org/index.php/topic,136328.0.html

I'm also dealing some inconveniences due to my server's default ownership settings.  I suspect that the solution posited in the 'FAQ: Avoiding 777' would fix most of my problems (http://help.joomla.org/component/option,com_easyfaq/task,view/id,99/Itemid,268/ This is basically setting the server so that apache runs as an FTP account user).

BUT.. I can't figure out from the simple explanation given what exactly needs to be done.

The article says:



The thing is, I dont' know if I'm looking for a file named 'user.conf' or [insertyourusernamehere].conf, OR where to look for this file.  Running a 'locate' command on my server doesn't turn anything up called 'user.conf.'

I thought maybe Russ or someone else could clue me in on some more specifics here.

Thanks!