|
All of those directories should be writable if you would like Joomla to work at its maximum potential. There are however, some strange things being said by some people on this forum with regard to file permissions that I would like to comment on. One of which involves one thing that almost all of the people here have erred with. A file does not need to have it's permissions set to 7 for owner/group/world to be able to write to it. It only has to be set to 6. A directory, however, must be set to 7 in order for owner/group/world to be able to read and write to it. If you only want read access to a file, you can set it to 4, however, if you want a directory to have only read access, it must be set to 5.
This may seem like nit-picking to some, but, it is important. In order for an Operating Systems kernel to be able to do anything within a directory, including something as trivial as reading which files are in that directory, it has to have the execute permission. This execute permission is what accounts for the difference in file/directory permissions (4 being read only for a file, 5 being read and execute from a directory. 6 being read and write only for a file, 7 being read and write and execute for a directory.) The only files that need to have the execute bit set are applications and scripts. PHP pages are not scripts in the normal sense, they are pages that are read and written to, but they just so happen to be passed through an interpreter along the way.
Furthermore, there are some things that may help your security situation if you are concerned with that, which at least some of you appear to be. One thing to do is if you are in a shared hosting environment, like most basic hosting packages, ask your service provider to make your user a member of the group that apache runs as. This will provide a small increase in security, especially if they only do this for someone who may ask for it, however, I don't know how most hosting providers would take this request. What this allows for is for a slightly finer tuned permission setup, in which you can have files, such as configuration.php, writeable by your user, and the apache group (which would presumably be small), instead of being world writeable, in which case someone could wonder into your directory structure on a shared host, and modify your files because they are essentially open to anyone.
One other possible option is the event that your hosting provider does not want to add you to the apache user group, is to ask them to chgrp (change group ownership) some files, again, such as the configuration.php file. Then, you could set that file writeable for the group. And you will still of course be the owner of it, so you will maintain total control over the file, except for which group it is in. This will provide a similar security feature as the description above, with a slightly different implementation. I think the one above is slightly more robust, and would allow you to implement this feature also (I think.) if you were to choose to.
This setup provides for a Joomla setup that will be feature rich, and will require little fussing with. I can count quite a few times that I forgot to set my configuration file to be writeable before changing settings, only to lose all of the changes I made because I wasn't paying attention. Not to mention, it will allow you to easily install new themes, components, modules, etc. with out any hassle. Unfortunately, there are some definite security concerns due to the powerful nature of PHP. It is a trade-off that must be addressed, one of convenience versus security, and the choice is not always easy, especially if you have multiple people making modifications to a site, and not all of them are very computer literate, at least not literate enough to grasp the concept of file permissions and such. If you don't mind the inconvenience and extra steps, you could make the make the file and directory permissions more strict, but, I guess I am just saying you should way your options.
I wouldn't consider myself an expert on security and PHP, but, I try to educate myself on these things as best I can. But, to prevent break-ins and unauthorized file modification, keep as few files as possible group or world writeable (the second and third 66's, like 666 is bad.) A directory, however, is not as much of a concern, yes, they may be able to write to the directory, but, they will not be able to write over or modify any existing file unless it is explicitly writeable. And given the design of Joomla, it will not work with files unless it has been told to do so, meaning that it doesn't scan the components directory, and load every component it finds. That would be bad for security. Instead, you have to go into the Administration panel, and tell Joomla to install and load this component, or else, it won't do it, which is better for security.
I think that is enough of that for one post, sorry if I am blabbering on.
Good Luck,
Rob S.
_________________
Rob Schley - Open Source Matters
Webimagery - http://www.webimagery.net/ - Professional Consulting Services
JXtended - http://www.jxtended.com/ - Free and Commercial Joomla! Extensions
|
Login
Register
Rules
FAQ
The team
BUMP
. RJS is totally right. Joomla will run normally with these settings. You just can't install new components/modules/mambots with these settings. If you want to install one of those, the installation screen will show you which directories need to be writable (only a few). Change those to 777, and you are able to install the component/module/mambot. If you are finished, you can change it back again. This requires some work, but you aren't installing new components a lot on production sites, but it is a lot safer.
