0

Recently changed hosting of a website and found the upload directory of WordPress wasn't "available". I have been reading that setting folder permissions to 777 would allow everything to work fine, but I consider this a big security issue, and a future problem for sure.

SCENARIO:

The folder's (and its contents) permissions are 755, an administrative account was the owner/group of it and WordPress wasn't working properly in the Media dashboard within the web CMS.

So, I have came up with a solution, in fact the matter of my question:

SOLUTION(?)

  • Searched the user that executes the web server (NginX, Apache, Cherokee, etc...):

    ps -aux

  • Assign that user as owner/group of wp_content/uploads recursively:

    chmod -R username uploads/ chgrp -R username uploads/

  • Found a GeoIP.dat and GeoIPV6.dat files within uploads/ folder, then assign the former owner/group to those executable files.

  • Since that, I have been able to upload my files again through the media dashboard in the WordPress CMS without any trouble.

Is this practice safer than the 777 permissions? I mean, maybe it could be reachable through the web, sure, but since there are a couple security plugins running already, I have little concern about it.

0

In short:

YES, is a big time threat.

Explained:

Little time has passed since I asked this question but now I have found that the safer and most useful file permissions for wordpress are the following:

Directories: 755 Owner can: Read, write and execute. Group and public can: Read and execute.

Read-only files:644 Owner can: Read and write. Group and public can read only.

Example of read only files:

  • *.css
  • *.htm
  • *.html
  • *.jpeg
  • *.jpg
  • *.gif
  • *.png
  • *.js
  • *.mpeg
  • *.mpg
  • *.mp3
  • *.avi
  • *.txt
  • *.doc
  • *.pdf

Executable files:700 Owner can: Read, write and execute.

Example of executable files:

  • *.php
  • *.cgi
  • *.pl
  • *.py
  • *.rb

TO IMPLEMENT THE CHANGES (in terminal):

Determine where are you, this will tell you that.

pwd 

Once you get to the desired folder (there were the wp-config.php lays) in order to change the directory permissions you could try:

sudo find . -type d -exec chmod 755 {} \;

Where: -type d stands for instances listed as directories found by find command.

Then:

sudo find . -type f \( -iname '*.css' \-or -iname '*.htm*' \-or -iname '*.jpeg' \-or -iname '*.jpg' \-or -iname '*.gif' \-or -iname '*.png' \-or -iname '*.js' \-or -iname '*.mpeg' \-or -iname '*.mpg' \-or -iname '*.mp3' \-or -iname '*.avi' \-or -iname '*.txt' \-or -iname '*.doc' \-or -iname '*.pdf' \) -exec chmod 644 {} \;

Where: -type f stands for instances listed as files with given file extensions founded by find command.

And finally:

find . -type f \( -iname '*.php*' \-or -iname '*.cgi' \-or -iname '*.pl' \-or -iname '*.py' \-or -iname '*.rb' \) -exec chmod 700 {} \;

Where: (again) -type f stands for instances listed as files with given file extensions founded by find command.

Happy server management.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.