1

I know there are a thousand questions about this all over the place and trust me I've been trying every possible solution for years [not an overstatement] and each and every one is either missing a crucial piece or simply doesn't work [in my experience].

I'm looking for a solid, complete, and open minded solution for the wordpress directory user / group ownership and permissions on linux. The requirements are the ones that I think everyone should be looking for: state of the art security, auto-updates, and sftp access.

The facts - if I'm not missing anything - are fairly straightforward: if we configure ownership of the web directory [in my case /var/www/] to a dedicated user [meaning not the webserver user - which in my case is www-data], as in: wp:www-data, wordpress is able to install themes and plugins but not to auto-update itself [security issue], even with fs method: direct;

if we attribute everything to www-data, as in www-data:www-data, files are owned by the webserver user [security issue];

and to access everything through sftp, even if we setup chroot, bind mounts, and access with a dedicated sftp user with whatever comination of user / group nesting [sftp being a part of www-data, sftp and www-data being a part of the same group, and so on...], files uploaded via sftp are created as the sftp user and even with the most complex ACL rules and excluding periodic chown / chmod scripts [which are absurd] ownership and permissions are always wrong.

I am astonished I haven't found a more obvious solution up until now. How many insecurely configured web servers are there out there? I'm sure the solution is out there and that you guys can help me figure this out. Thank you so much in advance! :)

1

If your aim is security, the only directory writable by the web server should be uploads. Yes, it means no easy updates, but in a secure environment the web server should not be able to write to directories in which there is executable code.

If you have so many updates that SFTP becomes too much of a time waster, install and use the wp-cli utility to do updates.

.... Almost forgot, the way to have updates while avoiding the permissions confusion is to run and FTP server that will be limited to accept requests from the local host. Firewall the FTP ports from any other host and you got both the possibility to update from the browser while being secure.

  • Ok thanks I'll look into wp-cli. Any idea for the rest of the issues? – Nikksno Nov 8 '16 at 10:18
  • @Nikksno, maybe I missed something, but once you limit the webserver to upload there are no other issues as all of the other directories belong to the user – Mark Kaplun Nov 8 '16 at 11:06
  • @Nikksno, added another option – Mark Kaplun Nov 8 '16 at 13:56
  • Ok so [s]ftp updates could be an option. I was wondering how to deal with the sftp issue: ownership / permissions, and so on. Is there a way to make both wp updates and user sftp access work with my requirements? Thank you. – Nikksno Nov 10 '16 at 9:27
  • @Nikksno, if you use the ftp option, you can use the same user as you use with SFTP, so at least there should not be any confusion from that - just one user for all – Mark Kaplun Nov 10 '16 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.