Difference between revisions of "Security Directory Permissions"

From Phoenix Cart User Guide
(Add suggestion for comments about servers)
 
Line 6: Line 6:
 
</div>
 
</div>
  
−
On a Linux-based system, the general rule of thumb is 755 for directories, 644 for files
+
This page checks how your server set-up affects how secure your files are. On PhoenixCart < 1.0.8.15, the two columns "Writable" and "Recommended" should have the same symbol to indicate correct set-up. On PhoenixCart >=1.0.8.15 a green symbol indicates correct set-up, while a red symbol means you should change things in your hosting to strengthen your security.
  
−
<!--
+
Often, on a Linux-based system, correct permissions for non-writable files are 0644, while folders are 0755.
−
Note that servers can be set up in different manners.
 
−
Commonly for shared servers, to protect the server, servers will set both the user and php as owner.
 
−
While this means that another infected site on your server would be unable to infect your site, it also means that should your site be hacked, the hacker will be able to use chmod() to alter all your files.
 
−
PhoenixCart has no known vulnerabilities, but you must make sure to keep your passwords safe - especially for ftp and your host!
 
−
The reason to mention this here is that this page may show all files and directories with a red lock, to show that they are writable, but are not supposed to be.
 
−
Thus, if you are on a server where php runs as owner, this page may not be helpful.
 
−
To test whether php is owner or not, you could try making a new file in the root of you store called testchmod.php with the following content:
 
−
<nowiki>
 
−
<?
 
−
/*
 
−
credit to Te Taipo, @Taipo for this exact code
 
−
*/
 
−
// change the file name to whatever file you are testing
 
−
$testfile = "testchmod.php";
 
  
−
error_reporting(0);
+
Note that webservers can be set up differently.
−
$i=0;
+
Thus, 0664, 0644, 0640, 0460, 0444, 0440 or 0400 could be correct for non-writable files and 0775, 0755, 0750, 0570, 0555, 0550 or 0500 could be correct for non-writable folders. You can do trial and error or speak to your host to find the correct permissions for your set-up.
−
$content = NULL;
+
 
−
$writeperms = substr( decoct( fileperms( $testfile ) ),3 );
+
If your server requires low permissions (04XX for files or 05XX for folders) to not be writable, you should instead get help from your host to make the server run as a different user from the FTP-user. You should also make your user separate from the user of other sites on the same server if possible.
 +
 
 +
If you are on a dedicated server, you could further strengthen security by making admin run as a different user than catalog. This would make an eventual compromise of the catalog-server less impactful for you, as less harm can be done from there.
 +
 
 +
Obviously, nothing is really secure, if the keys are left in the locks, so make sure to keep your passwords strong and safe!
  
−
if ($writeperms <= 665) {
 
−
  if ( !chmod( $testfile, 0666 ) ) {
 
−
    $i++;
 
−
  } else {
 
−
    $msg .= "able to chmod<br>";
 
−
  }
 
−
} else {
 
−
  $msg .= $testfile . " is already chmod to " . $writeperms . "<br>";
 
−
}
 
−
  if (!$fp = fopen($testfile, 'r')) {
 
−
  $i++;
 
−
} else {
 
−
  $content = stream_get_contents($fp, -1, 0);
 
−
  fclose($fp);
 
−
  $msg .= "able to read content of " . $testfile . "<br>";
 
−
}
 
−
if ( !$fp = @fopen( $testfile, "w" ) ) {
 
−
  $i++;
 
−
} else {
 
−
  $msg .= "able to open " . $testfile . "<br>";
 
−
} 
 
−
if ( fwrite( $fp, $content ) === FALSE ) {
 
−
  $i++;
 
−
} else {
 
−
  $msg .= "able to write to file " . $testfile . "<br>";
 
−
} 
 
−
if ( !fclose( $fp ) ) {
 
−
  $i++;
 
−
} else {
 
−
  $msg .= "able to close file " . $testfile . "<br>";
 
−
} 
 
−
if( $i > 0 ) { 
 
−
  echo $testfile . " is Write-Protected ";
 
−
} else {
 
−
  echo $msg;
 
−
} 
 
−
?>
 
−
</nowiki>
 
−
Then browse to it (yousite.com/testchmod.php) and see the result.
 
−
Make sure you delete the file afterwards!
 
−
-->
 
 
<hr>
 
<hr>
 
{{Page_In_Progress}}
 
{{Page_In_Progress}}
 
{{Contribute}}
 
{{Contribute}}

Latest revision as of 10:31, 22 February 2023

Back
Administration

From admin go to Adminnavbartools.png Tools → Security Directory Permissions to see similar to this:

Securitydirectory.png

This page checks how your server set-up affects how secure your files are. On PhoenixCart < 1.0.8.15, the two columns "Writable" and "Recommended" should have the same symbol to indicate correct set-up. On PhoenixCart >=1.0.8.15 a green symbol indicates correct set-up, while a red symbol means you should change things in your hosting to strengthen your security.

Often, on a Linux-based system, correct permissions for non-writable files are 0644, while folders are 0755.

Note that webservers can be set up differently. Thus, 0664, 0644, 0640, 0460, 0444, 0440 or 0400 could be correct for non-writable files and 0775, 0755, 0750, 0570, 0555, 0550 or 0500 could be correct for non-writable folders. You can do trial and error or speak to your host to find the correct permissions for your set-up.

If your server requires low permissions (04XX for files or 05XX for folders) to not be writable, you should instead get help from your host to make the server run as a different user from the FTP-user. You should also make your user separate from the user of other sites on the same server if possible.

If you are on a dedicated server, you could further strengthen security by making admin run as a different user than catalog. This would make an eventual compromise of the catalog-server less impactful for you, as less harm can be done from there.

Obviously, nothing is really secure, if the keys are left in the locks, so make sure to keep your passwords strong and safe!

Construction.png
This page is in progress
Please visit again soon for additions and changes

Phoenix Cart User Guide, like CE Phoenix Cart, is free to use but is maintained by unpaid volunteers.

Code references are licensed under a Commons Attribution-NonCommercial-ShareAlike 2.0 UK: England & Wales License.
All other content is the reserved Intellectual Property and Copyright of phoenixcart.org
Retrieved from ‘https://phoenixcart.org/phoenixcartwiki/index.php?title=Security_Directory_Permissions&oldid=4454’