Answers.Body: <p>I'm not sure if this helps, but here is how I (attempt) to manage deployments/installs.</p>
  
  <p>I first create a user so I'm not using the root account. I tie that user to the apache user group. We'll call him 'user1'.</p>
  
  <p>I use beanstalk to deploy, and the deployment credentials are for 'user1'.</p>
  
  <p>Once all of the files have deployed for the first time, I'll log into the server via terminal, and <code>chown</code> the project directory: <code>chown -R user1:apache</code></p>
  
  <p>Next, I'll make sure everything has the correct permissions: <code>chmod -R 754 mysite.com</code></p>
  
  <p>Next, I know that Craft needs to be able to write to:</p>
  
  <ul>
  <li>/craft/app</li>
  <li>/craft/config</li>
  <li>/craft/storage</li>
  </ul>
  
  <p>I will chmod those directories to 774. <code>chmod -R 774</code>. Since 'user1' belongs to apache, it can read/write to the appropriate directories.</p>
  
  <p>Hope this helps!</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-09T20:20:31.527Z
Answers.Text: Probably need to be able to write to any folder you have setup as an asset source as well...
Answers.UserDisplayName: RitterKnight
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-09T20:24:35.047Z
Answers.Text: ^ This too... :)
Answers.UserDisplayName: Damon
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-06-11T01:32:14.087Z
Answers.Text: when you say "tie the user to the apache user group"...how do you do that?
Answers.UserDisplayName: David Rhoden
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-06-11T14:39:30.963Z
Answers.Text: @DavidRhoden this part: `chown -R user1:apache`   in this case, I am saying  modify the file/folder so that `user1` is the owner and it belongs to the `apache` group
Answers.UserDisplayName: Damon
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-09T05:13:49.413Z
Answers.LastActivityDate: 2015-12-09T05:13:49.413Z
Answers.UserDisplayName: Damon
Body: <p>Quick preface - i'm a new to managing my own servers. I'm on Ubuntu 14.04 running Apache. I ran into some problems setting up Craft which i was hoping someone might be able to shed a bit of light on what i got wrong. I have a user with sudo privileges, lets say 'user1'. </p>
  
  <p>I used a simple PHP script to find out what user PHP is running as:</p>
  
  <pre><code>&lt;?php echo exec('whoami'); ?&gt;
  </code></pre>
  
  <p>Which came out as 'www-data'. In terminal as 'user1' i created a new group 'craftpermissions' and added 'user1' and 'www-data' to this group. I then set the group 'craftpermissions' as the owner of the following directories:</p>
  
  <pre><code>/craft/app/
  /craft/config/
  /craft/storage/
  </code></pre>
  
  <p>I then set permissions on those three folders to 775 using:</p>
  
  <pre><code>sudo chmod -R 775 /var/www/myvirtualhostaddress/craft/app/
  </code></pre>
  
  <p>However when i visited <code>mydomainname.com/index.php/admin/</code> i still got the error saying php could not write to the /config folder.</p>
  
  <p>In the end i set permissions on the folder to 777 so i could crack on with installation and it worked fine, but i'd like to do it properly as i think 777 is a bit of a no-no? Or does it not matter too much if craft folder is one directory above my web root?</p>
  
  <p>Any guidance much appreciated.</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>for <code>/craft/app</code> everything is owned by craftpermissions except <code>..</code> which is owned by the group created when i made user1:</p>
  
  <pre><code>drwxr-xr-x  7 user1 user1 4096 Aug 25 06:44 ..
  </code></pre>
  
  <p>does this refer to the directory above it? When i run on /craft/storage/ it appears as:</p>
  
  <pre><code>drwxrwxrwx 3 user1 craftpermissions 4096 Aug 25 09:18 .
  drwxr-xr-x 7 user1 user1       4096 Aug 25 06:44 ..
  drwxr-xr-x 6 www-data   www-data         4096 Aug 25 09:19 runtime.
  </code></pre>
  
  <p><code>/craft/config</code> appears as </p>
  
  <pre><code>drwxrwxrwx 3 user1 craftpermissions 4096 Aug 25 09:19 .
  drwxr-xr-x 7 user1 user1       4096 Aug 25 06:44 ..
  -rwxrwxrwx 1 user1 craftpermissions  671 Aug 25 06:44 db.php
  -rwxrwxrwx 1 user1 craftpermissions  220 Aug 25 06:44 general.php
  -rw-r--r-- 1 www-data   www-data          255 Aug 25 09:19 license.key
  drwxrwxrwx 2 user1 craftpermissions 4096 Aug 25 06:45 redactor
  -rwxrwxrwx 1 user1 craftpermissions  844 Aug 25 06:44 routes.php
  </code></pre>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-08-25T17:19:37.590Z
Comments.Text: You definitely don't want to run with 777 in a production environment. When you `ls -al`, what user:group currently owns `craft/app`, `craft/storage` and `craft/config`?
Comments.UserDisplayName: Brad Bell
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-08-26T09:05:51.027Z
Comments.Text: i've edited my post above
Comments.UserDisplayName: alexr
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-08-26T17:57:16.257Z
Comments.Text: You might have to `service apache2 restart` after adding `www-data` to the group. If that doesn't work - anything interesting in the Apache logs? Also - any reason why you're not just `chown -R www-data:www-data /var/www/myvirtualhostaddress`?
Comments.UserDisplayName: megatrond
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-08-26T20:50:42.227Z
Comments.Text: Just to narrow things down if you `chown` those files to `www-data:www-data`, do the 755 permissions work then?
Comments.UserDisplayName: Brad Bell
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-08-27T14:42:37.413Z
Comments.Text: i chown'd the `/app`,`/storage` and `/config` folders to www-data:www-data, and set permissions to 755 and it worked fine - thanks for the suggestion. is it ok to do it this way (having directories owned by www-data), or are there any drawbacks? is the best way to figure out how to do it with groups? i think i've probably just not fully understood how the relationships between groups / users works. am i understanding right that if group X is assigned through chown to a directory, any user in the group X should be able to read/write/execute with 775 (regardless of assigned user through chown)?
Comments.UserDisplayName: alexr
Tags: <installation><permissions>
Title: Unix permissions for Craft
ThreadText: # Unix permissions for Craft
  
  (Asked by: username_0 on 2015-08-25)
  
  Quick preface - i'm a new to managing my own servers. I'm on Ubuntu 14.04 running Apache. I ran into some problems setting up Craft which i was hoping someone might be able to shed a bit of light on what i got wrong. I have a user with sudo privileges, lets say 'user1'.
  
  I used a simple PHP script to find out what user PHP is running as:
  
  ```
  <?php echo exec('whoami'); ?>
  
  ```
  
  Which came out as 'www-data'. In terminal as 'user1' i created a new group 'craftpermissions' and added 'user1' and 'www-data' to this group. I then set the group 'craftpermissions' as the owner of the following directories:
  
  ```
  /craft/app/
  /craft/config/
  /craft/storage/
  
  ```
  
  I then set permissions on those three folders to 775 using:
  
  ```
  sudo chmod -R 775 /var/www/myvirtualhostaddress/craft/app/
  
  ```
  
  However when i visited `mydomainname.com/index.php/admin/` i still got the error saying php could not write to the /config folder.
  
  In the end i set permissions on the folder to 777 so i could crack on with installation and it worked fine, but i'd like to do it properly as i think 777 is a bit of a no-no? Or does it not matter too much if craft folder is one directory above my web root?
  
  Any guidance much appreciated.
  
  **EDIT**
  
  for `/craft/app` everything is owned by craftpermissions except `..` which is owned by the group created when i made user1:
  
  ```
  drwxr-xr-x  7 user1 user1 4096 Aug 25 06:44 ..
  
  ```
  
  does this refer to the directory above it? When i run on /craft/storage/ it appears as:
  
  ```
  drwxrwxrwx 3 user1 craftpermissions 4096 Aug 25 09:18 .
  drwxr-xr-x 7 user1 user1       4096 Aug 25 06:44 ..
  drwxr-xr-x 6 www-data   www-data         4096 Aug 25 09:19 runtime.
  
  ```
  
  `/craft/config` appears as
  
  ```
  drwxrwxrwx 3 user1 craftpermissions 4096 Aug 25 09:19 .
  drwxr-xr-x 7 user1 user1       4096 Aug 25 06:44 ..
  -rwxrwxrwx 1 user1 craftpermissions  671 Aug 25 06:44 db.php
  -rwxrwxrwx 1 user1 craftpermissions  220 Aug 25 06:44 general.php
  -rw-r--r-- 1 www-data   www-data          255 Aug 25 09:19 license.key
  drwxrwxrwx 2 user1 craftpermissions 4096 Aug 25 06:45 redactor
  -rwxrwxrwx 1 user1 craftpermissions  844 Aug 25 06:44 routes.php
  
  ```
  
  **Tags:** installation, permissions
  
  > **Comments:**
  > **username_1**: You definitely don't want to run with 777 in a production environment. When you `ls -al`, what user:group currently owns `craft/app`, `craft/storage` and `craft/config`?  
  > **username_0**: i've edited my post above  
  > **username_2**: You might have to `service apache2 restart` after adding `www-data` to the group. If that doesn't work - anything interesting in the Apache logs? Also - any reason why you're not just `chown -R www-data:www-data /var/www/myvirtualhostaddress`?  
  > **username_1**: Just to narrow things down if you `chown` those files to `www-data:www-data`, do the 755 permissions work then?  
  > **username_0**: i chown'd the `/app`,`/storage` and `/config` folders to www-data:www-data, and set permissions to 755 and it worked fine - thanks for the suggestion. is it ok to do it this way (having directories owned by www-data), or are there any drawbacks? is the best way to figure out how to do it with groups? i think i've probably just not fully understood how the relationships between groups / users works. am i understanding right that if group X is assigned through chown to a directory, any user in the group X should be able to read/write/execute with 775 (regardless of assigned user through chown)?  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_3 on 2015-12-09. Score: 3
  
  I'm not sure if this helps, but here is how I (attempt) to manage deployments/installs.
  
  I first create a user so I'm not using the root account. I tie that user to the apache user group. We'll call him 'user1'.
  
  I use beanstalk to deploy, and the deployment credentials are for 'user1'.
  
  Once all of the files have deployed for the first time, I'll log into the server via terminal, and `chown` the project directory: `chown -R user1:apache`
  
  Next, I'll make sure everything has the correct permissions: `chmod -R 754 mysite.com`
  
  Next, I know that Craft needs to be able to write to:
  
  * /craft/app
  * /craft/config
  * /craft/storage
  
  I will chmod those directories to 774. `chmod -R 774`. Since 'user1' belongs to apache, it can read/write to the appropriate directories.
  
  Hope this helps!
  
  > **Comments:**
  > **username_4**: Probably need to be able to write to any folder you have setup as an asset source as well...  
  > **username_3**: ^ This too... :)  
  > **username_5**: when you say "tie the user to the apache user group"...how do you do that?  
  > **username_3**: @username_5 this part: `chown -R user1:apache`   in this case, I am saying  modify the file/folder so that `user1` is the owner and it belongs to the `apache` group  
  
  ---
  
  