Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running wordpress site on shared hosting (CentOS). Uploading through wordpress works only if I set upload directory to 777 which is not secure.

The upload directory is owned by user and group psacln ( We use plesk on server).

After googlin around still can't understand what should I do, to enable user upload from wordpress without setting 777 on directory?

Thank you

share|improve this question

3 Answers 3

up vote 2 down vote accepted

The directory needs to be owned by the same user as the PHP process is running. If you're using PHP under apache, this user will generally be apache.

You can check this by checking the user of httpd:

[user@host ~]$ ps aux | grep httpd

You will get an output similar to this:

[user@host ~]$ ps aux | grep nginx
root      4774  0.0  0.3  11204  3288 ?        Ss   12:20   0:00 /usr/sbin/httpd
apache    4776  0.0  0.1  11204  2076 ?        S    12:20   0:00 /usr/sbin/httpd
apache    4777  0.0  0.1  11204  2076 ?        S    12:20   0:00 /usr/sbin/httpd
apache    4778  0.0  0.1  11204  2076 ?        S    12:20   0:00 /usr/sbin/httpd
apache    4779  0.0  0.1  11204  2076 ?        S    12:20   0:00 /usr/sbin/httpd
apache    4780  0.0  0.1  11204  2076 ?        S    12:20   0:00 /usr/sbin/httpd
apache    4781  0.0  0.1  11204  2076 ?        S    12:20   0:00 /usr/sbin/httpd
apache    4782  0.0  0.1  11204  2076 ?        S    12:20   0:00 /usr/sbin/httpd
apache    4783  0.0  0.1  11204  2076 ?        S    12:20   0:00 /usr/sbin/httpd
root      4787  0.0  0.0   5500   716 pts/1    S+   12:20   0:00 grep httpd

Here I am running apache with PHP compiled as a module, so changing the permissions to 'apache' will fix your problem and allow you to reset permissions to 755 or 700 if you're really security conscious:

[user@host ~]$ chown apache /path/to/upload/dir
[user@host ~]$ chmod 755 /path/to/upload/dir

As per your comment, you could add apache and psacln to the same group, change group ownership and chmod it that way

[user@host ~]$ sudo groupadd web  
[user@host ~]$ sudo usermod -G web apache  
[user@host ~]$ sudo usermod -G web psacln  
[user@host ~]$ chgrp web /path/to/upload/dir  
[user@host ~]$ chmod 070 /path/to/upload/dir   

You could also use 575 for rwr permission (owner, group, other)

share|improve this answer
    
Hi, thank you for your answer. One more question, wouldn't changing owner to apache break ftp right ? I mean, wouldn't this cause "permission denied" when user will try to use ftp to upload something to server ? –  Tatica Feb 22 '13 at 10:30
    
You could add apache and psacln to the same group, I have edited my original reply to show this, and this will allow them both rwx access to the same directory. –  sjdaws Feb 22 '13 at 10:38

I'm using this simple script to set all the correct permissions on the file system to keep the WordPress installation as secure as possible, but still allow uploads from the web server.

#!/bin/bash

PATH=/bin:/usr/bin
WEBROOT="/var/www/www.example.org"

UPLOADS="${WEBROOT}/wp-content/uploads"

chown -R nobody:nogroup ${WEBROOT}
find ${WEBROOT} -type d -exec chmod 0555 {} \;
find ${WEBROOT} -type f -exec chmod 0444 {} \;

chown nobody:www-data ${WEBROOT}/sitemap.xml ${WEBROOT}/sitemap.xml.gz
chmod 0464 ${WEBROOT}/sitemap.xml ${WEBROOT}/sitemap.xml.gz

chown -R nobody:www-data ${UPLOADS}
find ${UPLOADS} -type d -exec chmod 2575 {} \;
find ${UPLOADS} -type f -exec chmod 0464 {} \;

If I want to upgrade WordPress or any plugins or themes, I simply run

chmod -R 0777 /var/www/www.example.org

followed by the update. When I'm done with the upgrades I immediately run the first script to set the correct permissions again.

share|improve this answer

Using 777 or adding apache/http/user right and allow files modification is insecure.

Don't allow direct dowload, and use ftp or SFTP access only for upgrade. By this way the website have only a read/execute access on files (if you not do a damn 777 before).

For secure right management use WSD security scanner plugin to test if your WP is secure or not.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.