0

My client's website is hosted at Digital Ocean and is running Ubuntu 20.04 with Apache. I have WordPress installed and running with some issues. The ability to upload or update plugins and themes is not working because of permission issues. I have been following the official WordPress security hardening article, but I believe some of the changes I have applied have caused the permission issues.

I have detailed all of the current permission settings below for reference. The user for this account is callkneehill.

Root WordPress directory (callkneehill.ca) and files found in /var/www:

  • 755
  • 644
  • Owner and group are callkneehill

wp-admin and wp-include directories and files (recursively applied):

  • 755
  • 644
  • Owner and group are callkneehill

wp-content directories and files (recursively applied):

  • 755
  • 644
  • Owner is callkneehill
  • Group is www-data

plugins and theme directories and files (recursively applied):

  • 755
  • 644
  • Owner and group is callkneehill

With these permissions, WordPress informs me that FTP/SFTP needs to be used to upload/update plugins and themes. Before working with the hardening article, www-data was the sole owner and group for permissions within the WordPress root directory.

If I use www-data on the plugins and themes directory, the same FTP/SFTP notice is displayed when trying to upload or update.

How do I go about configuring the user and group permissions to provide the security hardening with the ability to upload/update within WordPress?

Updated with per-user pool configuration settings

Should chdir be /var/www/callkneehill.ca?

/etc/php/7.4/fpm/pool.d

[callkneehill]
user = callkneehill
group = callkneehill

listen = /run/php/callkneehill.sock
chdir = /var/www

listen.owner = www-data
listen.group = www-data

/etc/apache2/sites-available

<FilesMatch \.php$>
   # SetHandler "proxy:unix:/var/run/php/php7.4-fpm.sock|fcgi://localhost"
   SetHandler "proxy:unix:/run/php/callkneehill.sock|fcgi://localhost"
</FilesMatch>
3
  • Wordpress permissions are a bit of confusing area. I set up as per the Wordpress recommendations, and I think if you want a highly secure install Wordpress can't update itself or install plugins. If you have SSH access I can share a bash script I use that runs the Wordpress CLI nightly to updates wordpress and plugins, and a bash command I use to install plugins.
    – Tim
    Apr 9, 2021 at 19:14
  • Does this answer your question? What permissions should my website files/folders have on a Linux webserver? Apr 9, 2021 at 19:19
  • @AndrewSchulman I have tried what was suggested in the Maintained by a single user section, but the same FTP/SFTP notice is still being displayed when trying to upload or update plugins and themes. Apr 9, 2021 at 19:47

1 Answer 1

0

The core problem might not be the file permissions, but that you are running PHP as www-data instead of running a PHP-FPM pool as user callkneehill. When you run the scripts as the same user that owns them, you don't need this kind of hacks. On a multi-user system this is also essential as it prevents the users from modifying the sites of other users.

There are several tutorials for installing PHP-FPM on Ubuntu 20.04, so there is no need to repeat the instructions here. Therefore, I only give an example on the per-user pool in /etc/php/7.4/fpm/pool.d/callkneehill.conf:

[callkneehill]
user = callkneehill
group = callkneehill

listen = /run/php/callkneehill.sock
chdir = /var/www

listen.owner = www-data
listen.group = www-data

Using the pool from Apache VirtualHost configuration is done by adding a handler that uses the UNIX socket:

<FilesMatch \.php$> 
    SetHandler "proxy:unix:/run/php/callkneehill.sock|fcgi://localhost"
</FilesMatch>
3
  • Thanks for the tips. I have the installation of PHP-FPM scheduled to hopefully resolve this issue. Apr 12, 2021 at 15:01
  • I have implemented PHP-FPM and used your pool code, but when I enable it, my site displays a 503 error. I have updated my question with the code from the respective files. I am new to this, so I don't know the ins and outs. Apr 16, 2021 at 2:49
  • I have fixed the 503 error, but I am still battling the permission issues for WordPress. The callkneehill user is still not owning the directories and files. Any ideas? Apr 16, 2021 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.