0

I have an Ubuntu 16.04 Nginx server environment with several (WordPress) webapps under /var/www/html.

My Nginx user is www-data.

Each time I add A webapp, I execute:

chown www-data:www-data /var/www/html/* -R
find /var/www/html/* -type d -exec chmod 755 {} \;
find /var/www/html/* -type f -exec chmod 644 {} \;

It seems that some software (Nginx maybe?) changes permissions so at least some directories (and maybe also their files) are becoming unwritable.

My question is why and how would any software change my permissions and what's the best way to deal with that?

I could add a daily crontask to bring back the aforementioned changes but some might not see that as a "neat" solution and it's best to change any suspicious software itself so it won't "dare" changing these permissions again.

4
  • 4
    a) Nginx doesn't change permissions, something else is doing it, b) your web server generally should not have write access to the files you are serving, especially if it's executed code.
    – jordanm
    Jan 2, 2018 at 6:20
  • What could change them? This environment is most minimal (CSF-LFD, Maldet, Nginx, unattended-upgrades and that's basically it). Jan 2, 2018 at 7:15
  • 2
    WordPress, for one, can manage its own permissions if the web server is able to write to the files. But making files read-only? Maybe you should specify which files are read-only? Jan 2, 2018 at 22:29
  • This is what auditing is made for. (man auditctl to get started.)
    – Jenny D
    Jan 3, 2018 at 14:13

2 Answers 2

0

I had a similar issue with Moodle, however in my case the ownership of the files were changing to root:root also. The files and directories that changed were cache files, and caused issues when upgrading verisons. I finally realized it was actually a bug within Moodle that was changing the permissions, however the ownership issue was due to my httpd process running as root instead of as the apache user. Instructions can be found here for httpd and here for nginx.

I would have to suspect your issue is very similar to mine. It would be very useful if you could provide some specific examples of the files/directories within your WordPress install that are being affected by this issue, and maybe a list of plugins you're currently using. My issue was caused by a bug within a plugin.

0

The issue was caused by another cron command - a WP-CLI command to update the WordPress core. There are also a similar commands to update plugins and themes that might have caused similar issues.

Here are the 3 commands (core, plugins, themes) + 3 commands that run right after them to fix the permission deviations caused by the updates:

for dir in /var/www/html/*/; do cd "$dir" && /usr/local/bin/wp plugin update --all --allow-root; done
for dir in /var/www/html/*/; do cd "$dir" && /usr/local/bin/wp core update --allow-root; done
for dir in /var/www/html/*/; do cd "$dir" && /usr/local/bin/wp theme update --all --allow-root; done
chown www-data:www-data /var/www/html/* -R
find /var/www/html/* -type d -exec chmod 755 {} \;
find /var/www/html/* -type f -exec chmod 644 {} \;

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .