hi,

i am trying to set permissions on my wordpress install such that the wordpress admin can write to the files and directories in the wordpress tree. otherwise i have to do all the things wordpress does automatically by hand with vi.

of course i would like to have permissions set as precisely as possible for security.

at present the files are set to 644 (-rw-r--r--). my plan is to change permissions to 664 (-rw-rw-r--) using chmod. ie "chmod -r 664 ./wordpress".

please advise.

To answer your question setting mode 664 may or may not allow apache to write. You will most likely need to chgrp the files to apache as well.

In general it is a bad idea to allow apache to write in the document root, but unfortunately as you see wordpress requires it. I manage linux servers for customers of all sizes from VPSes to 200+ machine installs. I only manage the OS level. They manage the apps. The single biggest exploit vector I see is due to web apps, and the most commonly exploited is wordpress. Sorry for the tangent, but my point is don't just start changing permissions until it works. Google and read a few articles on securing wordpress. Know how and what need exactly which permissions before relaxing file permissions on the server. And be extra vigilant on keeping wordpress updated.

1 members found this post helpful.

ty mweed,

i will go slow and do some homework as you advise. chgrp is a good idea i had overlooked.

As the previous post hinted, you will also need to make sure that the files are in Apache's group (apache on some distros, httpd on others, it's in httpd.conf). You might also want to note whether or not Apache has x on the directories too. IIRC, the recursive option for chmod is -R and not -r.

To the previous poster: Is there a list you could recommend of wordpress vulnerabilities and how to properly secure them? Is it more of a problem from the PHP or the MySQL?

here is a link to a recent post in the wordpress forum describing how mysql was exploited. if you scroll down you will see a few links a moderator recommended reading to prevent it from happening again...

http://wordpress.org/support/topic/385477?replies=43

i am not sure where to begin with what groups should be considered. but apache and httpd. thanks