VPS permission setup

[HaCos]

Hello, i have a fresh install in a vps and i am trying to update PS from 1.6.0.8 to 1.6.0.9 via 1-click update but I am getting several server permissions errors. Via ssh i saw that folder & files permissions are the followings:  

 

User : myusername group: apache 

User : Root group: root

 

All the files that have root:root permissions stop the install..

 

So i updated permissions myuser:apache to all files. What i want to know if there is any chance that this may be a security issue? Or if therea are any files that must have only root:root permissions for some resons within a PS install? 

 

Regards,

C

Edited November 18, 2014 by HaCos (see edit history)

[parsifal]

It generally depends on the exact configuration of your webserver daemon and PHP. For example, on my Debian-based VPSes I use a PHP-FPM setup with a separate Linux user account as owner of each website, each PHP process in the website's PHP pool running under the corresponding user account, 755/644 permissions for directories/files respectively. Everything works wonderfully, with no complicated hacks like "assign user X to the www-data group or user www-data to user X group" etc etc.

 

In your case, it sounds like you didn't worsen your security, considering that you are following the normal flow of the Least Privilege principle (you went from "more privileges" to "less") and everything seems to work OK. If you went the other way (you were forced to go to "more privileges" to make your site work), then we would have something to talk about.

Edited November 28, 2014 by parsifal (see edit history)