<p>I'm not sure if this helps, but here is how I (attempt) to manage deployments/installs.</p>

<p>I first create a user so I'm not using the root account. I tie that user to the apache user group. We'll call him 'user1'.</p>

<p>I use beanstalk to deploy, and the deployment credentials are for 'user1'.</p>

<p>Once all of the files have deployed for the first time, I'll log into the server via terminal, and <code>chown</code> the project directory: <code>chown -R user1:apache</code></p>

<p>Next, I'll make sure everything has the correct permissions: <code>chmod -R 754 mysite.com</code></p>

<p>Next, I know that Craft needs to be able to write to:</p>

<ul>
<li>/craft/app</li>
<li>/craft/config</li>
<li>/craft/storage</li>
</ul>

<p>I will chmod those directories to 774. <code>chmod -R 774</code>. Since 'user1' belongs to apache, it can read/write to the appropriate directories.</p>

<p>Hope this helps!</p>

CC BY-SA 3.0
2015-12-09T20:20:31.527Z
Probably need to be able to write to any folder you have setup as an asset source as well...
RitterKnight
CC BY-SA 3.0
2015-12-09T20:24:35.047Z
^ This too... :)
Damon
CC BY-SA 3.0
2017-06-11T01:32:14.087Z
when you say "tie the user to the apache user group"...how do you do that?
David Rhoden
CC BY-SA 3.0
2017-06-11T14:39:30.963Z
@DavidRhoden this part: `chown -R user1:apache`   in this case, I am saying  modify the file/folder so that `user1` is the owner and it belongs to the `apache` group
Damon
CC BY-SA 3.0
2015-12-09T05:13:49.413Z
2015-12-09T05:13:49.413Z
Damon
<p>Quick preface - i'm a new to managing my own servers. I'm on Ubuntu 14.04 running Apache. I ran into some problems setting up Craft which i was hoping someone might be able to shed a bit of light on what i got wrong. I have a user with sudo privileges, lets say 'user1'. </p>

<p>I used a simple PHP script to find out what user PHP is running as:</p>

<pre><code>&lt;?php echo exec('whoami'); ?&gt;
</code></pre>

<p>Which came out as 'www-data'. In terminal as 'user1' i created a new group 'craftpermissions' and added 'user1' and 'www-data' to this group. I then set the group 'craftpermissions' as the owner of the following directories:</p>

<pre><code>/craft/app/
/craft/config/
/craft/storage/
</code></pre>

<p>I then set permissions on those three folders to 775 using:</p>

<pre><code>sudo chmod -R 775 /var/www/myvirtualhostaddress/craft/app/
</code></pre>

<p>However when i visited <code>mydomainname.com/index.php/admin/</code> i still got the error saying php could not write to the /config folder.</p>

<p>In the end i set permissions on the folder to 777 so i could crack on with installation and it worked fine, but i'd like to do it properly as i think 777 is a bit of a no-no? Or does it not matter too much if craft folder is one directory above my web root?</p>

<p>Any guidance much appreciated.</p>

<p><strong>EDIT</strong></p>

<p>for <code>/craft/app</code> everything is owned by craftpermissions except <code>..</code> which is owned by the group created when i made user1:</p>

<pre><code>drwxr-xr-x  7 user1 user1 4096 Aug 25 06:44 ..
</code></pre>

<p>does this refer to the directory above it? When i run on /craft/storage/ it appears as:</p>

<pre><code>drwxrwxrwx 3 user1 craftpermissions 4096 Aug 25 09:18 .
drwxr-xr-x 7 user1 user1       4096 Aug 25 06:44 ..
drwxr-xr-x 6 www-data   www-data         4096 Aug 25 09:19 runtime.
</code></pre>

<p><code>/craft/config</code> appears as </p>

<pre><code>drwxrwxrwx 3 user1 craftpermissions 4096 Aug 25 09:19 .
drwxr-xr-x 7 user1 user1       4096 Aug 25 06:44 ..
-rwxrwxrwx 1 user1 craftpermissions  671 Aug 25 06:44 db.php
-rwxrwxrwx 1 user1 craftpermissions  220 Aug 25 06:44 general.php
-rw-r--r-- 1 www-data   www-data          255 Aug 25 09:19 license.key
drwxrwxrwx 2 user1 craftpermissions 4096 Aug 25 06:45 redactor
-rwxrwxrwx 1 user1 craftpermissions  844 Aug 25 06:44 routes.php
</code></pre>

CC BY-SA 3.0
2015-08-25T17:19:37.590Z
You definitely don't want to run with 777 in a production environment. When you `ls -al`, what user:group currently owns `craft/app`, `craft/storage` and `craft/config`?
Brad Bell
CC BY-SA 3.0
2015-08-26T09:05:51.027Z
i've edited my post above
alexr
CC BY-SA 3.0
2015-08-26T17:57:16.257Z
You might have to `service apache2 restart` after adding `www-data` to the group. If that doesn't work - anything interesting in the Apache logs? Also - any reason why you're not just `chown -R www-data:www-data /var/www/myvirtualhostaddress`?
megatrond
CC BY-SA 3.0
2015-08-26T20:50:42.227Z
Just to narrow things down if you `chown` those files to `www-data:www-data`, do the 755 permissions work then?
Brad Bell
CC BY-SA 3.0
2015-08-27T14:42:37.413Z
i chown'd the `/app`,`/storage` and `/config` folders to www-data:www-data, and set permissions to 755 and it worked fine - thanks for the suggestion. is it ok to do it this way (having directories owned by www-data), or are there any drawbacks? is the best way to figure out how to do it with groups? i think i've probably just not fully understood how the relationships between groups / users works. am i understanding right that if group X is assigned through chown to a directory, any user in the group X should be able to read/write/execute with 775 (regardless of assigned user through chown)?
alexr
<installation><permissions>
Unix permissions for Craft
# Unix permissions for Craft

(Asked by: username_0 on 2015-08-25)

Quick preface - i'm a new to managing my own servers. I'm on Ubuntu 14.04 running Apache. I ran into some problems setting up Craft which i was hoping someone might be able to shed a bit of light on what i got wrong. I have a user with sudo privileges, lets say 'user1'. 
I used a simple PHP script to find out what user PHP is running as:


Which came out as 'www-data'. In terminal as 'user1' i created a new group 'craftpermissions' and added 'user1' and 'www-data' to this group. I then set the group 'craftpermissions' as the owner of the following directories:
/craft/app/
/craft/config/
/craft/storage/

I then set permissions on those three folders to 775 using:
sudo chmod -R 775 /var/www/myvirtualhostaddress/craft/app/

However when i visited mydomainname.com/index.php/admin/ i still got the error saying php could not write to the /config folder.
In the end i set permissions on the folder to 777 so i could crack on with installation and it worked fine, but i'd like to do it properly as i think 777 is a bit of a no-no? Or does it not matter too much if craft folder is one directory above my web root?
Any guidance much appreciated.
EDIT
for /craft/app everything is owned by craftpermissions except .. which is owned by the group created when i made user1:
drwxr-xr-x  7 user1 user1 4096 Aug 25 06:44 ..

does this refer to the directory above it? When i run on /craft/storage/ it appears as:
drwxrwxrwx 3 user1 craftpermissions 4096 Aug 25 09:18 .
drwxr-xr-x 7 user1 user1       4096 Aug 25 06:44 ..
drwxr-xr-x 6 www-data   www-data         4096 Aug 25 09:19 runtime.

/craft/config appears as 
drwxrwxrwx 3 user1 craftpermissions 4096 Aug 25 09:19 .
drwxr-xr-x 7 user1 user1       4096 Aug 25 06:44 ..
-rwxrwxrwx 1 user1 craftpermissions  671 Aug 25 06:44 db.php
-rwxrwxrwx 1 user1 craftpermissions  220 Aug 25 06:44 general.php
-rw-r--r-- 1 www-data   www-data          255 Aug 25 09:19 license.key
drwxrwxrwx 2 user1 craftpermissions 4096 Aug 25 06:45 redactor
-rwxrwxrwx 1 user1 craftpermissions  844 Aug 25 06:44 routes.php

**Tags:** installation, permissions

> **Comments:**
> **username_1**: You definitely don't want to run with 777 in a production environment. When you `ls -al`, what user:group currently owns `craft/app`, `craft/storage` and `craft/config`?  
> **username_0**: i've edited my post above  
> **username_2**: You might have to `service apache2 restart` after adding `www-data` to the group. If that doesn't work - anything interesting in the Apache logs? Also - any reason why you're not just `chown -R www-data:www-data /var/www/myvirtualhostaddress`?  
> **username_1**: Just to narrow things down if you `chown` those files to `www-data:www-data`, do the 755 permissions work then?  
> **username_0**: i chown'd the `/app`,`/storage` and `/config` folders to www-data:www-data, and set permissions to 755 and it worked fine - thanks for the suggestion. is it ok to do it this way (having directories owned by www-data), or are there any drawbacks? is the best way to figure out how to do it with groups? i think i've probably just not fully understood how the relationships between groups / users works. am i understanding right that if group X is assigned through chown to a directory, any user in the group X should be able to read/write/execute with 775 (regardless of assigned user through chown)?  

---

## 1 answers

### Answer by username_3 on 2015-12-09. Score: 3

I'm not sure if this helps, but here is how I (attempt) to manage deployments/installs.

I first create a user so I'm not using the root account. I tie that user to the apache user group. We'll call him 'user1'.

I use beanstalk to deploy, and the deployment credentials are for 'user1'.

Once all of the files have deployed for the first time, I'll log into the server via terminal, and `chown` the project directory: `chown -R user1:apache`

Next, I'll make sure everything has the correct permissions: `chmod -R 754 mysite.com`

Next, I know that Craft needs to be able to write to:

* /craft/app
* /craft/config
* /craft/storage

I will chmod those directories to 774. `chmod -R 774`. Since 'user1' belongs to apache, it can read/write to the appropriate directories.

Hope this helps!

> **Comments:**
> **username_4**: Probably need to be able to write to any folder you have setup as an asset source as well...  
> **username_3**: ^ This too... :)  
> **username_5**: when you say "tie the user to the apache user group"...how do you do that?  
> **username_3**: @DavidRhoden this part: `chown -R user1:apache`   in this case, I am saying  modify the file/folder so that `user1` is the owner and it belongs to the `apache` group  

---

