Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have several folders with Magento installations.

e.g.

www/magento1 www/magento2

All of the files/folders inside of those are owned by root:magento1 and root:magento2 respectively.

I have 3755 perms for all folders, 644 for all directories to start with. That prevents anyone but root from writing to any folder or file.

Then I add in group write permissions for folders/files devs should be able to write to. E.g. they cannot write to core files, but they can write to module/skins that are non core.

That's all fine. The only thing that's not fine is that I don't want them to be able to read the mysql database username/password from magento1/app/etc/local.xml. I don't want them to have access to the database, where sensitive information is stored. I also don't want a rogue programmer to delete a bunch of tables or what have you.

But apache needs to have read access to that same file.

Here's a "solution" that doesn't work: Remove read permissions from group but leave them for others. Why? Because that prevents devs from reading from their app/etc/local.xml, but allows them to read all the others.

What do I do?


EDIT: Yes, devs = developers and they will have SSH and FTP access.

share|improve this question
    
Its really simple. If a file is marked as being read by an user, then they can view the contents of the file, the answer is make the user that runs apache different then any other user account. Place the user in its own group since you also don't wnat that user to have the same rights as root but more then simple read access in some cases. –  Ramhound Sep 14 '12 at 11:08

2 Answers 2

up vote 2 down vote accepted

Assuming that, like under Debian, the apache runs as user www-data and group www-data, the solution is

chown www-data:www-data www/magento1/app/etc/local.xml
chmod 440 www/magento1/app/etc/local.xml

The root user can always read and write all files.

share|improve this answer
    
That's is basically the solution I've ended up using. –  Buttle Butkus Sep 18 '12 at 6:32

Assuming devs=developers...

Whats not explained in which way devs are accessing the system - ssh? ftp?

if it is only ftp access you could possibly exclude config file from serving/showing via ftp.

Alternatively you could possibly run apache under certain username (usually it is setup to work as nobody, sometimes as user holding account). If you allow "others"/"world" to read it everyone can read it. So you go other way - make it readable only to user, and set user ownership to apache user, and completely close group and other's access. In this way apache is happy reading it while noone other user can (save root). You'd need though to mimic yourself to that user if you want to make intervention on a file. E.g. su - username

share|improve this answer
    
ia apache is running as "root" (which is btw considered bad practice for apache config) then database config file shall be owned by root and only readable to root user (go-rwx or 400) theoretically if apache is running as root you could also set 000 because root shall be able to read it anyway. –  ljgww Sep 14 '12 at 4:41
    
no apache is not running as root. It's running as apache:apache (user:group) –  Buttle Butkus Sep 18 '12 at 6:30
    
then make file readable by apache:apache only chown apache:apache local.xml and then chmod 400 local.xml to be readable by apache only. Ahh I see someone already have said that. :) –  ljgww Sep 18 '12 at 20:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.