Being used to using Kohana and Code Igniter frameworks I’m used to having all site files stored above the public_html folder in the folder tree. Except for index.php, images/css etc which must be publicly available and are stored in and below public_html. This means the public can access only files which are meant to be publicly accessed, other are protected within root.
Now I’ve started with MODx it seems all files are stored in public_html, which makes me uncomfortable (or have I set up incorrectly?). Still, I presume this is still secure if the folder permissions are set correctly? Can some enlighten me further please? What are the ideal permissions for folders such as manager and assets?
-
☆ A M B ☆
- 24,524 Posts
It depends on your server configuration. If you are using some kind of suexec for the PHP scripts, then 755 and 644 permissions are adequate; in fact on many shared hosts any other permissions will cause server errors.
Otherwise, php files can be 644, and directories 755, except for directories that will be written to; there are several of these in the assets directory (cache, files, images, export at the least) that can vary depending on what snippets you are using. MaxiGallery, for example, needs a 777 directory "galleries" so it can upload its images. I usually change my index.php files and the config.inc.php file to read-only just to be on the safe side. Most attack vectors to date have targeted the PHP files copy/pasted into the Manager in making the snippet in the Manager for a package (when these are named something like "snippet.code.php", while "snippet.code.txt" is harmless), or on occasion the main site cache file (which must be writable) or the config.in.php file. But this can only be done if someone has cracked the server itself.
The best insurance is backup immediately after installation, then frequently thereafter during development, then more or less often depending on what active snippets/modules are running (to save growing photo galleries, or growing web user/newsletter lists). I always install a backup module immediately after a new installation.
If you’re on a Web-facing server, all the precautions in the world won’t help you if somebody cracks into root access on your server, not even having your scripts out of the web root.
I modified my VPS to have my sftp user and the Apache user belong to the same group, and have my directories and files all set to 770 and 660.
-
MODX Staff
- 12,272 Posts
With Revo, the core can be located outside of public html directory.
Ryan Thrash, MODX Co-Founder
Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
-
☆ A M B ☆
- 24,524 Posts
You could probably add Basic Authentication to the manager directory to protect the entire directory.
lo9on.com
MODx Evolution/Revolution | Remote Desktop Training | Development
-
☆ A M B ☆
- 24,524 Posts
The hacks usually come in from cracked servers; no amount of web access controls will stop that. An intruder with root access can do whatever he wishes across the entire server via ssh or even sftp.
MODX Staff
