Most secure file permissions after installation

the wiki page shows tips on securing Evolution sites by choosing permissions more wisely.

I tried it but it broke the site. So instead of 600 on config.inc.php i chose 744 to make it work (otherwise the site would show MODx is not installed). Same goes for the files in the cache directory. I suppose it is better than 777 security-wise.

What would be the most minimalistic permissions I need to set on Evolution files, directly after the installation?

I am no unix expert, not even by a long shot. If someone could advise me on this I would appreciate it and update the wiki.

In most cases if your server is configured to use suPHP or some other kind of suexec (where the user is switched from the Apache user to the user who owns the PHP file being executed) the 644 for files and 755 for directories is required. The only thing I try to do is to make the two index.php files (the main one and the manager one) read-only, as well as the manager/includes/config.inc.php file. You may not be able to do that, again depending on your host’s configuration.

The other main point is to be careful when installing third-party add-ons that any files in the upload that are only used to provide the content for the element’s code in the Manager either not end with .php or be removed once you’ve created the element in the Manager and don’t need that content file any more.

When writing your own snippet or other element code, make sure you require an internal constant set in the Manager to be available so that the file can’t be accessed directly.

Subscribe to the security feed or email list.

Thanks for answering my question and even more!

Setting readonly on both indexes worked. I agree though addon files are a risk.

Core snippets typically rely on external files that do nothing by themselves but are only called from their db stored stub. I used to wonder about this but I’ve come to see the security advantage.

Maybe this is sort of a best practice or a design pattern I am not aware of.