We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

CHMOD on config.inc.php

    • 37042
    • 384 Posts
    eladnova Reply #1, 14 years, 5 months ago
    Just wondering what the CHMOD permissions should be on core/config/config.inc.php in Revo
    Thanks
      ...
      • 28945
      • 12 Posts
      Susann Reply #2, 14 years, 5 months ago
      If everythings works 644 is safe.
        • 15953
        • 123 Posts
        kirkhuyser Reply #3, 14 years, 5 months ago
        I found message earlier that recommends 600 for certain security reasons that I can't remember. I was researching this because BobsGuides said make it writable, but there are a whole slew of settings that make it writable.
          • 18373 ☆ A M B ☆
          • 3,141 Posts
          Mark Hamstra Reply #4, 14 years, 5 months ago
          600 works, but so does 644. As long as it aint hugher than 644.

          I think 600 blocks out viewing the file through the webserver (like, browsing the core dir in a browser), but obviously youmoved your core dir out of the webroot which makes that moot smiley
            Mark Hamstra • Developer spending his days working on Premium Extras and a MODX Site Dashboard with the ability to remotely upgrade MODX and extras to make the MODX world a little better.

            Tweet me @mark_hamstra, check my infrequent blog at markhamstra.com, my slightly more frequent ramblings at MODX.today or see code at Github.
            • 28042 ☆ A M B ☆
            • 24,524 Posts
            sottwell Reply #5, 14 years, 5 months ago
            These are operating system file permissions and have no bearing on the web server behavior. To deny access to a file being viewed directly from the browser (via an HTTP request) use the .htaccess file. 

            <Files config.inc.php>
order deny,allow
deny from all
</Files>


            File permissions determine whether or not the web server (who is treated as a user) can access the file at all.

            600 means only the owner of the file can read (view) or write the file. This will only work if PHP is being run with some type of su_exex.

            Ordinarily a script (.php) is run as the user that called the script; in our case it would be the user the Apache (or other web server) is running as. That means that with 600 permissions, the file is owned by your user (FTP or CPanel user) and the web server can't read the file. In this situation, permissions need to be 644. The last number of the three indicates "other", or a user other than the owner (the second number indicates "group").

            If the server is configured to run .php through some kind of su_exec (Switch User execute) then the user is switched to the owner of the .php file instead of the web server user. In that case 600 would be great, as the owner can read/write the file but nobody else can even see it.
              Studying MODX in the desert - http://sottwell.com
              Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
              Join the Slack Community - http://modx.org