Correct permissions of Files and Directories before and after installation?

[VipulK]

Hi,

I'm trying to install Magento 1.9.2 and getting 403 forbidden error at the installation page. What are the correct permissions for files and directories during the installation and keep the store secure after installation?

Thanks

EDIT: I'm getting a 500 Internal Server error if i use 777 for Directories and 777 for Files; And I get 403 Forbidden error if I use 700 for Directories and 600 for Files

[VipulK]

Please help me, I can't install the **bleep** thing. What are the correct permissions?

[Conor_Tomkins]

Hello,

Post a link, let me have a look.

Sounds to me that there are more than permission errors at work here.

Cheers

[theMageComp]

@VipulK

Upload this Magento Cleanup PHP file in the root of your Magento and execute it. You'll have necessary permission and permission related issues will be fixed.

http://pastebin.com/bah8gxmv

[VipulK]

@theMageComp I got the 500 error on the file as well. BTW the file had the permission of 644 by default, I tried 755 but that gave the same error as well.

@Conor_Tomkins You can access the installlation at http://store.bwdmedia.in. Hope it helps

[theMageComp]

Hello @VipulK

Make sure there is no maintainance.flag file in the root of the Magento installation. If so, delete or rename it.

Also make sure you have make the correct configuration in local.xml file.

[Conor_Tomkins]

Hello,

Without access this is pretty much a guessing game!

But, try renaming your .htaccess to .htaccess.old

It appears there may be somthing in the default .htaccess which isn't playing nicely with your server.

See if renaming the .htaccess makes any difference & if so, we have a starting point.

[chiefair]

EDIT: I'm getting a 500 Internal Server error if i use 777 for Directories and 777 for Files; And I get 403 Forbidden error if I use 700 for Directories and 600 for Files

As you should, the evil 777 should never be used on a live server and will be prevented on a shared server for obvious reasons (who wants global rights in a shared environment?)

777 = User full, Group full, Everyone full rights to muck with stuff.

You will need to see if your server accepts 770 and 660 for directories and files as cPanel/WHM and other security setups will restrict permissions to User and Group only being able to have read/write/execute and  read (4) for global.

As to needing 777 for Magento Connect usage, if it's truly going to need the rights that wide open, you will not be able to use it to install or upgrade.

Your issue likely is you're trying to run this on a web hosting service that runs the web server as a different user from the login user. This is why there is the advice floating around there to set permissions to 777 if you're going to use Connect, it needs to be able to overwrite every file that was login user created and it can't because it's running as user www-data, nobody or similar. It doesn't have the permissions to do that unless given global read/write/execute.

How you're going to fix it? Talk to your hosting provider... If this is on a machine you control, then you need to set up group rights so you and the server are in the same group.

https://www.sonassi.com/knowledge-base/stop-magento-permissions-errors-permanently/

https://blog.nexcess.net/2010/12/06/securing-magento-file-directory-permissions/

[MagenX]

you probably have some weird cPanel suPHP setup,

find . -type f -exec chmod 644 {} \;
find . -type d -exec chmod 755 {} \;

but find out who is your web server owner, user name, like "nobody" or go to /home and check who owns your "public_html" folder.

anyway you must find your error log, and see exact error.

[VipulK · Accepted solution]

Wow, lot's of responses here. I'll try to return as much information as possible.

@theMageComp There's no maintenance file, I've uploaded a fresh copy of Magento files and I don't know what to look for in local.xml and where to look for it either. It's not there by default, right?

@Conor_Tomkins I don't have any htaccess in the root (public_html) and i renamed the htaccess file in the Magento directory, Now it throws a 404 error

@chiefair I'm on a VPS. And I contacted the hosting company and they changed the permissions to 755 for directories and 644 for the files and I was able to reach the installation screen.

So I guess 755 and 644 are the correct permissions before the installation