In an effort to follow the post install file and directory ownership and permissions, it has been nothing but headache after headache trying to implement the recommendations. The recommendations lead to pages not loading and modules not functioning. Can we have a definitive guide that actually works. Post Install Permissions
chown -R www-data .
find . -type f -exec chmod 400 {} \;
find . -type d -exec chmod 500 {} \;
find var/ -type f -exec chmod 600 {} \;
find media/ -type f -exec chmod 600 {} \;
find var/ -type d -exec chmod 700 {} \;
find media/ -type d -exec chmod 700 {} \;
chmod 700 includes
chmod 600 includes/config.phpPerforming a chown . to the apache server has only served to create ownership to directories that it shouldn't own, even on dedicated Magento directories. I'm getting so many bugs and buggy behavior that simply shouldn't even exist. Is the documentation completely batty? A 400 and 500 for permissions appears to lock out functionality in Magento 1.9.x for me and permissions are the only changes being made that are creating problems. Does anyone have a best practices that properly secures Magento, but perhaps isn't so haphazard in the wide number of files and directories that it impacts?
A good example for me is that the front-end "Lost Password" and "Create New Account" stopped working, and it all came down to permissions for /var/app/current/media. After that was fixed, all was completely functional again.
