Joomla security issues

[Sapph1r3]

Thanks for all the assistance.
The user eventually got back to me.
On attempting to upgrade, the error reads:

Capture.JPG

[tgalati4]

What are the details of the file?

ls -la LICENSE.txt

Either this is the first of many files that you will have problems with, or the permissions of the directory above it may have a permissions/owner issue.

[bab1]

What are the details of the file?

ls -la LICENSE.txt

Either this is the first of many files that you will have problems with, or the permissions of the directory above it may have a permissions/owner issue.

+1 to that.

This is really a Joomla! problem and not a Linux file permissions problem per si. Joomla! requires directory and file permissions that are not acceptable to most Ubuntu installs. It might even be counter to the way Apache should be secured. My understanding is that Joomla itself must be configured correctly to overcome the discrepancy.

I'm suprised when I read the Joomla! documentation. It is not how I would secure an Apache server. If you are in control of the entire Ubuntu server (not a VPS) you might be interested in the Joomla! permissions documentation available here and here.

Here is a pretty good blog post about the problems. Even then it is not what I would do to secure my Apache server. I don't allow the Apache user (www-data) write permissions to the DocumentRoot at all. But that's just me. If the Apache user can only read (and serve) the data it can't be compromised.

Edit: My guess as I'm not a Joomla! or Drupal user is that the problem arises when a person tries to update the system via a web interface using PHP. I think that is a very insecure idea. The person should use backend tools (i.e. SFTP or vsftp) only. In that case I would set the directory permissions at 755 or 775 depending upon whether the users were user:user or user:somegroup. In this scenario the Apache user would always have read access via the other read only permissions. The Apache user does NOT need to be either the user or in the user-group to function correctly.