Moodle in English: Security of moodledata directory on linux server

Security of moodledata directory on linux server

by Marius S - Thursday, June 23, 2011, 2:42 PM

Hello,

We have Linux server with Apache, php, mysql. We installed Moodle 1.9.x and 2.x to this server.

In this page it's offered to set moodledata directory Owner 'apache' and set 770 permissions so user and group (in this case apache) will be able to create new files/folders in moodledata directory.

What about files?
Does Moodle modify any files in moodledata directory or it's just create new ones?
What permissions do we need to set on files in moodledata directory?

apache Group need to have permissions to delete files from moodledata if they are deleted in Moodle course?

Thanks.

This forum post has been removed

The content of this forum post has been removed and can no longer be accessed.

Re: Security of moodledata directory on linux server

by Marius S - Monday, June 27, 2011, 2:26 AM

Hello,

You mean not web accessible area, so you can't reach moodledata directory in internet browser, like: http://example.com/moodledata?

If we set user1 as moodledata owner and Apache as group, so we need to set 770 permissions to all directories in moodledata and 660 to all files in moodledata, so then Apache will be able to delete files?

If I have Moodle website in /var/www/html so can I use /var/www/moodledata? I think moodledata won't be accessible because in vhosts.conf DocumentRoot will be /var/www/html, so there is no way to get back to /var/www

Thanks.

Average of ratings: -

Re: Security of moodledata directory on linux server

by Ken Task - Monday, June 27, 2011, 3:19 AM

From what informaton is given, sounds as if you have a virtually hosted "Red Hat layout" apache install. If that is true, the config for apache (typically httpd.conf) probably defines the 'application' (apache or in your case httpd [the actual daemon]) root to be /var/www/.

In that directory one might find a cgi-bin and/or an images folder as well as the 'document root' (html). Any thing in the html folder is served out by apache by default (this is typically where the web pages go - thus moodle as well). Apache (user/group), however, can (or should be able to) at least read (if not write) anything in /var/www/ ... like moodledata.

BUT, the moodledata directory, however, is not directly accessible via anyuser browser URL: http://[yoursite]/moodledata/ as it is NOT located in /var/www/html/ (the document root) and not defined in httpd.conf for apache to be allowed.

Hope that helps!

'spirit of sharing', Ken

Average of ratings: -

This forum post has been removed

The content of this forum post has been removed and can no longer be accessed.

Security and privacy

Security of moodledata directory on linux server