Hi,
Using Moodle 3.8, LAMP stack on a VPS. Permissions:
When I try to install plugins from the Moodle.org repositories, I get a file permissions error, presumably because the owner is root & www-data (Apache) is doing the install.
I'd like to know what the most secure/recommended permissions are to enable installing plugins via Moodle.org repositories. I'm fine with making the changes via the CLI.
Thanks in advance!
Matt
You are correct in that www-data (either user or group) needs write access to code directories where plugins are to be installed. If running a dedicated moodle and no other apps run under www-data group one could do owner (www-data) read/write on all files/directories in code ... might change only one ... config.php ... if PHP ever gets broke and folks see that config.php is wgetable ... and if in config.php you've used same user/pass as DB or ssh to your server (yes, some do for ease of use) server could be compromised rather easily.
Can run your site as paranoid as you like, but, I, for one, do kinda like 'deploy' for plugins from Moodle plugins.
You could allow only certain directories that deploy would check/use ... mod, blocks, theme, report etc. and then the others could be in 'paranoid mode'.
How about this (above) for a 'dis-calming response'!
My 2 cents.
'SoS', Ken
Thanks Ken & Visvanath
Until now, as you can see, I've been happy to download, unzip, upload & install plugins manually & keep security settings as strict as possible. So far so good.
Now, I've reached the limits of what I can do with the Quiz module & other activities & I want to install the H5P activity plugin. H5P in turn, auto-installs question types as & when they're needed (the last time I checked). That's the main reason I want to relax the restrictions on directories & files but as little as possible.
From what you've said, I'm guessing I can just: chown -R root:www-data /moodle/mod/ then change the permissions as per the bash script?
And thanks for the bash codes Visvanath!
How does that sound?
Thanks again!
Re: re-using passwords, I never do it. I always use a secure, encrypted password manager to generate & store strong, unique passwords
# find /path/to/moodle/subdir -type d -exec chmod 770 {} \;
# find /path/to/moodle/subdir -type f -exec chmod 660 {} \; # find /path/to/moodle/subdir -type d -exec chmod 750 {} \;
# find /path/to/moodle/subdir -type f -exec chmod 640 {} \; Ya know ... if developers of plugins could be encouraged to follow a standard for their git branches ... moodle could use those branches.
Added to a bash shell script for updating could be the lines for setting appropriate directories for plugin updates (open), then pulling core via git, pulling plugin updates via git, updating, and lastly, put site back to lockdown (closed).
And and all of that could be an un-official plugin in /local/ with requirements for restricting access to admin levels. Would never need updating itself cause there are no rows to add to tables - no version updating either. Doesn't show in system admin menu links.
And atop all that a few more lines to do a minimal backup of site ... code + DB dump + moodledata/filedir.
That's just updating .... upgrading to higher version of Moodle would mean similar script for one time use.
Maybe by 4.x?
'SoS', Ken
Hi Howard,
Yess, good advice. I feel uneasy with those on my personal Moodle. I've installed everything I need to & have changed them back to 'paranoid' mode.
Thanks again for the advice!
