Hello!
I have installed the module "security review" and it notify me that I have the wrong file permissions.
I have not done any configuration to the file permissions since I recently installed drupal.
My settings
Folder 755 (except for sites/default folder that has 555)
Files 644 (except for settings.php that has 444)
The security review module tells me that everything under sites, modules and themes have the wrong file permissions. (basically the whole drupal installation)
On this site: http://drupal.org/node/244924, you get an explanation on how to set the right file permissions. However I do not fully understand what they want me to do.
Since I on a shared host, first part:
"Note for hosted Drupal installations
It's important to notice that the owner of Drupal's root directories and files is the root user and group is the group your apache is running on. For files and directories inside the sites directory the user who is hosting the site on your server is their owner. The best way to do this is to delete the sites directory and make it a symbolic link to /home or other path you use to store user's home directories."
I do not understand what the security team is recomending me to do. Anyone that can give me a hint or a step to step guide?
Second part
[root@localhost]cd /path_to_drupal_installation
[root@localhost]chown -R greg:www-data .
[root@localhost]find . -type d -exec chmod u=rwx,g=rx,o= {} \;
[root@localhost]find . -type f -exec chmod u=rw,g=r,o= {} \;
"The second command will give ownership recursively on Drupal's root directory for user greg and www-data group. Don't do this if you are in a hosted installation. To the Drupal's root files and directories the user root must be the owner, not greg."
Does that meen I shall only do line 3 and 4, or does it meen that I shall not do this at all when you are on a shared host?
I need some help and advice on what file permission I shall have in order to enhance security of my site.
Best regards
Martin