Quick preface - i'm a new to managing my own servers. I'm on Ubuntu 14.04 running Apache. I ran into some problems setting up Craft which i was hoping someone might be able to shed a bit of light on what i got wrong. I have a user with sudo privileges, lets say 'user1'.

I used a simple PHP script to find out what user PHP is running as:

<?php echo exec('whoami'); ?>

Which came out as 'www-data'. In terminal as 'user1' i created a new group 'craftpermissions' and added 'user1' and 'www-data' to this group. I then set the group 'craftpermissions' as the owner of the following directories:


I then set permissions on those three folders to 775 using:

sudo chmod -R 775 /var/www/myvirtualhostaddress/craft/app/

However when i visited mydomainname.com/index.php/admin/ i still got the error saying php could not write to the /config folder.

In the end i set permissions on the folder to 777 so i could crack on with installation and it worked fine, but i'd like to do it properly as i think 777 is a bit of a no-no? Or does it not matter too much if craft folder is one directory above my web root?

Any guidance much appreciated.


for /craft/app everything is owned by craftpermissions except .. which is owned by the group created when i made user1:

drwxr-xr-x  7 user1 user1 4096 Aug 25 06:44 ..

does this refer to the directory above it? When i run on /craft/storage/ it appears as:

drwxrwxrwx 3 user1 craftpermissions 4096 Aug 25 09:18 .
drwxr-xr-x 7 user1 user1       4096 Aug 25 06:44 ..
drwxr-xr-x 6 www-data   www-data         4096 Aug 25 09:19 runtime.

/craft/config appears as

drwxrwxrwx 3 user1 craftpermissions 4096 Aug 25 09:19 .
drwxr-xr-x 7 user1 user1       4096 Aug 25 06:44 ..
-rwxrwxrwx 1 user1 craftpermissions  671 Aug 25 06:44 db.php
-rwxrwxrwx 1 user1 craftpermissions  220 Aug 25 06:44 general.php
-rw-r--r-- 1 www-data   www-data          255 Aug 25 09:19 license.key
drwxrwxrwx 2 user1 craftpermissions 4096 Aug 25 06:45 redactor
-rwxrwxrwx 1 user1 craftpermissions  844 Aug 25 06:44 routes.php
  • You definitely don't want to run with 777 in a production environment. When you ls -al, what user:group currently owns craft/app, craft/storage and craft/config?
    – Brad Bell
    Aug 25 '15 at 17:19
  • i've edited my post above
    – alexr
    Aug 26 '15 at 9:05
  • You might have to service apache2 restart after adding www-data to the group. If that doesn't work - anything interesting in the Apache logs? Also - any reason why you're not just chown -R www-data:www-data /var/www/myvirtualhostaddress?
    – megatrond
    Aug 26 '15 at 17:57
  • Just to narrow things down if you chown those files to www-data:www-data, do the 755 permissions work then?
    – Brad Bell
    Aug 26 '15 at 20:50
  • i chown'd the /app,/storage and /config folders to www-data:www-data, and set permissions to 755 and it worked fine - thanks for the suggestion. is it ok to do it this way (having directories owned by www-data), or are there any drawbacks? is the best way to figure out how to do it with groups? i think i've probably just not fully understood how the relationships between groups / users works. am i understanding right that if group X is assigned through chown to a directory, any user in the group X should be able to read/write/execute with 775 (regardless of assigned user through chown)?
    – alexr
    Aug 27 '15 at 14:42

I'm not sure if this helps, but here is how I (attempt) to manage deployments/installs.

I first create a user so I'm not using the root account. I tie that user to the apache user group. We'll call him 'user1'.

I use beanstalk to deploy, and the deployment credentials are for 'user1'.

Once all of the files have deployed for the first time, I'll log into the server via terminal, and chown the project directory: chown -R user1:apache

Next, I'll make sure everything has the correct permissions: chmod -R 754 mysite.com

Next, I know that Craft needs to be able to write to:

  • /craft/app
  • /craft/config
  • /craft/storage

I will chmod those directories to 774. chmod -R 774. Since 'user1' belongs to apache, it can read/write to the appropriate directories.

Hope this helps!

  • 1
    Probably need to be able to write to any folder you have setup as an asset source as well... Dec 9 '15 at 20:20
  • ^ This too... :)
    – Damon
    Dec 9 '15 at 20:24
  • when you say "tie the user to the apache user group"...how do you do that? Jun 11 '17 at 1:32
  • 1
    @DavidRhoden this part: chown -R user1:apache in this case, I am saying modify the file/folder so that user1 is the owner and it belongs to the apache group
    – Damon
    Jun 11 '17 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.