CPanel Permissions? Best practices... and changing it to be correct?

lenatime · 2022-11-18 00:05:51

For some reason the permissions for my Textpattern install, aren’t setup correctly. When I’m logged in, as admin, and try to duplicate a page, I am redirected to a 403 error page. Diagnostics says everything is peachy. This is a new host provider and maybe their permission defaults are different or is this possibly an error with the Textpattern install?

Name Size Last Modified Type Permissions

.well-known 4 KB Oct 3, 2022, 10:15 AM httpd/unix-directory 0755
cgi-bin 4 KB Oct 3, 2022, 8:50 AM httpd/unix-directory 0755
files 4 KB Today, 10:04 AM httpd/unix-directory 0755
images 4 KB Today, 10:04 AM httpd/unix-directory 0755
rpc 4 KB Today, 10:04 AM httpd/unix-directory 0755
textpattern 4 KB Today, 10:04 AM httpd/unix-directory 0755
themes 4 KB Today, 10:04 AM httpd/unix-directory 0755
.htaccess 746 bytes Jan 24, 2022, 4:02 PM text/x-generic 0644
css.php 889 bytes Jan 24, 2022, 4:02 PM text/x-generic 0644
HISTORY.txt 73.86 KB Jan 24, 2022, 4:02 PM text/plain 0644
index.html_ 1.92 KB Oct 3, 2022, 9:18 AM text/x-generic 0644
index.php 2.29 KB Jan 24, 2022, 4:02 PM text/x-generic 0644
INSTALL.txt 3.01 KB Jan 24, 2022, 4:02 PM text/plain 0644
LICENSE.txt 14.81 KB Jan 24, 2022, 4:02 PM text/plain 0644
README.txt 1.12 KB Jan 24, 2022, 4:02 PM text/plain 0644
UPGRADE.txt 3.55 KB Jan 24, 2022, 4:02 PM text/plain 0644

jakob · 2022-11-18 09:06:23

Hi LenaTime and welcome,

As detailed in the installation docs 0755 Orr 0711 should work (but in practice it doesn’t with many hosts*). If the Admin › Diagnostics panel doesn’t complain, your permissions may be okay and the reason may lie elsewhere.

Compare the URL of the 403/404 page you get versus what you have in your site settings. Do they differ? Also check if you are signed in with https:// (with the s). Check if you have anything in your htaccess that might be inhibiting Textpattern. You can compare it against the default .htaccess here.

*On some servers it’s necessary to relax the access rights to either 0775 or 0777 to make them writeable, though it’s sub-optimal (see footnote here).

phiw13 · 2022-11-18 12:59:55

LenaTime wrote #334146:

Diagnostics says everything is peachy.

It is possible that the error is not on your side or Textpattern’s side, but some server configuration is preventing the saving of your actions.

Can you tell us the full error message or does the server only says ‘error 403’?
Do you see the same type of error (& error message) for various actions (e.g simply editing a Form or Page, or writing something on the Write panel)?

–^–

nagging suspicion: mod_security.

gaekwad · 2022-11-18 13:10:17

phiw13 wrote #334149:

nagging suspicion: mod_security.

This.

…and f you’re using Cloudflare: forum.textpattern.com/viewtopic.php?pid=332859#p332859

lenatime · 2022-11-18 14:59:58

Thanks Jakob! Very thorough response and much appreciated.
check – .htaccess (same as the default)
check – https:// (yes on the https)
The 403 page I’m getting is the cpanel error page, I think, because the 403 page URL defaulted to “/textpattern/index.php,” because the 403.shtml is for the public web access (right?).

I don’t know what’s going on. It’s with the Namecheap hosting provider (trying to move away from Godaddy). Their tech support suggested I move my shared domains to the root instead of inside of public_html, but then the SSLs needed reworked. I don’t know if that has anything to do with anything.

I can ADD a page and duplicate it, but I can’t duplicate the “default” page. So now I’m wondering if maybe I’ve been spinning my wheels. Is that intentional? I guess I need to read thoroughly through the documentation. ??

lenatime · 2022-11-18 15:14:30

phiw13 wrote #334149:

It is possible that the error is not on your side or Textpattern’s side, but some server configuration is preventing the saving of your actions.

Can you tell us the full error message or does the server only says ‘error 403’?

Do you see the same type of error (& error message) for various actions (e.g simply editing a Form or Page, or writing something on the Write panel)?

–^–

nagging suspicion: mod_security.

I just responded to Jakob’s response, which might be relevant to your response. It was a 403 permission error message redirect to /textpattern/index.php. I just discovered, however, that I can create a new page and duplicate it. I just can’t duplicate the default page, so now I’m wondering if I’m getting a false error message somehow, and/or if something else is going on. I know with previous Textpattern installs with Godaddy hosting, I was able to duplicate the default page — though not this most recent version of Textpattern. Too many variables…making my head spin. :)

jakob · 2022-11-18 17:58:55

LenaTime wrote #334151:

The 403 page I’m getting is the cpanel error page, I think, because the 403 page URL defaulted to “/textpattern/index.php,” because the 403.shtml is for the public web access (right?).

If the site in question is same domain as your email address, the 404 page (not 403) that is shown there looks to me like a template you are in the process of making rather than a standard server error message page (unless you especially went to the effort of changing it).

I can ADD a page and duplicate it, but I can’t duplicate the “default” page. So now I’m wondering if maybe I’ve been spinning my wheels.

If you mean duplicating the default page template under Presentation › Pages, then yes, you should be able to do duplicate that without any problem. If you mean duplicating a section under Presentation › Sections, you can’t do that for any section, you can only add, delete or edit sections.

Their tech support suggested I move my shared domains to the root instead of inside of public_html, but then the SSLs needed reworked.

The /public_html/ folder is typically the default for the main domain name of your account, so putting any other domains in there alongside it means they can also be theoretically reached via the main domain, which is usually not desired. If you are running several sites from the same hosting package, it’s then better to place other domains alongside the main domain. You can leave that in /public_html/ if you wish.
If you find your Let’s Encrypt SSL certificates are affected by the switch of directory, you should be able to re-request them without any problem.

lenatime · 2022-11-18 20:12:25

phiw13 wrote #334149:

It is possible that the error is not on your side or Textpattern’s side, but some server configuration is preventing the saving of your actions.

Can you tell us the full error message or does the server only says ‘error 403’?

Do you see the same type of error (& error message) for various actions (e.g simply editing a Form or Page, or writing something on the Write panel)?

–^–

nagging suspicion: mod_security.

mod_security?
I’ve installed Textpattern in a couple of domains, and subdomains, and it has happened with each install (getting a 403 permission error when trying to duplicate the default page in presentation).
I think something happened to the permissions when I moved these websites to the root directory and reinstalled the SSLs. Maybe? I think I’m going to put this back onto Namecheap. Or find an analytics tool to help me sort this out. Namecheap told me my permissions were all messed up too. And I have no idea how. All I’ve done is create addon domains, install the SSLs, and use Cpanel’s software installation tool to install Textpattern, or FTP simple bootstrap websites to their respective domains.

Last edited by lenatime (2022-11-18 20:28:59)

lenatime · 2022-11-18 20:27:29

jakob wrote #334153:

If the site in question is same domain as your email address, the 404 page (not 403) that is shown there looks to me like a template you are in the process of making rather than a standard server error message page (unless you especially went to the effort of changing it).

If you mean duplicating the default page template under Presentation › Pages, then yes, you should be able to do duplicate that without any problem. If you mean duplicating a section under Presentation › Sections, you can’t do that for any section, you can only add, delete or edit sections.

The /public_html/ folder is typically the default for the main domain name of your account, so putting any other domains in there alongside it means they can also be theoretically reached via the main domain, which is usually not desired. If you are running several sites from the same hosting package, it’s then better to place other domains alongside the main domain. You can leave that in /public_html/ if you wish.
If you find your Let’s Encrypt SSL certificates are affected by the switch of directory, you should be able to re-request them without any problem.

No, it’s not installed on telossi.com, it’s at ecentech.com, which is just a prototyping spot for now. I’m going to contact Namecheap and see if they can spot anything or help me out. I didn’t change any permissions prior to installing Textpattern. Not finding this issue either after installing Textpattern on my Godaddy hosting service.
Good to know why the root is a better place for other domains. Insofar as I can tell, moving the domains and reinstalling SSLs (albeit a hassle) are correct and seem to be working properly. Not seeing any error messages pertaining to those. Not seeing any error message pertaining to this 403 permission error, except when trying to create a duplicate default page under presentation. I’m concerned my permissions aren’t correct, however, and I’ll run into this again, eventually.

phiw13 · 2022-11-19 01:21:51

LenaTime wrote #334154:

At least from your further comments your issue looks far less dramatic that a first impression…Good.

mod_security?

mod_security is a module for Apache for managing security of the server. It does this by preventing some types of transactions or scripts. In some configurations it has been known to interfere with the working of Textpattern.

[…] and use Cpanel’s software installation tool to install Textpattern

Just to be clear, you installed Textpattern through Cpanel? That might be the reason for some hiccup or misconfiguration. I vaguely remember another user upgrading a Textpattern installation through Cpanel and having some odd issues.

Can you install / upload Textpattern with a FTP client (Transmit, FileZilla, …)? Be sure not to overwrite the images and files folders if you already have uploaded images or files, and don’t delete the config.php file inside the textpattern folder.

lenatime · 2022-11-19 07:15:33

phiw13 wrote #334156:

LenaTime wrote #334154:

At least from your further comments your issue looks far less dramatic that a first impression…Good.

mod_security is a module for Apache for managing security of the server. It does this by preventing some types of transactions or scripts. In some configurations it has been known to interfere with the working of Textpattern.

Just to be clear, you installed Textpattern through Cpanel? That might be the reason for some hiccup or misconfiguration. I vaguely remember another user upgrading a Textpattern installation through Cpanel and having some odd issues.

Can you install / upload Textpattern with a FTP client (Transmit, FileZilla, …)? Be sure not to overwrite the images and files folders if you already have uploaded images or files, and don’t delete the config.php file inside the textpattern folder.

Thanks. Should I just start over from scratch, not using cPanel at all? This host provider, Namecheap, uses “Softaculous apps installer” whereas Godaddy uses “Installatron app installer.” I simply do not have this problem when installing Textpattern through my Godaddy host service, using Installatron (stupid names). Why is there a difference? What is the difference? Is the difference a security concern? I like Namecheap. I would prefer to do business with them over Godaddy, but this is a problem. I have several clients I’m trying to move off of WordPress, to something much better, like Textpattern.

Though, I can live with installing Textpattern outside of cPanel. For the future life of Textpattern, if this is indeed a reason why I have run into ‘this’ particular issue, is there, shall we say, a global fix, so it can be successfully installed through cPanel?

I’ll try the other way of installing Textpattern and report back.

Thank you for your expertise.

lenatime · 2022-11-21 00:16:21

phiw13 wrote #334156:

LenaTime wrote #334154:

At least from your further comments your issue looks far less dramatic that a first impression…Good.

Just to be clear, you installed Textpattern through Cpanel? That might be the reason for some hiccup or misconfiguration. I vaguely remember another user upgrading a Textpattern installation through Cpanel and having some odd issues.

Can you install / upload Textpattern with a FTP client (Transmit, FileZilla, …)? Be sure not to overwrite the images and files folders if you already have uploaded images or files, and don’t delete the config.php file inside the textpattern folder.

p.

Last edited by lenatime (2022-11-21 00:20:57)

Textpattern CMS

Textpattern CMS support forum

#1 2022-11-18 00:05:51