Making MovableType more secure

Most shared hosts are running CGI applications, for which MovableType is one, in suexec mode. This means the application is run as your unique username enabling you to write files (i.e “rebuild”) via the interface without having to set your directory permissions too loosely. Why then, is MovableType configured to create folders and write files with global writability? In a perfect world, this might not be a problem – provided the server is configured correctly. But, this isn’t a perfect world and you should take some step to ensure that your directories are secure. Luckily MovableType can easily be configured to write files with stricter permissions.

Here’s what we do….

Within the MovableType configuration (mt.cfg – make a backup of this file just in case you make a mistake) file there are two sections. The first is commented with a strict warning about changing the settings. Since we know what we’re doing (i.e asking MT to write with stricter permissions, see conclusion below for full result or read about file permissions), we’re going to change them. This first section looks like this:

# DBUmask 0022
# HTMLUmask 0022
# UploadUmask 0022
# DirUmask 0022

The “#” before the entries has commented these lines so they are ignored by MT. We want to remove the comment (“#”) and make the four lines appear like:

DBUmask 0022
HTMLUmask 0022
UploadUmask 0022
DirUmask 0022

The next section is usually just below and is preceded by yet another warning. It looks like this:

# HTMLPerms 0777
# UploadPerms 0777

Let’s once again remove the comments and also change the default configuration:

HTMLPerms 0644
UploadPerms 0644

(Optional) While we’re here, lets also find this line and speed up our rebuild times somewhat. (If you start to get errors halfway through your rebuilds, you should come back and add the ‘#’ back in for temp files, but most servers don’t need it.) Near the top we see this:

# NoTempFiles 1

Let’s once again remove that comment:

NoTempFiles 1

Now save the file. In order to get the new permissions to take effect up you will have to delete all of your archives and indexes and then do a full rebuild. Of course, you could just change their permissions manually but it’s up to you. All new entries posted, files uploaded, and archives created will use the new settings by default.

Conclusion: The above changes will ensure that your files are writable by you and you alone. These changes are recommend but, as I already stated, normally not required. I’d only recommend making them if you are comfortable poking in your mt.cfg file and are interested in getting the most out of your MovableType configuration.