In my previous tutorial for installing Wordpress on a Raspberry Pi, I showed how to do a "quick and dirty" installation, by changing ownership of the whole Wordpress installation folder to the web server process (www-data). This gets the job done, because Wordpress is able to make changes to its own configuration files, themes and plugins. However, giving Apache the ability to modify the scripts it is executing is inherently insecure - a security flaw in one script could allow an attacker to make WordPress download a new script and execute it (like installing a new plugin), or modify an existing script for some malicious purpose. This tutorial will show you how to set up a local FTP server and change the ownership of your WordPress files to some other user (not www-data). When WordPress wants to modify one of these files, it must ask for that user's password and log in to the FTP server to make the changes, instead of having write access to absolutely everything without any checks in place.

File permissions and Ownership

Let's have a look at the current ownership and file permissions of the Wordpress files. You could use ls -l to do this, but it is a bit tedious because it doesn't list recursively so you's have to inspect each directory in turn. Instead, we'll use the tree command to will list all of the files in the /var/www directory and one subdirectory within it, showing file permissions and ownership. Assuming your Wordpress files are installed in Apache's root directory /var/www:

tree -L 2 -puga /var/www

NB: you may have to install tree first:

sudo apt-get update
sudo apt-get install tree

Ownership

To stop Apache from being able to modify Wordpress files on its own, we will set the files as owned by an existing system user. I'm going to use the username "pi" as an example - swap it for the username of the person who owns the site (e.g. for my brother's site tomhobbs.co.uk this was "tom").

sudo chown -R pi:pi /var/www

Now all of the files are owned by a user other than www-data, WordPress can't make changes to its own files. However, we do want Wordpress to be able to upload image files to /wp-content/uploads, so let's change the ownership of this directory back to www-data:

sudo chown -R www-data:www-data /var/www/wp-content/uploads

If you want to use the in-browser theme editor, you also need to allow Apache to write to /wp-content/themes. If you don't think you'll use the theme editor then don't do this:

sudo chown -R www-data:www-data /var/www/wp-content/themes

Some plugins may require write access to your .htaccess file (this is the override file for the Apache settings set in your Apache config and VirtualHost file for the site). One example of a plugin that does this is iThemes Security (formerly "Better WP Security"), which can do lots of fancy things like blocking IP addresses that make too many failed login attempts. If you want to use these capabilities, you need to set the .htaccess file (/var/www/.htaccess) to be owned by www-data... be careful though, I experienced some problems with the plugin where it tried to make lots of writes to the .htaccess file in a short period of time and ended up corrupting it, resulting in a 500 - internal server error.

Permissions

Now is a good time to check that your permissions are correct too. Assuming your Wordpress files are stored at /var/www/, the following command will change the permissions for all directories to 755 - (permission to "execute" a directory is required to list what is inside it; so 755 means everyone can read the files inside but only the owner can modify the directory).

sudo find /var/www/ -type d -exec chmod 755 {} \;

This command modifies the permissions for all files to 644 (everyone can read them, only the owner can modify them):

sudo find /var/www/ -type f -exec chmod 644 {} \;

FTP access

The changes we have made mean that WordPress can still upload image files to a specific directory, but it can no longer update itself and you can't install new plugins through the admin backend. Now we need to set up a local FTP server so that Wordpress can ask you for your system username and password and then use the credentials to log in to the FTP server to make its changes. I'm assuming that your server is behind a router with a firewall. This stage enables a FTP server on your Pi which will be accessible on your LAN. If you forwarded port 21 to the server on your router (don't!), anyone on the internet could access the server and you'd be hammered by bots trying to crack your password. If you are behind a router you'll be fine, but it's something worth bearing in mind. The FTP server we are going to use is called "Very Secure FTP Daemon" (VSFTPD). Install it like so:

sudo apt-get install vsftpd

The config file for vsftpd is at /etc/vsftpd.conf. Open it and uncomment the following line to tell VSFTPD to check usernames and passwords against the list of system users in /etc/passwd with PAM:

local_enable=YES

Also uncomment this line to allow authenticated users to write to the filesystem (default is read-only):

write_enable=YES

This is not a necessary step and won't even be used by WP, but you might as well do now because it's quick: if you have your own SSL certificate then you can override the deafaults to the location of your cert and its key file:

rsa_cert_file=/etc/ssl/certs/samhobbs.crt
rsa_private_key_file=/etc/ssl/private/samhobbs.key

If you don't have an SSL cert you can just use the default "snakeoil" certificate (leave the config file as it is) or use my CAcert tutorial to generate one yourself and get it signed for free. Now restart the FTP server:

sudo service vsftpd restart

That's it for FTP :)

Tell Wordpress to use FTP

Now all that's left is to tell WordPress to ask you for FTP credentials when it can't modify files itself. Open your WP config file at /var/www/wp-config.php and add these two lines at near the end of the file but above the line /* That's all, stop editing! Happy blogging. */. They tell Wordpress to connect to the local FTP server, and use the username "pi":

define( 'FTP_HOST', 'localhost' );
define( 'FTP_USER', 'pi' );

This is what you will see when you need to update a plugin: Cool eh? You can use a plain FTP connection because your password isn't sent over an unencrypted network - the FTP server is local, so it's all internal. While you're in your wp-config.php this file, you may also want to add this option to force administrative actions to be conducted over SSL (HTTPS).

define('FORCE_SSL_ADMIN', true);

That's it! Let me know if you run into difficulty.