0

When I come to uninstall Wordpress plugins I get a message that I need to login in FTP/SFTP to the system. When I fill the right credentials in, Wordpress rejects them.

After some reading I understood I should make my work-user owner and www-data as group (both recursively), to the wp-content library (in which the plugins, themes, and languages libraries are situated).

Well, I did that, and I also gave 777 recursively to all of wp-contnet, just for testing (basic permissions there are 755 to dirs and 644 to files).

Even after that, I am still being asked by Wordpress to login via FTP/SFTP and again Wordpress rejects the right credentials.

cd /var/www/html/example.com
sudo chown $USER:www-data wp-content/ -R
sudo chmod 777 wp-content/ -R

More details (IPs and Usernames ommited):

sudo tail /var/log/apache2/error.log :

0.0.0.0 - - [08/Dec/2016:10:12:39 +0000] "POST /example.com/wp-admin/admin-ajax.php HTTP/1.1" 200 436 "http://0.0.0.0/example.com/wp-admin/plugins.php"

sudo tail /var/log/auth.log :

Dec 8 10:24:34 ubuntu-2gb-fra1-01 sudo: pam_unix(sudo:session): session closed for user root
Dec 8 10:26:36 ubuntu-2gb-fra1-01 sshd[28358]: Invalid user sunil from IP
Dec 8 10:26:36 ubuntu-2gb-fra1-01 sshd[28358]: input_userauth_request: invalid user sunil [preauth]
Dec 8 10:26:37 ubuntu-2gb-fra1-01 sshd[28358]: Connection closed by IP port 37544 [preauth]
Dec 8 10:30:01 ubuntu-2gb-fra1-01 CRON[28571]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 8 10:30:01 ubuntu-2gb-fra1-01 CRON[28571]: pam_unix(cron:session): session closed for user root
Dec 8 10:33:41 ubuntu-2gb-fra1-01 sshd[28658]: Did not receive identification string from IP
Dec 8 10:34:54 ubuntu-2gb-fra1-01 sshd[28659]: Connection closed by IP port 17928 [preauth]
Dec 8 10:35:26 ubuntu-2gb-fra1-01 SUDO USERNAME TTY=pts/0 ; PWD=/var/log ; USER=root ; COMMAND=/usr/bin/tail auth.log

Update 1 - Update for George:

This time I did the following inside the sites' dir, with my primary Ubuntu work-user:

cd /var/www/html/example.com
sudo chown $USER:www-data wp-content/ -R
sudo find . -type d -exec chmod 755 {} \;
sudo find . -type f -exec chmod 644 {} \; 

I went to delete plugins, was asked for the FTP credentials and filled them in (I filled in my same Ubuntu work-user and its password) and still, Wordpress rejects these details and I can't remove plugins from its GUI.

Update 2 - A direction for a solution:

When I first raised up the VPS, I disabled any option to login to the server with passwords. I always login to it with SSH keys (even though I do have a password for my work-user with whom I login). This fact might be associated with the problem I encounter.

In other words, Wordpress wants to use the servers username-passowrd FTP/SFTP authentication but on the other hand, by means of security I disabled password for server authentication when creating the VPS while Wordpress doesn't process SSH keys, so Wordpress kind of shooting itself in the foot with the request for me to login with SFTP (most of the SFTP users I know, including myself, use SFTP at least with SSH keys, but not only with passwords).

4
  • 1
    This problem once happened to me, dunno why, but it seemed WordPress required restarting apache after I gave write permission on the wp-content directory for it to work. If that doesn't work out for you, check the following SO question: stackoverflow.com/questions/17922644/…
    – Dan
    Dec 8, 2016 at 10:50
  • Sadly restarting Apache2 didn't help but regarding the link, you know @Dan , If I add define('FS_METHOD', 'direct'); in wp-config.php --------- Does it have a chance to be re-written / deleted in every Wordpress update?
    – user423047
    Dec 8, 2016 at 11:07
  • No, the wp-config doesn't get changed on upgrades. It's the file that contains all your configs, like db credentials.
    – Dan
    Dec 8, 2016 at 11:28
  • Oh sure, sorry I didn't think of this fact (db credentials inside) when asking; Quite new to the WP hierarchy. Anyway @Dan, I think I found a direction to my problem (please see Update 2 in the question); You are most welcome to share your thought on this.
    – user423047
    Dec 8, 2016 at 11:30

3 Answers 3

0

I could think of two possible solution

  1. Use your login user name and password as FTP user name and password.

  2. Install something like ProFTPD on your machine

Personally, if you operate from dash board and permission are fine ( default ), you could get away with your login user name and passwor.

0

Wordpress from my experience requires you to [install or uninstall] plugins via an ftp program rather than doing so it manually when developing on Ubuntu and that's how I developed with it on my Ubuntu

Now for the permission matter Wordpress doesn't take into consideration the file permissions when [installing or uninstalling] plugins it just insists you use that means to do so. I believe wordpress uses your default or set permissions to write to them as the case may require but when [installing or uninstalling] one has do it that way.

Note: The same isn't the case when done on a live install as this is done behind the scenes.

I believe it's a security feature that ensures that the process is being done by you the owner, hence the need to do it via an authentication app like yours.

And you will need to use your Ubuntu password and username to do so when asked via your ftp application (such as vsftpd or any other). So changing the permissions will only enable wordpress to manipulate those files but not determine how the are added to wordpress.


Even if you are able to sign in to add or remove a plugin and WordPress discovers that you have not set the right permissions on Ubuntu, then that process will not work because wordpress makes changes to folders and files when manipulating a plugin. So WordPress checks two things:

  • Do you have the needed Ubuntu or Linux permissions to actually do so (is the wordpress environment is owned by you) ?
  • Do you have permission to install or uninstall plugins in the current environment (i.e do you have proper Ubuntu file permissions) ?

Both must be in your favor to get it to work as expected. So finally you need to install an ftp application to do Wordpress development on your computer.

9
  • Hi George! Thank you for detailing! The wired thing is that when I inserted the true credentials (which uses me both for SFTP/FTP logins) Wordpress rejected these. I will now double check permissions and try putting in this credentials as well.
    – user423047
    Dec 8, 2016 at 8:15
  • sure please do and let us know how it went. please also note that if you use vsftpd then go here for steps on how it should be set up Dec 8, 2016 at 8:20
  • I've updated the question for you George. BTW, Why would Wordpress ask for SFTP details? In any case these require SSH keys and AFAIK Wordpress doesn't process SSH keys.
    – user423047
    Dec 8, 2016 at 8:53
  • Maybe it's for cases when no keys are used and the SFTP is only username && password.
    – user423047
    Dec 8, 2016 at 8:53
  • great my guess exactly. Noticed that when learning wordpress development that to do it on your computer I needed an ftp program. Dec 8, 2016 at 8:55
0

What worked for me was to do:

Stage 1 - Disable Wordpress's need to ask you for SFTP/FTP credentials:

I find Wordpress's need to ask for SFTP/FTP credentials (IP, username and password) as redundant and a major architecture problem in the program; The reason is that not all people allow password usage for server-authentication. Some people like myself disable it under /home/USERNAME/.ssh/authorized_keys from security/maintenance reasons.

The solution for Wordpress's request for these credentials is to disable it. For that, add this in the end of your wp-config file:

define('FS_METHOD', 'direct');

Stage 2 - Give the right ownership, grouping, and permissions:

sudo chown www-data:www-data wp-content/ -R
sudo find . -type d -exec chmod 755 {} \;
sudo find . -type f -exec chmod 644 {} \; 

Note I did sudo chown www-data:www-data wp-content/ -R instead of sudo chown $USER:www-data wp-content/ -R. The reason is with the first I still couldn't uninstall plugins and Wordpress seem to need www-data as owner as well.


Basically that's it. After you do these actions you finished and can now uninstall plugins or do similar actions. You have a need to restart your server and in this case, if you're using Apache just execute:

sudo service apache2 restart .

I want to thank Dan and George for their help and comments.

You must log in to answer this question.