Windows server 2012 file permissions


#1

Hi all,
Can not seem to find any help on this issue. I have installed piwik from scratch onto an internal windows server 2008 R2 environment.

I am getting the following error message:


Error in Piwik: Piwik couldn't write to some directories  (running as user 'iis apppool\piwik'). Try to Execute the following commands on your server, to allow Write access on these directories: cacls C:\inetpub\piwik\tmp /t /g piwik:f  cacls C:\inetpub\piwik/tmp/assets/ /t /g piwik:f  cacls C:\inetpub\piwik/tmp/cache/ /t /g piwik:f  cacls C:\inetpub\piwik/tmp/logs/ /t /g piwik:f  cacls C:\inetpub\piwik/tmp/tcpdf/ /t /g piwik:f  cacls C:\inetpub\piwik/tmp/templates_c/ /t /g piwik:f  If this doesn't work, you can try to create the directories with your FTP software, and set the CHMOD to 0755 (or 0777 if 0755 is not enough). To do so with your FTP software, right click on the directories then click permissions. After applying the modifications, you can refresh the page. If you need more help, try Piwik.org. 

I have tried the commands listed - and those are met with a permission denied as well.
I have tried giving full permission access to the IUSR (no luck)
any clue what is going on here? I am stuck at step 1! :\

Thanks
Citti


#2

I don’t use Windows Server, and I’m by no means an expert, …

Piwik requires full read/write/modify permission (777 permission) on the “/tmp” directory and all its subordinate files and directories. Initially, it also requires 777 permission on the “/config” directory and its contents. When Piwik has been configured, the “/config” directory can be reset to the normal 755 permission set.

It’s possible that there’s a .htaccess file somewhere in the path leading to the “/tmp” directory or in the “/tmp” directory itself that’s preventing access. A work-around that sometimes works is to delete or rename the existing “/tmp” directory and to then use the FTP software to create a new “/tmp” directory and set the permission to 777 before launching Piwik. Piwik will create whatever directory structure it needs in the “/tmp” directory.


#3

I came into the office this morning and it started magically working?!?!?! ugh I hate when this happens. No clue what actually fixed it.
Like I had said prior I gave the IUSR user full permissions (777 in the unix world) on all files under /piwik/… I have to believe this fixed it and I was just cached or something…
Anyways when I move this to the production machine I will start with a fresh install and see what I run into. Obviously I will not have those permissions in my production environment.

Stay Tuned.
Citti


#4

So as I was going through the rest of the install it was still erroring out. I actually had to the “users” write permission to the config folder. Which is not what I wanted to do. Wondering if anyone else has run into this? and what the work around is? This is an internal test machine at the moment, but will need this resolved before i push to production.

Citti


#6

I haven’t seen this specifically with Piwik but from other IIS experience I think this may be related to the change in the default identity used by application pools introduced in IIS 7.5 (which comes with 2008 R2). As I understand it from IIS 7.5 the application pool by default gets set up to run with its own dynamic account (not IUSR) I understand the account is called “iis apppool\apppoolname” (in your case piwik). At first use (when the apppool starts up) the apppool account is dynamically added to a local group called IIS_IUSRS and removed when the application pool closes.

By giving permissions to “users” I think you will have opened it up to more than just the web site, but will included them by default. I think if you grant the permissions to the group IIS_IUSRS it should work. If you don’t want all IIS applications to have access (but the old IUSR approach would effectivley have done that anyway) then you can assign a specific account to the pool via the IIS manager. I think you can assign permissions to the specifc “IIS apppool\piwik” but I have never tried it as IIS_IUSRS has been fine for what I have done.


#7

Ok so sure enough. We had to reinstall and ran into the same issues again. So had to really really look into what was going on this time. Thanks to GaryR’s thinking above this got me looking into the actual application pools and what was running my piwik website. I have other php applications running on the same server which was fine right? So as i was looking processes being spun up in my task manager i noticed that the piwik application was being created by the default application pool.
WHICH WAS SET to look at a different version of PHP! :stuck_out_tongue:
Went back into IIS -> handler mappings -> and reset the FastCGI Handler to point to the correct version of PHP (which trickles down to the rest of my websites) and BOOM. Fixed.

Lesson learned! and thanks to GaryR for changing my thinking on this issue :slight_smile:

Cheers
Citti