# Mattermost security

**URL:** <https://forum.mattermost.com/t/mattermost-security/10013>\
**Category:** Troubleshooting\
**Created:** [June 24, 2020, 4:18pm UTC](https://forum.mattermost.com/t/mattermost-security/10013 "2020-06-24T16:18:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![egoitzr](https://avatars.discourse-cdn.com/v4/letter/e/ccd318/32.png) [@egoitzr](https://forum.mattermost.com/u/egoitzr)\
**Post date:** [June 24, 2020, 4:18pm UTC](https://forum.mattermost.com/t/mattermost-security/10013/1 "2020-06-24T16:18:54Z")

</div>

Hi,

Does Mattermost server, need permissions for read and write in other directories than the data directory and the config directory?.

I was planning to improve our server security. As it’s opened to Internet I think it could be idea to do a :

chown root:root /mattermostdir  
chown mattermost:mattermost /mattermostdir/datadir

I assume it does not need full permissions in all it’s directory… does it?.

Does another security advise, be convenient having in mind too?. We run Nginx in front of Mattermost too…

Your opinion would be highly appreciatted,  
Cheers!

---

<div class="post-metadata">

**Author:** ![ahmaddanial](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/ahmaddanial/32/2938_2.png) [@ahmaddanial](https://forum.mattermost.com/u/ahmaddanial)\
**Post date:** [June 26, 2020, 1:47am UTC](https://forum.mattermost.com/t/mattermost-security/10013/2 "2020-06-26T01:47:23Z")

</div>

Hello, @egoitzr

As mentioned in step 6b in the [Installing Mattermost Server](https://community.mattermost.com/core/pl/1kmz5swy6pyaxxo8pb1qiqafby) documentation, the ownership of the `mattermost` user needs to be granted to the `/opt/mattermost` directory (assuming that it was installed in the default directory mentioned in the doc).

In your case, you will need to grant ownership to the `mattermostdir` directory to the `mattermost` user. Else, you will encounter the `permission denied` error in the `mattermost.log` when you attempt to perform some actions from the UI (eg. uploading plugin).

Besides setting up a proxy, you can read more about Mattermost security in the [Security Overview](https://docs.mattermost.com/overview/security.html) page which includes the authentication, transmission, and many more.

---

<div class="post-metadata">

**Author:** ![egoitzr](https://avatars.discourse-cdn.com/v4/letter/e/ccd318/32.png) [@egoitzr](https://forum.mattermost.com/u/egoitzr)\
**Post date:** [July 1, 2020, 12:53pm UTC](https://forum.mattermost.com/t/mattermost-security/10013/3 "2020-07-01T12:53:45Z")

</div>

Thank you so much ahmaddanial!!