Mediawiki/Hardening - Revision history

R00t: /* remove database password from LocalSettings.php */

2014-10-12T05:49:57Z

‎remove database password from LocalSettings.php

R00t at 05:29, 12 October 2014

2014-10-12T05:29:18Z

R00t at 04:33, 12 October 2014

2014-10-12T04:33:25Z

R00t: Created page with "==Disable user self registration== Add the following to LocalSettings.php # Prevent new user registrations except by sysops $wgGroupPermissions['*']['createaccount'] = false;"

2014-10-12T04:32:20Z

Created page with "==Disable user self registration== Add the following to LocalSettings.php # Prevent new user registrations except by sysops $wgGroupPermissions['*']['createaccount'] = false;"

New page

==Disable user self registration==
Add the following to LocalSettings.php
# Prevent new user registrations except by sysops
$wgGroupPermissions['*']['createaccount'] = false;

@@ Line 14: / Line 14: @@
                  # If you've other scripting languages, disable them too.
   </Directory>
-==remove database password from LocalSettings.php==
+==remove security variables from LocalSettings.php==
-Its not a good idea to have the database password within a file that lives in the document root.  Should a problem happen, like php crashes, and php files can be downloaded or served in plain text, you've just had your security compromised.<br>
+Its not a good idea to have the security variables within a file that lives in the document root.  Should a problem happen, like php crashes, and php files can be downloaded or served in plain text, you've just had your security compromised.<br>
 Start by creating a folder and file that lives outside of the document root and its children.  For example, if your document root is <code>/var/www/</code> then you'll want to do something like this:
   ~$ sudo mkdir /var/security/
   ~$ sudo chown www-data:www-data /var/security
   ~$ sudo chmod 644 /var/security
-  ~$ sudo vi /var/security/passwords.php
+  ~$ sudo vi /var/security/secure.php
-  ~$ sudo chown www-data:www-data /var/security/passwords.php
+  ~$ sudo chown www-data:www-data /var/security/secure.php
-  ~$ sudo chmod 644 /var/security/passwords.php
+  ~$ sudo chmod 644 /var/security/secure.php
 Now with the files created, modify LocalSettings.php and add:
   #including separate file that contains the database password so that it is not stored within the document root.
-  require_once "/var/security/passwords.php";
+  require_once "/var/security/secure.php";
 Finally, within the new file we've created outside of the document root, define your variables that Mediawiki still needs, such as:
   $wgDBpassword =
   $wgSecretKey =

← Older revision		Revision as of 05:29, 12 October 2014
Line 14:		Line 14:
	# If you've other scripting languages, disable them too.		# If you've other scripting languages, disable them too.
	</Directory>		</Directory>
		+	==remove database password from LocalSettings.php==
		+	Its not a good idea to have the database password within a file that lives in the document root. Should a problem happen, like php crashes, and php files can be downloaded or served in plain text, you've just had your security compromised.<br>
		+	Start by creating a folder and file that lives outside of the document root and its children. For example, if your document root is <code>/var/www/</code> then you'll want to do something like this:
		+	~$ sudo mkdir /var/security/
		+	~$ sudo chown www-data:www-data /var/security
		+	~$ sudo chmod 644 /var/security
		+	~$ sudo vi /var/security/passwords.php
		+	~$ sudo chown www-data:www-data /var/security/passwords.php
		+	~$ sudo chmod 644 /var/security/passwords.php
		+	Now with the files created, modify LocalSettings.php and add:
		+	#including separate file that contains the database password so that it is not stored within the document root.
		+	require_once "/var/security/passwords.php";
		+	Finally, within the new file we've created outside of the document root, define your variables that Mediawiki still needs, such as:
		+	$wgDBpassword =
		+	$wgSecretKey =

← Older revision		Revision as of 04:33, 12 October 2014
Line 3:		Line 3:
	# Prevent new user registrations except by sysops		# Prevent new user registrations except by sysops
	$wgGroupPermissions['*']['createaccount'] = false;		$wgGroupPermissions['*']['createaccount'] = false;
		+	==Uploads Dir security==
		+	add to the bottom of your Virtual site config, before you close it:
		+	<Directory /var/www/yoursite.com/wiki/images/>
		+	# Ignore .htaccess files
		+	AllowOverride None
		+	# Serve HTML as plaintext, don't execute SHTML
		+	AddType text/plain .html .htm .shtml .php
		+	# Don't run arbitrary PHP code.
		+	php_admin_flag engine off
		+	# If you've other scripting languages, disable them too.
		+	</Directory>