We recommend you don't take security issues too lightly. Chamilo is security-audited at least once a year, but you're never too sure. This list is a work in progress. Feel free to recommend additional measures by sending us an e-mail at info@chamilo.org.
Contents
Disclosing server info
It is considered a safer behaviour not to disclose server information from your Chamilo page. In order to avoid both web server and PHP information disclosure, you might want to take the following actions:
- Locate the ServerTokens setting inside your Apache configuration and set it to "Prod"
- Locate the ServerSignature setting inside your Apache configuration and set it to "Off"
- Locate the expose_php setting inside your PHP configuration and set it to "Off"
- Reload Apache
4. Keeping up to date
Make sure you check our security issues page from time to time. Subscribe to our free security alerts mailing-list: http://lists.chamilo.org/listinfo/security or that you follow our security Twitter feed: http://twitter.com/chamilosecurity.
Authors
- Yannick Warnier, Zend Certified PHP Engineer, BeezNest Belgium SPRL, ywarnier@beeznest.net