security.html 2.7 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758
  1. <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
  2. <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  3. <head>
  4. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  5. <title>Chamilo Security Guide</title><link rel="stylesheet" href="default.css" type="text/css" media="screen,projection" />
  6. <link rel="shortcut icon" href="../favicon.ico" type="image/x-icon" />
  7. <style type="text/css">
  8. <!--
  9. page { width: 21cm; height: 29.7cm; margin: 2cm }
  10. pre { font-family: "Courier New", monospace }
  11. p { margin-bottom: 0.21cm }
  12. .code {margin: 1em 1em 1em 2em; padding: 0.5em; background-color: rgb(229, 229, 229); vertical-align: top; border: 1px solid #999999;}
  13. -->
  14. </style>
  15. </head>
  16. <body>
  17. <div id="header1">
  18. <h1>Chamilo 1.8.8.2 : Security Guide</h1>
  19. </div>
  20. <a href="index.html">Documentation</a> &gt; Security Guide
  21. <div id="outerframe">
  22. <div id="main">
  23. <p></p>
  24. <p>We recommend you don't take security issues too lightly. Chamilo is security-audited at least once a year, but you're never too sure. This list is a work in progress. Feel free to recommend additional measures by sending us an e-mail at info@chamilo.org.</p>
  25. <h2><b>Contents</b></h2>
  26. <ol>
  27. <li><a href="#1.Disclosing-server-info">Disclosing server info</a></li>
  28. <li><a href="#2.Keeping-up-to-date">Keeping up to date</a></li>
  29. <li><a href="#3.Using-safe-browsers">Using safe browsers</a></li>
  30. </ol>
  31. <h2><a name="1.Disclosing-server-info"></a>Disclosing server info</h2>
  32. <p>
  33. It is considered a safer behaviour not to disclose server information from your Chamilo page. In order to avoid both web server and PHP information disclosure, you might want to take the following actions:
  34. <ul>
  35. <li>Locate the <i>ServerTokens</i> setting inside your Apache configuration and set it to "Prod"</li>
  36. <li>Locate the <i>ServerSignature</i> setting inside your Apache configuration and set it to "Off"</li>
  37. <li>Locate the <i>expose_php</i> setting inside your PHP configuration and set it to "Off"</li>
  38. <li>Reload Apache</li>
  39. </ul>
  40. </p>
  41. <h2><a name="4.Keeping-up-to-date"></a>4. Keeping up to date</h2>
  42. <p>
  43. Make sure you check <a href="http://support.chamilo.org/projects/chamilo-18/wiki/Security_issues">our security issues page</a> from time to time.
  44. Subscribe to our free security alerts mailing-list: <a href="http://lists.chamilo.org/listinfo/security">http://lists.chamilo.org/listinfo/security</a> or that you follow our security Twitter feed: <a href="http://twitter.com/chamilosecurity">http://twitter.com/chamilosecurity</a>.
  45. </p>
  46. <hr />
  47. <h2>Authors</h2>
  48. <ul>
  49. <li>Yannick Warnier, Zend Certified PHP Engineer, BeezNest Belgium SPRL, <a href="mailto:ywarnier@beeznest.net">ywarnier@beeznest.net</a></li>
  50. </ul>
  51. </body></html>