security.html 9.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184
  1. <html lang="en">
  2. <head>
  3. <meta charset="utf-8" />
  4. <title>Chamilo Security Guide</title>
  5. <link rel="stylesheet" href="../public/build/css/app.css" type="text/css" media="screen,projection" />
  6. <link rel="stylesheet" href="../public/build/css/themes/chamilo/default.css" type="text/css" media="screen,projection" />
  7. <link rel="stylesheet" href="default.css" type="text/css" media="screen,projection" />
  8. <link rel="stylesheet" href="../public/build/css/print.css" type="text/css" media="print" />
  9. <script src="../public/build/app.js"></script>
  10. </head>
  11. <body>
  12. <div class="container">
  13. <h1>Chamilo LMS: Security Guide</h1>
  14. <a href="index.html">Documentation</a> &gt; Security Guide
  15. <p>We recommend you don't take security issues too lightly. Chamilo is security-audited at least once a year,
  16. but you're never too sure. This list is a work in progress. Feel free to recommend additional measures by
  17. sending us an e-mail at info@chamilo.org.</p>
  18. <h2><b>Contents</b></h2>
  19. <ol>
  20. <li><a href="#1.Disclosing-server-info">Disclosing server info</a></li>
  21. <li><a href="#2.Keeping-up-to-date">Keeping up to date</a></li>
  22. <li><a href="#3.Using-safe-browsers">Using safe browsers</a></li>
  23. <li><a href="#4.Moving-config-file">Moving your configuration file out of the web directory</a></li>
  24. <li><a href="#5.Files-permissions">Restricting files permissions</a></li>
  25. <li><a href="#6.HSTS">HTTP Headers Security</a></li>
  26. </ol>
  27. <h2><a name="1.Disclosing-server-info"></a>1. Disclosing server info</h2>
  28. <p>
  29. It is considered a safer behaviour not to disclose server information from your Chamilo page. In order to avoid
  30. both web server and PHP information disclosure, you might want to take the following actions:
  31. </p>
  32. <ul>
  33. <li>Locate the <i>ServerTokens</i> setting inside your Apache configuration and set it to "Prod"</li>
  34. <li>Locate the <i>ServerSignature</i> setting inside your Apache configuration and set it to "Off"</li>
  35. <li>Locate the <i>expose_php</i> setting inside your PHP configuration and set it to "Off"</li>
  36. <li>Reload Apache</li>
  37. </ul>
  38. <h2><a name="2.Keeping-up-to-date"></a>2. Keeping up to date</h2>
  39. <p>
  40. Make sure you check <a href="http://support.chamilo.org/projects/chamilo-18/wiki/Security_issues">our security
  41. issues page</a> from time to time.
  42. Subscribe to our free security alerts mailing-list:
  43. <a href="http://lists.chamilo.org/listinfo/security">http://lists.chamilo.org/listinfo/security</a> or that you
  44. follow our security Twitter feed: <a href="http://twitter.com/chamilosecurity">http://twitter.com/chamilosecurity</a>.
  45. </p>
  46. <h2><a name="3.Using-safe-browsers"></a>3. Using safe browsers</h2>
  47. <p> Additionally to lacking the implementation of features that really improve the quality of your browsing the
  48. Internet, older browsers tend to have many unresolved security flaws. Using an old browser, you put in danger the
  49. security of your computer and the data it contains, but you can also put others in danger by letting crackers take
  50. control of it and attacking others.</p>
  51. <p>To avoid being a risk to yourself and others, you should download and install a recent browser. We recommend
  52. <a href="http://www.getfirefox.com" target="_blank">the latest stable version of Firefox</a>.</p>
  53. <h2><a name="4.Moving-config-file"></a>4. Moving your configuration file out of the web directory</h2>
  54. <p>It is considered unsafe to leave the configuration file inside the app/config/ directory, as it will be directly
  55. accessible for all users, which could lead crackers to download it, uninterpreted, and read through your
  56. configuration, which could lead to illicit
  57. access to your database if that one isn't well protected and many other stuff we'd prefer to avoid. To secure it,
  58. move the configuration file out of your web directory. If your Chamilo installation is in /var/www/, move your
  59. configuration to /etc/chamilo/configuration.php, for example. Then create a new app/config/configuration.php
  60. file, open it, and write the following:</p>
  61. <pre>
  62. &lt;?php
  63. require '/etc/chamilo/configuration.php';
  64. </pre>
  65. <p>
  66. This will prevent direct access to your settings and make it seem totally the same to Chamilo.
  67. </p>
  68. <h2><a name="5.Files-permissions"></a>5. Restricting files permissions</h2>
  69. <p>Making all the Chamilo files world-writable will help you install quickly, and it solves many
  70. issues for people without much admin experience. However, it's more
  71. secure to make a distinct user owner of all the chamilo files and folders,
  72. and only give read access to the web server to all files, and write access
  73. only to the directories previously mentioned.</p>
  74. <p>This way, these files need
  75. only be readable and writable by the Apache process owner, not by the
  76. entire world. It would also be advisable to make all writable directory
  77. refuse the interpretation of PHP files (except for the root of the courses
  78. directories).</p>
  79. <p>Don't hesitate to hire an experienced administrator to do that,
  80. it might be a bit more expensive now, but you'll be happy not to have to loose
  81. all of your data to a hacker who attacked your site.</p>
  82. <p>Only the following directories have required (or optional) write
  83. permissions from the web server:<br />
  84. <ul>
  85. <li>app/cache/</li>
  86. <li>app/courses/</li>
  87. <li>app/home/</li>
  88. <li>app/logs/</li>
  89. <li>app/upload/</li>
  90. <li>main/default_course_document/images/</li>
  91. <li>main/lang/ (optional, only for sublanguages)</li>
  92. <li>web/css/ (optional, only for switching CSS through the web)</li>
  93. </ul>
  94. <br />
  95. Because these directories have "write by the web server" permissions,
  96. it is important to prevent the execution of PHP scripts from those
  97. directories (because a specially-crafted attack could end up allowing
  98. the upload of a PHP script to one of these). To do that, taking into
  99. account we authorize overrides through .htaccess, we need to set
  100. something that a .htaccess file cannot revert, and we need to set it
  101. for each of those directories. This can be done as follows inside
  102. your VirtualHost definition in Apache, where "/var/www/URL/" is the path of your VirtualHost web root:<br />
  103. <pre>
  104. &lt;Directory /var/www/URL/app/cache&gt;
  105. php_admin_value engine Off
  106. &lt;/Directory&gt;
  107. &lt;Directory /var/www/URL/app/courses&gt;
  108. php_admin_value engine Off
  109. &lt;/Directory&gt;
  110. &lt;Directory /var/www/URL/app/home&gt;
  111. php_admin_value engine Off
  112. &lt;/Directory&gt;
  113. &lt;Directory /var/www/URL/app/logs&gt;
  114. php_admin_value engine Off
  115. &lt;/Directory&gt;
  116. &lt;Directory /var/www/URL/app/upload&gt;
  117. php_admin_value engine Off
  118. &lt;/Directory&gt;
  119. &lt;Directory /var/www/URL/app/Resources/public/css>
  120. php_admin_value engine Off
  121. &lt;/Directory&gt;
  122. &lt;Directory /var/www/URL/main/default_course_document/images&gt;
  123. php_admin_value engine Off
  124. &lt;/Directory&gt;
  125. &lt;Directory /var/www/URL/main/lang&gt;
  126. php_admin_value engine Off
  127. &lt;/Directory&gt;
  128. &lt;Directory /var/www/URL/web/css&gt;
  129. php_admin_value engine Off
  130. &lt;/Directory&gt;
  131. </pre>
  132. For Nginx, this would look like the following rules. However, do
  133. remember that Nginx interprets rules in order of appearance, so these
  134. rules would have to be at the top of your location rules to take the
  135. highest priority:
  136. <pre>
  137. location ~ ^/app/(cache|courses|home|logs|upload|Resources/public/css)/.*\.ph(p[3457]?|t|tml|ar)$ {
  138. deny all;
  139. }
  140. location ~ ^/main/default_course_document/images/.*\.ph(p[3457]?|t|tml|ar)$ {
  141. deny all;
  142. }
  143. location ~ ^/main/lang/.*\.ph(p[3457]?|t|tml|ar)$ {
  144. deny all;
  145. }
  146. location ~ ^/web/css/.*\.ph(p[3457]?|t|tml|ar)$ {
  147. deny all;
  148. }
  149. </pre>
  150. <br />
  151. <hr />
  152. <h2><a name="6.HSTS">HTTP Headers Security</a></h2>
  153. <p>A relatively recent development in web security, HTTP headers can be modified either
  154. from the web server or from the application (like Chamilo) to increase the security
  155. of your visitors.</p>
  156. <p>These implies several aspects, from simple to complex, to deal with, from stuff like
  157. indicating which websites you say media or libraries can be loaded from, to adding
  158. extra info about your SSL certificate to make sure a hacked certification authority
  159. will not immediately make your certificate useless.</p>
  160. <p>In Chamilo 1.11.6, we have added several parameters, together with recommendations,
  161. to main/install/configuration.dist.php, that you are free to use or ignore,
  162. depending on the level of security you want to achieve.</p>>
  163. <p>To check your portal for possible improvements in terms of headers security,
  164. we highly recommend the <a href="https://securityheaders.io/">securityheaders.io</a>
  165. website. If you want to read more about CSP and all related headers
  166. security techniques, check <a href="https://scotthelme.co.uk/">Scott Helme's blog</a>.
  167. <h2>Authors</h2>
  168. <ul>
  169. <li>Yannick Warnier, Zend Certified PHP Engineer, BeezNest Belgium SPRL,
  170. <a href="mailto:yannick.warnier@beeznest.com">yannick.warnier@beeznest.com</a></li>
  171. </ul>
  172. </div>
  173. </body>
  174. </html>