Security Checklist/Hosting and Server Setup/nl - Revision history

MartijnM at 14:29, 18 April 2020

2020-04-18T14:29:47Z

← Older revision		Revision as of 14:29, 18 April 2020
Line 41:		Line 41:
	: Understand how to work with the php.ini file, and how PHP configurations are controlled. Study the [http://us3.php.net/manual/en/ini.php#ini.list Official List of php.ini Directives] at http://www.php.net, and the well-documented default php.ini file included with every PHP install.		: Understand how to work with the php.ini file, and how PHP configurations are controlled. Study the [http://us3.php.net/manual/en/ini.php#ini.list Official List of php.ini Directives] at http://www.php.net, and the well-documented default php.ini file included with every PHP install.
	===Use PHP7===		===Use PHP7===
	~~<span class="mw-translate-fuzzy">~~PHP-versies zijn verouderd en sommige versies worden niet meer ondersteund (ouwe meuk). Sommige hostingproviders hebben nog steeds verschillende versies beschikbaar op servers om verouderde scripts te ondersteunen. Joomla zou PHP7.x moeten gebruiken. (Zie [https://downloads.joomla.org/technical-requirements Joomla Requirements])~~</span>~~		PHP-versies zijn verouderd en sommige versies worden niet meer ondersteund (ouwe meuk). Sommige hostingproviders hebben nog steeds verschillende versies beschikbaar op servers om verouderde scripts te ondersteunen. Joomla {{JVer\|3.x}} en hoger zou PHP7.x moeten gebruiken. (Zie [https://downloads.joomla.org/technical-requirements Joomla Requirements])

	===Use local php.ini files===		===Use local php.ini files===

FuzzyBot: Updating to match new version of source page

2020-04-08T21:58:59Z

Updating to match new version of source page

← Older revision		Revision as of 21:58, 8 April 2020
Line 41:		Line 41:
	: Understand how to work with the php.ini file, and how PHP configurations are controlled. Study the [http://us3.php.net/manual/en/ini.php#ini.list Official List of php.ini Directives] at http://www.php.net, and the well-documented default php.ini file included with every PHP install.		: Understand how to work with the php.ini file, and how PHP configurations are controlled. Study the [http://us3.php.net/manual/en/ini.php#ini.list Official List of php.ini Directives] at http://www.php.net, and the well-documented default php.ini file included with every PHP install.
	===Use PHP7===		===Use PHP7===
	PHP-versies zijn verouderd en sommige versies worden niet meer ondersteund (ouwe meuk). Sommige hostingproviders hebben nog steeds verschillende versies beschikbaar op servers om verouderde scripts te ondersteunen. Joomla zou PHP7.x moeten gebruiken. (Zie [https://downloads.joomla.org/technical-requirements Joomla Requirements])		<span class="mw-translate-fuzzy">PHP-versies zijn verouderd en sommige versies worden niet meer ondersteund (ouwe meuk). Sommige hostingproviders hebben nog steeds verschillende versies beschikbaar op servers om verouderde scripts te ondersteunen. Joomla zou PHP7.x moeten gebruiken. (Zie [https://downloads.joomla.org/technical-requirements Joomla Requirements])</span>

	===Use local php.ini files===		===Use local php.ini files===

FuzzyBot: Updating to match new version of source page

2020-04-04T20:28:47Z

Updating to match new version of source page

← Older revision		Revision as of 20:28, 4 April 2020
Line 1:		Line 1:
	<noinclude><languages /></noinclude>		<noinclude><languages /></noinclude>
	{{:Security Checklist/TOC}}		{{:Security Checklist/TOC/en}}

	== Choose a Qualified Hosting Provider ==		== Choose a Qualified Hosting Provider ==


	===The most important decision===		===The most important decision===

Webmiep: Created page with "PHP-versies zijn verouderd en sommige versies worden niet meer ondersteund (ouwe meuk). Sommige hostingproviders hebben nog steeds verschillende versies beschikbaar op servers..."

2019-10-19T10:47:03Z

Created page with "PHP-versies zijn verouderd en sommige versies worden niet meer ondersteund (ouwe meuk). Sommige hostingproviders hebben nog steeds verschillende versies beschikbaar op servers..."

← Older revision		Revision as of 10:47, 19 October 2019
Line 39:		Line 39:
	: Understand how to work with the php.ini file, and how PHP configurations are controlled. Study the [http://us3.php.net/manual/en/ini.php#ini.list Official List of php.ini Directives] at http://www.php.net, and the well-documented default php.ini file included with every PHP install.		: Understand how to work with the php.ini file, and how PHP configurations are controlled. Study the [http://us3.php.net/manual/en/ini.php#ini.list Official List of php.ini Directives] at http://www.php.net, and the well-documented default php.ini file included with every PHP install.
	===Use PHP7===		===Use PHP7===
	PHP ~~versions become deprecated and some have become obsolete~~. ~~Some hosting providers still have several available on~~ servers ~~to support outdated~~ scripts. Joomla ~~should be using~~ PHP7.x. (~~See~~ [https://downloads.joomla.org/technical-requirements Joomla Requirements])		PHP-versies zijn verouderd en sommige versies worden niet meer ondersteund (ouwe meuk). Sommige hostingproviders hebben nog steeds verschillende versies beschikbaar op servers om verouderde scripts te ondersteunen. Joomla zou PHP7.x moeten gebruiken. (Zie [https://downloads.joomla.org/technical-requirements Joomla Requirements])

	===Use local php.ini files===		===Use local php.ini files===

FuzzyBot: Updating to match new version of source page

2019-10-19T07:50:14Z

Updating to match new version of source page

← Older revision		Revision as of 07:50, 19 October 2019
Line 39:		Line 39:
	: Understand how to work with the php.ini file, and how PHP configurations are controlled. Study the [http://us3.php.net/manual/en/ini.php#ini.list Official List of php.ini Directives] at http://www.php.net, and the well-documented default php.ini file included with every PHP install.		: Understand how to work with the php.ini file, and how PHP configurations are controlled. Study the [http://us3.php.net/manual/en/ini.php#ini.list Official List of php.ini Directives] at http://www.php.net, and the well-documented default php.ini file included with every PHP install.
	===Use PHP7===		===Use PHP7===
	PHP versions become deprecated and ~~has~~ become obsolete. Some hosting providers still have several available on servers to support outdated scripts. Joomla should be using PHP7.x. (See [https://downloads.joomla.org/technical-requirements Joomla Requirements])		PHP versions become deprecated and some have become obsolete. Some hosting providers still have several available on servers to support outdated scripts. Joomla should be using PHP7.x. (See [https://downloads.joomla.org/technical-requirements Joomla Requirements])

	===Use local php.ini files===		===Use local php.ini files===
	: On shared servers you can't edit the main php.ini file, but you may be able to add custom, local php.ini files. If so, you'll need to copy the php.ini files to every sub-directory that requires custom settings.		: On shared servers you can't edit the main php.ini file, but you may be able to add custom, local php.ini files. If so, you'll need to copy the php.ini files to every sub-directory that requires custom settings.

Webcatsolutions: Created page with " ===Maak geen gebruik van PHP allow_url_include==="

2018-12-06T09:55:40Z

Created page with " ===Maak geen gebruik van PHP allow_url_include==="

← Older revision		Revision as of 09:55, 6 December 2018
Line 96:		Line 96:
	register_globals = 0		register_globals = 0

	===~~Don't use~~ PHP allow_url_include===
			===Maak geen gebruik van PHP allow_url_include===

	: Do not use PHP ''allow_url_include''. This PHP option allows a programmer to include a remote file using an URL rather than a local file path. This is insecure. If an application (or extension) can be tricked into including content from a URL outside itself, an attacker could force the application (or extension) to start running code from their own web site. If an application or extension claims to require this feature to function, you should look into alternatives, as a requirement to use of this feature indicates serious design flaws within the application or extension.		: Do not use PHP ''allow_url_include''. This PHP option allows a programmer to include a remote file using an URL rather than a local file path. This is insecure. If an application (or extension) can be tricked into including content from a URL outside itself, an attacker could force the application (or extension) to start running code from their own web site. If an application or extension claims to require this feature to function, you should look into alternatives, as a requirement to use of this feature indicates serious design flaws within the application or extension.

Webcatsolutions: Created page with "== Bestandsrechten =="

2018-12-06T09:54:56Z

Created page with "== Bestandsrechten =="

← Older revision		Revision as of 09:54, 6 December 2018
Line 112:		Line 112:
	PHP default: allow_url_include is disabled		PHP default: allow_url_include is disabled

	== ~~File permissions~~ ==		== Bestandsrechten ==
	: If a Joomla installation is hosted on Apache with mod_php, then all virtual hosts on that server run in the same context as your joomla code. If the files are owned by some other user than 'nobody' or 'wwwrun', the safest permissions are those which '''prevent''' changes to the joomla code, unless via an authorised channel (e.g. FTP:		: If a Joomla installation is hosted on Apache with mod_php, then all virtual hosts on that server run in the same context as your joomla code. If the files are owned by some other user than 'nobody' or 'wwwrun', the safest permissions are those which '''prevent''' changes to the joomla code, unless via an authorised channel (e.g. FTP:
	*DocumentRoot directory: 750 (e.g. public_html)		*DocumentRoot directory: 750 (e.g. public_html)

Webcatsolutions: Created page with "PHP bestanden: 600 (400 als je paranoïde bent)"

2018-12-06T09:54:07Z

Created page with "PHP bestanden: 600 (400 als je paranoïde bent)"

← Older revision		Revision as of 09:54, 6 December 2018
Line 124:		Line 124:
	: If a Joomla installation is hosted on Apache with fast-cgi, suphp or cgi that runs as a different user, then you should set your permissions as follows:		: If a Joomla installation is hosted on Apache with fast-cgi, suphp or cgi that runs as a different user, then you should set your permissions as follows:
	* DocumentRoot directory: 750 (e.g. public_html)		* DocumentRoot directory: 750 (e.g. public_html)
	* PHP ~~files~~: 600 (400 ~~if you are truly paranoid~~)		* PHP bestanden: 600 (400 als je paranoïde bent)
	* HTML and image files: 644 (444 if you are truly paranoid)		* HTML and image files: 644 (444 if you are truly paranoid)
	* Directories: 755 (711 if you are paranoid, but not for directories which need to be listed)		* Directories: 755 (711 if you are paranoid, but not for directories which need to be listed)

Webcatsolutions: Created page with "Bestanden: 644"

2018-12-06T09:53:10Z

Created page with "Bestanden: 644"

← Older revision		Revision as of 09:53, 6 December 2018
Line 115:		Line 115:
	: If a Joomla installation is hosted on Apache with mod_php, then all virtual hosts on that server run in the same context as your joomla code. If the files are owned by some other user than 'nobody' or 'wwwrun', the safest permissions are those which '''prevent''' changes to the joomla code, unless via an authorised channel (e.g. FTP:		: If a Joomla installation is hosted on Apache with mod_php, then all virtual hosts on that server run in the same context as your joomla code. If the files are owned by some other user than 'nobody' or 'wwwrun', the safest permissions are those which '''prevent''' changes to the joomla code, unless via an authorised channel (e.g. FTP:
	*DocumentRoot directory: 750 (e.g. public_html)		*DocumentRoot directory: 750 (e.g. public_html)
	*~~Files~~: 644		*Bestanden: 644
	*Directories: 755 (711 if you are paranoid, but not for directories which need to be listed) (owner: some user)		*Directories: 755 (711 if you are paranoid, but not for directories which need to be listed) (owner: some user)

Webcatsolutions: Created page with "Kapotte site door een foutieve upgrade."

2018-12-06T09:52:50Z

Created page with "Kapotte site door een foutieve upgrade."

← Older revision		Revision as of 09:52, 6 December 2018
Line 138:		Line 138:
	: You should at all time be able to return your site to a previous working state through regular use of a strong, off-site backup and recovery process. Be sure your backup and recovery process is in place and tested BEFORE you go live. This is the single best way (and often the only way) to recover from such inevitable catastrophes as:		: You should at all time be able to return your site to a previous working state through regular use of a strong, off-site backup and recovery process. Be sure your backup and recovery process is in place and tested BEFORE you go live. This is the single best way (and often the only way) to recover from such inevitable catastrophes as:

	#~~Broken~~ site ~~due to a faulty~~ upgrade.		#Kapotte site door een foutieve upgrade.
	#Hardware failure, such as dead hard drives, power failures, server theft, etc.		#Hardware failure, such as dead hard drives, power failures, server theft, etc.
	#Authoritarian government intervention. (More common than some think.)		#Authoritarian government intervention. (More common than some think.)