There are a number of security tasks that you must do to your website configuration to help reduce vulnerabilities. Hopefully, this will get you started -- or at least pointed in the right direction where to ask questions -- related to security and v 1.0.11. Things are getting much, much more secure due to the hard work of many people here. Their guideliness are very good even if it seems a bit complicated at first.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Installation Message #1: Recommended PHP.INI settings - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - The developers recommend you edit the
php.ini file located in the php directory and make certain these parameters are set (as pictured below).
Quote:
register_globals = 0
disable_functions = show_source, system, shell_exec, passthru, exec, phpinfo, popen, proc_open
allow_url_fopen = 0
magic_gpc_quotes = 1
safe_mode = 1
open_basedir = /dir/to/include/change_me/
Note, exceptions from Beat:allow_f_url_open = 0 => true that it increases security, but it will break a few components (like "URL Links" backend function in Docman)
safe_mode = 1 => it's another line of defense on shared hosts, but might not allow Joomla! components, modules, extension installer to work depending on other safe_mode settings. Joomla 1.5 fixes that.
Function exec is sometimes (rarely) needed for some libraries (like ImageMagic).
If your host maintains this information, see if they will make changes.
If your host will not make these changes, please read this post "
Secure it with php.ini" <
http://forum.joomla.org/index.php/topic ... #msg411018 > where it instructs you how to make your own php.ini files for each of your subdirectories in order to override the server settings.
NOTE: Beat lists SEVEN logical steps to getting your PHP settings changed that can help you think through your options if your web host will not make changes <
http://forum.joomla.org/index.php/topic ... #msg455771 >
For MUCH more GREAT information, please see the
Joomla! Security Administrator's Checklist, starting with the
PHP section <
http://forum.joomla.org/index.php/topic,81058.0.html > ):
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Installation Message #2: Joomla! RG_EMULATION setting is `ON` instead of `OFF` in file globals.php - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - After the installation, the developers recommend you edit the
globals.php file located in the root directory of your website for increased security.
Locate this parameter (as pictured next):
Quote:
define( 'RG_EMULATION', 1 );
Change the
1 (as pictured above) to
0 (as pictured below):
Quote:
define( 'RG_EMULATION', 0 );
WARNING: Some extensions will not work with this variable off.
In testing, the developers identified several and notified third party developers. Some fixes are already available.
Review and report such extensions, and find upgrades, here: <
http://forum.joomla.org/index.php/topic,86525.0.html >. Questions about this setting should also be asked in that thread.
You can leave the globals.php file without changes knowing you are choosing a diminished safety level.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Installation Message #3: New htaccess file - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - After the installation, the developers highly recommend you use the blocking rules that are now part of the default .htaccess file delivered with 1.0.11. Those using an older htaccess file are strongly encouraged to add this to their file. See <
http://forum.joomla.org/index.php/topic ... #msg388584 > for more information or to ask .htaccess related questions. (If you are getting
access denied messages to your website, it is very likely related to the htaccess file, post requests for help in this previous thread.)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Installation Message #4: Please take time to consider the Joomla! Security Administrator's Checklist: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - The Joomla! Security Administrator's Checklist is available <
http://forum.joomla.org/index.php/topic,81058.0.html >
Rliskey maintains the previously linked to list, so, check back to that link
frequently for updates. It is an
EXCELLENT resource and he has made it
EASY for us to learn how to secure our sites. Please spend time with this information. There is a link in that topic for you to use for questions or comments. Many people who are very knowledgeable in security issues watch that thread closely!
As you read through this information, it really starts to make sense. No worries, though, there are many who will help! It is worth our time to learn and there are many who will help us with questions. Thanks to all of you who have figured out this information for the Joomla! end user community.
Login
Register
Rules
FAQ
The team
????
