(this assumes you are running Debian on your server; if not, I suggest you switch)<\/p>\n
Mediawiki. One of the world’s less secure wikis? Probably. I use and install it a lot, and it’s usually “the compromise wiki”: it’s weak at a lot of things, but it’s the “least worst overall” a lot of the time. Here’s my current standard fixes and tweaks.<\/p>\n
\nStrange, given how many people use wikis as a collaboration tool, that Mediawiki doesn’t do basic security out of the box, and has no user-options to enable any of these:<\/p>\n
By default (with no user-configurable settings for this) it also:<\/p>\n
So, here’s my list of fixes that I have to re-apply manually every time I install mediawiki; I do this often enough that I’m blogging it so I can just copy\/paste them next time. This is tiresome; it would be nice if they just updated it to work like other webapps and have a “config” page – and even better if it did some of these by default or as options at install time.<\/p>\n
Assuming you use Apache (and if not, why not?), setup a virtual hosts file to force-redirect non-SSL traffic to an SSL version of the wiki domain. This *guarantees* that *all* wiki pages can’t be snooped off-the-wire, and has the benefit of preventing any cleartext sending of passwords.<\/p>\n
Downsides: er … only one I can think of off the top of my head is that the CPU usage \/ traffic will increase from using “always on” encryption. Shouldn’t even be noticeable on modern server hardware…<\/p>\n
\n\r\n<VirtualHost *:80>\r\n ServerName wiki.securedomain.com\r\n ServerAdmin webmaster@localhost\r\n\r\n Redirect permanent \/ https:\/\/wiki.securedomain.com\/\r\n<\/VirtualHost>\r\n<VirtualHost *:443>\r\n ServerName wiki.securedomain.com\r\n ServerAdmin webmaster@localhost\r\n\r\n # only these two lines and the second in the file should differ\r\n # from the default site\r\n SSLEngine on\r\n SSLCertificateFile \/etc\/apache2\/ssl\/apache.pem\r\n\r\n DocumentRoot \/var\/lib\/mediawiki\/\r\n ServerSignature On\r\n\r\n<\/VirtualHost>\r\n<\/code>\r\n<\/pre>\n<\/blockquote>\n2. Change mediawiki configfile settings<\/h4>\n
You have to edit the config files manually on your webserver – if you don’t have access to your webserver files, you’re just screwed, sorry. Well, shell-access hosting is very cheap these days ($10 a month), shouldn’t be a problem…<\/p>\n
\n\r\n## Adam's default settings for LocalSettings.php\r\n\r\n## *All* the following put together will prevent everyone on the web\r\n## reading your data without even logging in, but will also allow your\r\n## real users to login; don't miss any of these out, or you may be unable\r\n## to login\r\n$wgGroupPermissions['*']['edit'] = false;\r\n$wgWhitelistRead = array(\"Special:Userlogin\", \"-\", \"MediaWiki:Monobook.css\" );\r\n$wgGroupPermissions['*']['read'] = false;\r\n$wgGroupPermissions['*']['createaccount'] = false;\r\n\r\n## Basic obvious default: let users get rid of the ugly\r\n## default GUI (sidebar, stylesheets, etc)\r\n$wgGroupPermissions['user']['editinterface'] = true;\r\n\r\n## Put uploads ... somewhere sensible:\r\n$wgUploadDirectory = \"{$IP}\/images\";\r\n$wgUploadPath = \"{$wgScriptPath}\/images\";\r\n\r\n## Ah, but they have a \"security\" system that will allow you to upload any\r\n## virus you want, and hack the server, BUT ... it won't let you upload most\r\n## image files. That's just ... stupid, IMHO.\r\n$wgStrictFileExtensions = false;\r\n\r\n## AND you can do this (note that it is STILL active even if the above flag\r\n## is set to false).\r\n## I was quite horrified that they use filename extensions as a security\r\n##\u00a0mechanism - this stops some kinds of simple attack (based on tricking\r\n## the webserver - although you SHOULD already have your webserver\r\n## setup to prevent this; if not, why not?)\r\n## For other attacks ... Mediawiki's approach to security\r\n## simply DOES NOT WORK. You *must* check the content\r\n##\u00a0of files, rather than the filename.\r\n$wgFileBlacklist = array('php','phtml','php3','php4','php5','phps');\r\n<\/pre>\n<\/blockquote>\n3. Setup each user by hand<\/h4>\n
To create new users, you now need to manually go to this URL on your wiki:<\/p>\n
\n\/index.php\/Special:UserLogin\n<\/p><\/blockquote>\n
(assuming you installed the wiki on its own domain name)<\/p>\n
4. Some final tweaks to add missing features<\/h4>\n
AND, if you want to edit the navbar, go to: (yes, this is required: go there by hand, with the following “special” URL. It’s a terrible user-interface :( )<\/p>\n
\n\/index.php?title=MediaWiki:Sidebar&action=edit\n<\/p><\/blockquote>\n
…but it gets worse, because that page alone uses a special syntax (not the Wiki syntax, sadly), so that adding either of the obvious misisng links is a bit of hassle. Here’s copy\/pasteable working code:<\/p>\n
\n* essentials
\n** MediaWiki:Sidebar | edit-sidebar
\n** Special:UserLogin|create user\n<\/p><\/blockquote>\n(note: they BOTH have a unique syntax due to the way mediawiki is badly designed, and the first one WILL BREAK if you use the text “sidebar” instead of “edit-sidebar” (use anything, just NOT “sidebar” on its own))<\/p>\n