Permissions, block access and php modules

Install and configure FormaLMS and DoceboCE
Post Reply
maruggio
FormaLms User
Posts: 56
Joined: Mon Dec 17, 2018 1:51 pm
Version: forma.lms 2.0
Contact:

Permissions, block access and php modules

Post by maruggio » Wed Feb 13, 2019 3:03 pm

Hi

I run several tests with FormaLMS using different VMs based on linux flavors (apache24) and OpenBSD (apache24 and httpd(8)), assuming Formalms is the sole webapp in DOCROOT.
I have some questions:
  • What are the suggested permissions for FormaLSM to be set in httpd DOCROOT. (eg. chmod 755 for directories, chmod 644 files?).
    Which files, directories should be blocked from outside, I do not understand every regex in .htaccess?
    Are there any more php modules (gd,intl,opcache,etc.) suggested to be installed for additional purposes?
Many thanks.

-maruggio

User avatar
canelli
FormaLms Guru
Posts: 488
Joined: Thu Nov 08, 2012 12:21 pm
Version: forma.lms 2.0
Contact:

Re: Permissions, block access and php modules

Post by canelli » Thu Feb 14, 2019 9:45 am

Hi Maruggio

there are other threads that answer to some of your questions . I will recap here for you and all that need them

To deploy formalms on a linux / bsd environment the best package is the tar.gz that contains files and directories already set with rigth permissions, if you can untar directly on the server , otherwise tar or zip format are the same and have same contents.
The permissions suggested for security are:
  • Beginning from the DOCROOT or from the directory where formalms are published:
    • All directories and files owned by a specific user, nor root nor apache web server user (www-data under debian/ubuntu, apache under redhat , centos , ...)
    • All directories with permissions: 755 (write permision only for owner) or 555 (no write permissions at all, only read)
    • All files with permisisons: 644 (write permision only for owner) or 444 (no write permissions, only read)
  • All directories under files directory (the webserver write uploaded or generated files under this one):
    • Directories and files owned by web server user
    • All directories permissions: 755
    • All files: 644
With above configrutation, config.php file is not writeble by web server. During install you must download the generated one from browser and upload to the web server.
At the and of installation remove install and upgrade directories or rename them with unusual and strange name to prevent the use from anyone.
Which files, directories should be blocked from outside, I do not understand every regex in .htaccess?
the root .htaccess blocks , from start to end:
  • blocks all files: .htpasswd , *.ini, *.php, *.fla , *.psd, *.log , *.sh
  • blocks all composer configuration files : composer.json , composer.lock
  • blocks all variant of readme files (eg. readme.txt, readme.md, ..)
  • permits only php entry files: index.php, cron.php, tasks.php, ...
the .htaccess under files directory:
  • remove web server execution for well know web scripts engine (cgi, php, ruby , python, perl, asp, aspx)
  • disable php engine both php5 and php 7
minimum php module needed are checked at installation time, you can check php also from the global admin dashboard (Server configuration link), here some hints:
  • GD, intl are wellcome
  • opcache (or other cache system) can be used
  • memcache (or similar) can be used (must be correctly configured) for sessions
Cercate nel forum le riposte prima di chiedere. Check the forum before posting
---------------
Claudio Anelli
Joint Technologies - Sistemi avanzati per l'information technology

http://www.joint-tech.com
---------------

maruggio
FormaLms User
Posts: 56
Joined: Mon Dec 17, 2018 1:51 pm
Version: forma.lms 2.0
Contact:

Re: Permissions, block access and php modules

Post by maruggio » Thu Feb 14, 2019 3:44 pm

Many thanks Claudio for your recap. That helps a lot. Mille grazie.

Post Reply