View source for Implementation Security Guidelines

# Implementation Security Guidelines

This article outlines the essential security guidelines for implementing and maintaining a MediaWiki installation, aimed at beginners. It covers a broad range of topics, from server hardening and access control to database security and regular maintenance. Ignoring these guidelines can leave your wiki vulnerable to attacks, resulting in data loss, defacement, or compromise of the entire server.

== 1. Server Hardening ==

The foundation of a secure MediaWiki installation lies in a hardened server environment. This involves securing the operating system (OS) and associated services.

*'''Operating System Selection:'''* Choose a well-supported and regularly updated Linux distribution (e.g., Ubuntu Server, Debian, CentOS/Rocky Linux). Windows Server is possible, but generally requires more configuration and is a more frequent target for attacks.
*'''Minimal Installation:'''* Install only the necessary packages for MediaWiki and its dependencies. Avoid including unnecessary services that increase the attack surface.
*'''Firewall Configuration:'''* Implement a robust firewall (e.g., `iptables`, `firewalld`, `ufw`) to restrict network access to only essential ports.  Commonly needed ports are 80 (HTTP) and 443 (HTTPS).  Limit access to SSH (port 22) to specific IP addresses or use key-based authentication. [https://www.cloudflare.com/learning/security/what-is-a-firewall/ Understanding Firewalls]
*'''Regular Updates:'''* Keep the OS and all installed packages up-to-date with the latest security patches. Automate this process where possible using package managers. [https://www.redhat.com/en/topics/security/what-is-patch-management Patch Management Basics]
*'''Disable Unnecessary Services:'''* Identify and disable any services that are not required for MediaWiki to function. This minimizes potential vulnerabilities.
*'''Security Auditing:'''* Regularly audit the server's security configuration using tools like Lynis or OpenVAS. [https://cisofy.com/lynis/ Lynis Security Auditing Tool]
*'''SELinux/AppArmor:'''* Utilize Security-Enhanced Linux (SELinux) or AppArmor for mandatory access control. These systems provide an extra layer of security by limiting the actions that processes can perform. [https://selinuxproject.org/ SELinux Project]
*'''Intrusion Detection System (IDS):'''* Consider implementing an IDS like Snort or Suricata to detect malicious activity. [https://www.snort.org/ Snort IDS]

== 2. Web Server Configuration ==

The web server (e.g., Apache, Nginx) plays a crucial role in serving MediaWiki content and must be configured securely.

*'''HTTPS Enforcement:'''*  Always use HTTPS to encrypt communication between the client and the server. Obtain an SSL/TLS certificate from a trusted Certificate Authority (CA) like Let's Encrypt. [https://letsencrypt.org/ Let's Encrypt]
*'''Disable Directory Listing:'''* Prevent web server from listing the contents of directories. This can expose sensitive files.
*'''Limit File Access:'''* Configure the web server to restrict access to sensitive files and directories (e.g., `LocalSettings.php`, `includes/` directory).
*'''HTTP Security Headers:'''* Implement security headers like `Strict-Transport-Security`, `X-Frame-Options`, `X-Content-Type-Options`, and `Content-Security-Policy` to mitigate common web attacks. [https://securityheaders.com/ Security Headers]
*'''Web Application Firewall (WAF):'''* Consider using a WAF like ModSecurity or Cloudflare to protect against web application attacks. [https://modsecurity.org/ ModSecurity WAF]
*'''PHP Configuration:'''* Configure PHP securely (see section 4).

== 3. MediaWiki Specific Security ==

Beyond the server and web server configuration, MediaWiki itself requires specific security measures.

*'''Update MediaWiki:'''* Keep MediaWiki updated to the latest stable version. Updates often include security fixes.  Regularly check for updates on the [[MediaWiki release page]].
*'''Strong Passwords:'''* Enforce strong password policies for all user accounts.  Require a minimum length, complexity, and regular password changes.
*'''Account Creation Restrictions:'''* Control who can create accounts. Consider requiring email verification or administrator approval.
*'''CAPTCHA:'''* Implement CAPTCHA to prevent automated account creation and spam.
*'''Disable Email Sending:'''* If you don't require email functionality, disable it to prevent potential abuse.
*'''Permissions and User Groups:'''* Carefully manage user permissions and groups. Grant users only the necessary privileges. Utilize the [[Permissions system]] effectively.
*'''Extension Security:'''* Only install extensions from trusted sources.  Review the extension's code and dependencies before installing. Keep extensions updated.  Consider the risk assessment associated with each extension.
*'''$wgCookiePath and $wgCookieDomain:'''* Configure these settings correctly in `LocalSettings.php` to prevent cookie hijacking.
*'''$wgSecretKey:'''*  Keep the `$wgSecretKey` secret and change it periodically. This key is used for generating secure cookies and other security features.
*'''$wgUploadDirectory:'''* Secure the upload directory and restrict file types that can be uploaded. [https://owasp.org/www-project-top-ten/ File Uploads – OWASP Top Ten]
*'''$wgSpamRegex:'''* Configure a spam regex to block common spam attempts.

== 4. PHP Security ==

PHP is the language MediaWiki is written in, and its security configuration is critical.

*'''Disable Dangerous Functions:'''* Disable potentially dangerous PHP functions like `exec()`, `system()`, `passthru()`, `eval()`, and `shell_exec()` in `php.ini`.
*'''Open Basedir Restriction:'''* Use the `open_basedir` directive in `php.ini` to restrict PHP's access to specific directories.
*'''Safe Mode (Deprecated):'''*  While deprecated, understand the concept of safe mode and how it used to enhance PHP security.  Modern alternatives are preferred.
*'''Error Reporting:'''*  Disable displaying PHP errors to the public. Log errors to a secure location for debugging purposes.
*'''Register Globals (Deprecated):'''* Avoid using register globals, as it can lead to security vulnerabilities.
*'''Magic Quotes (Deprecated):'''*  Avoid using magic quotes, as it can introduce security issues.
*'''Session Management:'''*  Configure PHP sessions securely, including using a strong session ID and protecting against session hijacking. [https://www.php.net/manual/en/session.security.php PHP Session Security]
*'''File Uploads:'''*  Implement strict validation and sanitization of uploaded files to prevent malicious code execution.

== 5. Database Security ==

The MediaWiki database contains sensitive information and must be protected.

*'''Strong Database Password:'''* Use a strong password for the database user.
*'''Restrict Database Access:'''*  Limit database access to only the MediaWiki server.  Do not allow remote access from other machines.
*'''Database User Permissions:'''*  Grant the database user only the necessary privileges. Avoid granting unnecessary permissions like `DROP` or `ALTER`.
*'''Regular Backups:'''*  Regularly back up the database to prevent data loss.  Store backups in a secure location. [https://www.percona.com/blog/2023/02/16/database-backup-strategies/ Database Backup Strategies]
*'''SQL Injection Prevention:'''* MediaWiki's code should be regularly reviewed to prevent SQL injection vulnerabilities.  Use prepared statements and parameterized queries.  [https://owasp.org/www-project-top-ten/A1_2021_Broken_Access_Control SQL Injection – OWASP Top Ten]
*'''Encryption at Rest:'''* Consider encrypting the database at rest to protect sensitive data.

== 6. Monitoring and Logging ==

Regular monitoring and logging are essential for detecting and responding to security incidents.

*'''Web Server Logs:'''* Analyze web server logs for suspicious activity, such as failed login attempts or unusual requests.
*'''MediaWiki Logs:'''*  Monitor MediaWiki's logs (e.g., `RecentChanges`, `Watchlist`, `LogEvents`) for unauthorized changes or malicious activity.
*'''System Logs:'''*  Monitor system logs for security-related events, such as failed SSH login attempts or firewall alerts.
*'''Intrusion Detection System (IDS) Alerts:'''*  If you have implemented an IDS, monitor its alerts for suspicious activity.
*'''Log Rotation:'''*  Implement log rotation to prevent logs from filling up the disk.

== 7. Regular Maintenance ==

Regular maintenance is crucial for maintaining a secure MediaWiki installation.

*'''Software Updates:'''*  Keep the OS, web server, PHP, and MediaWiki updated with the latest security patches.
*'''Database Maintenance:'''*  Regularly optimize and repair the database.
*'''File System Checks:'''*  Run file system checks to detect and fix errors.
*'''Security Audits:'''*  Periodically conduct security audits to identify and address vulnerabilities.
*'''Backup Verification:'''*  Regularly test the database backup and restore process to ensure it works correctly.

== 8. Disaster Recovery Planning ==

Having a disaster recovery plan in place is essential for minimizing downtime and data loss in the event of a security incident.

*'''Backup Strategy:'''*  Develop a comprehensive backup strategy that includes regular backups of the database, files, and configuration.
*'''Recovery Procedures:'''*  Document the procedures for restoring MediaWiki from backups.
*'''Failover Plan:'''*  Consider implementing a failover plan to automatically switch to a backup server in the event of a primary server failure.
*'''Incident Response Plan:'''*  Develop an incident response plan that outlines the steps to take in the event of a security breach.

== 9. Understanding Common Threats ==

Being aware of common threats can help you proactively protect your MediaWiki installation.

*'''Cross-Site Scripting (XSS):'''*  Prevent XSS attacks by sanitizing user input and output. [https://owasp.org/www-project-top-ten/A3_2021_Injection XSS – OWASP Top Ten]
*'''SQL Injection:'''*  Prevent SQL injection attacks by using prepared statements and parameterized queries.
*'''Cross-Site Request Forgery (CSRF):'''*  Protect against CSRF attacks by using CSRF tokens. [https://owasp.org/www-project-top-ten/A7_2021_Cross-Site_Scripting CSRF – OWASP Top Ten]
*'''Brute-Force Attacks:'''*  Protect against brute-force attacks by implementing rate limiting and account lockout policies.
*'''Denial-of-Service (DoS) Attacks:'''*  Mitigate DoS attacks with a WAF and DDoS protection services. [https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/ DDoS Attacks]
*'''Malware Uploads:'''*  Prevent malware uploads by validating and sanitizing uploaded files.
*'''Phishing Attacks:'''* Educate users about phishing attacks and how to identify them. [https://www.consumer.ftc.gov/articles/phishing Phishing – FTC]

== 10. Resources and Further Learning ==

*'''MediaWiki Security Documentation:''' [[MediaWiki Security]]
*'''OWASP (Open Web Application Security Project):''' [https://owasp.org/ OWASP]
*'''SANS Institute:''' [https://www.sans.org/ SANS Institute]
*'''NIST (National Institute of Standards and Technology):''' [https://www.nist.gov/ NIST]
*'''CIS Benchmarks:''' [https://www.cisecurity.org/ CIS Benchmarks]
*'''SecurityFocus:''' [https://www.securityfocus.com/ SecurityFocus]
*'''Krebs on Security:''' [https://krebsonsecurity.com/ Krebs on Security]
*'''Troy Hunt's Blog:''' [https://www.troyhunt.com/ Troy Hunt's Blog]
*'''Dark Reading:''' [https://www.darkreading.com/ Dark Reading]
*'''Threatpost:''' [https://threatpost.com/ Threatpost]
*'''BleepingComputer:''' [https://www.bleepingcomputer.com/ BleepingComputer]
*'''The Hacker News:''' [https://thehackernews.com/ The Hacker News]
*'''SecurityWeek:''' [https://www.securityweek.com/ SecurityWeek]
*'''Data Breach Today:''' [https://www.databreachtoday.com/ Data Breach Today]
*'''CSO Online:''' [https://www.csoonline.com/ CSO Online]
*'''InfoSecurity Magazine:''' [https://www.infosecurity-magazine.com/ InfoSecurity Magazine]
*'''ZDNet Security:''' [https://www.zdnet.com/topic/security/ ZDNet Security]
*'''TechTarget Security:''' [https://www.techtarget.com/searchsecurity/ TechTarget Security]
*'''Nmap:''' [https://nmap.org/ Nmap Network Scanner]
*'''Wireshark:''' [https://www.wireshark.org/ Wireshark Network Protocol Analyzer]
*'''Metasploit Framework:''' [https://www.metasploit.com/ Metasploit Framework]
*'''Burp Suite:''' [https://portswigger.net/burp Burp Suite Web Vulnerability Scanner]
*'''OWASP ZAP:''' [https://owasp.org/www-project-zap/ OWASP ZAP Web Application Security Scanner]
*'''Shodan:''' [https://www.shodan.io/ Shodan Internet Search Engine]
*'''VirusTotal:''' [https://www.virustotal.com/ VirusTotal Malware Analysis Service]

[[MediaWiki]] [[LocalSettings]] [[Extensions]] [[Database]] [[Security]] [[HTTPS]] [[Firewall]] [[PHP]] [[Web server]] [[User management]]

[[Category:MediaWiki Security]]

== Start Trading Now ==
[https://affiliate.iqbroker.com/redir/?aff=1085&instrument=options_WIKI Sign up at IQ Option] (Minimum deposit $10)
[http://redir.forex.pm/pocketo Open an account at Pocket Option] (Minimum deposit $5)
=== Join Our Community ===
Subscribe to our Telegram channel [https://t.me/strategybin @strategybin] to receive:
✓ Daily trading signals
✓ Exclusive strategy analysis
✓ Market trend alerts
✓ Educational materials for beginners