Security - Revision history

Jessica: /* Security settings in ICA-AtoM */

2012-08-30T21:10:38Z

Security settings in ICA-AtoM

2012-08-30T19:12:19Z

Server security

2012-08-30T19:10:38Z

Server security

2012-08-30T17:19:52Z

Upload security

2012-08-30T17:15:43Z

2012-08-30T17:04:39Z

Upload security

2012-08-29T22:23:08Z

General PHP recommendations: remove duplicate "register_globals" line

2012-08-29T22:21:57Z

Application security

2012-08-29T22:21:28Z

2012-08-29T22:21:02Z

Security settings in ICA-AtoM

@@ Line 26: / Line 26: @@
 *# Special characters
-* '''limit_admin_ip''': limit incoming requests for all administrator functionality to an IP address  IP range. Two examples:
+* '''limit_admin_ip''': limit incoming requests for all administrator functionality to an IP address or an IP range. Two examples:
 *# 192.168.0.1
 *# 192.168.0.1-192.168.0.255

@@ Line 40: / Line 40: @@
 == Server security ==
-Because '''AtoM''' is a web application, it is necessary to adequately secure the web server against attacks, both at the operating system (e.g. Windows, Mac OS X, Ubuntu Linux) and web server application (e.g. Apache, IIS, nginx) level.  The web server environment should be configured by an experienced systems administrator in accordance with current "best practice" standards. For developers, see the [[Qubit:Security|Qubit Toolkit Security]] documentation for more information about sensitive files within '''AtoM''' that may require extra protection. For administrators, see the ICA-AtoM Security documentation for further information.
+Because '''AtoM''' is a web application, it is necessary to adequately secure the web server against attacks, both at the operating system (e.g. Windows, Mac OS X, Ubuntu Linux) and web server application (e.g. Apache, IIS, nginx) level.  The web server environment should be configured by an experienced systems administrator in accordance with current "best practice" standards. For developers, see the [[Qubit:Security|Qubit Toolkit Security]] documentation for more information about sensitive files within '''AtoM''' that may require extra protection.
 === Stay up to date ===

@@ Line 40: / Line 40: @@
 == Server security ==
-Because '''AtoM''' is a web application, it is necessary to adequately secure the web server against attacks, both at the operating system (e.g. Windows, Mac OS X, Ubuntu Linux) and web server application (e.g. Apache, IIS, nginx) level.  The web server environment should be configured by an experienced systems administrator in accordance with current "best practice" standards. See the [[Qubit:Security|Qubit Toolkit Security]] documentation for more information about sensitive files within '''AtoM''' that may require extra protection.
+Because '''AtoM''' is a web application, it is necessary to adequately secure the web server against attacks, both at the operating system (e.g. Windows, Mac OS X, Ubuntu Linux) and web server application (e.g. Apache, IIS, nginx) level.  The web server environment should be configured by an experienced systems administrator in accordance with current "best practice" standards. For developers, see the [[Qubit:Security|Qubit Toolkit Security]] documentation for more information about sensitive files within '''AtoM''' that may require extra protection. For administrators, see the ICA-AtoM Security documentation for further information.
 === Stay up to date ===

@@ Line 78: / Line 78: @@
 For instance, the following code for Apache/mod_php will do the trick:
-<syntaxhighlight lang="apache">
+<pre>
 <Directory "/var/www/icaatom/uploads">
     # Ignore .htaccess files
@@ Line 91: / Line 91: @@
     # If you've other scripting languages, disable them too.
 </Directory>
-</syntaxhighlight>
+</pre>
 <hr />
 This document is partially based on the excellent [http://www.mediawiki.org/wiki/Manual:Security MediaWiki security page], it is strongly recommended to read that too.

@@ Line 78: / Line 78: @@
 For instance, the following code for Apache/mod_php will do the trick:
-<source lang="apache">
+<syntaxhighlight lang="apache">
 <Directory "/var/www/icaatom/uploads">
     # Ignore .htaccess files
@@ Line 91: / Line 91: @@
     # If you've other scripting languages, disable them too.
 </Directory>
-</source>
+</syntaxhighlight>
 <hr />
 This document is partially based on the excellent [http://www.mediawiki.org/wiki/Manual:Security MediaWiki security page], it is strongly recommended to read that too.

@@ Line 59: / Line 59: @@
 * Unless you require it specifically, disable [http://php.net/manual/en/filesystem.configuration.php#ini.allow-url-fopen allow_url_fopen].
 * Set [http://php.net/session session.use_trans_sid] off.
 === General MySQL recommendations ===

@@ Line 10: / Line 10: @@
 == Application security ==
-AtoM's built-in security features include:
+'''AtoM''''s built-in security features include:
 * User passwords are hashed using the [http://en.wikipedia.org/wiki/SHA-1 SHA-1] hashing algorithm with a randomly generated [http://en.wikipedia.org/wiki/Salt_%28cryptography%29 salt]
 * Protection against [http://en.wikipedia.org/wiki/SQL_injection SQL Injection] attacks via the [http://php.net/manual/en/book.pdo.php PHP PDO] database interface

@@ Line 3: / Line 3: @@
 '''AtoM''' implements current web application best practice for '''Security''', but creating a fully secure system requires secure practices to be observed at three levels:
-# web application (AtoM) security
+# Web application (AtoM) security
-# client-side (web browser) security
+# Client-side (web browser) security
-# server-side security
+# Server-side security

@@ Line 16: / Line 16: @@
 === Security settings in ICA-AtoM ===
-In [[Release 1.3]] three new security settings are added to '''AtoM''':
+In [[Release 1.3]] three new security settings were added to '''AtoM''':
 * '''require_ssl_admin''': see [[Qubit:TLS|TLS]] for more details