Installation security hints - Revision history

Denischenu: Rremove sample : see issue #20618 on mantis

2026-07-23T15:14:27Z

Rremove sample : see issue #20618 on mantis

@@ Line 61: / Line 61: @@
 *The upload/directory and all its sub-directories must also have set ''Read & Write'' permissions in order to enable pictures and media files upload
 * All other directories and files can be set to ''Read Only''
 ===Setting file permissions on a hosted web server=== <!--T:26-->

C schmitz: Text replacement - " enclose="div"" to ""

2022-02-16T13:10:18Z

Text replacement - " enclose="div"" to ""

← Older revision		Revision as of 15:10, 16 February 2022
Line 127:		Line 127:

	<!--T:36-->		<!--T:36-->
	<syntaxhighlight lang="php~~" enclose="div~~">		<syntaxhighlight lang="php">

	<!--T:58-->		<!--T:58-->
Line 146:		Line 146:

	<!--T:68-->		<!--T:68-->
	<syntaxhighlight lang="php~~" enclose="div~~">		<syntaxhighlight lang="php">
	'basePath' => '/var/www/htdocs/limesurvey',		'basePath' => '/var/www/htdocs/limesurvey',
	'runtimePath' => '/var/www/htdocs/limesurvey/tmp/runtime',		'runtimePath' => '/var/www/htdocs/limesurvey/tmp/runtime',

Han: Marked this version for translation

2021-03-09T10:20:37Z

Marked this version for translation

← Older revision		Revision as of 12:20, 9 March 2021
Line 9:		Line 9:
	LimeSurvey relies on its own security, which is activated by default. The authors of this software take no responsibility and makes no claims regarding the appropriateness or security level of this software. However, we take security issues very seriously and react quickly. Therefore, if you know of any security problems within LimeSurvey, please let us know either by sending us an email to [mailto:info@limesurvey.org info@limesurvey.org] or by opening a bug report in our [http://bugs.limesurvey.org bug tracker] (please mark it as private).		LimeSurvey relies on its own security, which is activated by default. The authors of this software take no responsibility and makes no claims regarding the appropriateness or security level of this software. However, we take security issues very seriously and react quickly. Therefore, if you know of any security problems within LimeSurvey, please let us know either by sending us an email to [mailto:info@limesurvey.org info@limesurvey.org] or by opening a bug report in our [http://bugs.limesurvey.org bug tracker] (please mark it as private).

	==Web server restriction==		==Web server restriction== <!--T:69-->

			<!--T:70-->
	If you use apache, LimeSurvey include different htaccess file for restriction. verify you alow included htaccess with <code>AllowOverride</code>.		If you use apache, LimeSurvey include different htaccess file for restriction. verify you alow included htaccess with <code>AllowOverride</code>.

			<!--T:71-->
	With other webserver or if you want to use <code>AllowOverride None</code> : you must		With other webserver or if you want to use <code>AllowOverride None</code> : you must

			<!--T:72-->
	* (option) disable access to all files in application, protected, framework and themes/*/views		* (option) disable access to all files in application, protected, framework and themes/*/views
	* disable access to file uploade by user /upload/surveys/.*/fu_[a-z0-9]		* disable access to file uploade by user /upload/surveys/.*/fu_[a-z0-9]
	* (option) disable access on executable file in upload directory		* (option) disable access on executable file in upload directory

			<!--T:73-->
	You can find a sample for nginx on our [[General_FAQ#With_nginx_webserver\|General Faq]]		You can find a sample for nginx on our [[General_FAQ#With_nginx_webserver\|General Faq]]

Line 159:		Line 163:


	=== Content Security Policy (CSP) ===		=== Content Security Policy (CSP) === <!--T:74-->

			<!--T:75-->
	'''DISCLAIMER - The CSP provided here is an example only and is not meant to used verbatim. It is meant as a starting point and you MUST adapt it to your needs and test it thoroughly.'''		'''DISCLAIMER - The CSP provided here is an example only and is not meant to used verbatim. It is meant as a starting point and you MUST adapt it to your needs and test it thoroughly.'''
	<nowiki><IfModule mod_headers.c>		<nowiki><IfModule mod_headers.c>

DenisChenu: Web server restriction

2021-02-11T08:00:19Z

Web server restriction

@@ Line 8: / Line 8: @@
 <!--T:3-->
 LimeSurvey relies on its own security, which is activated by default. The authors of this software take no responsibility and makes no claims regarding the appropriateness or security level of this software. However, we take security issues very seriously and react quickly. Therefore, if you know of any security problems within LimeSurvey, please let us know either by sending us an email to [mailto:info@limesurvey.org info@limesurvey.org] or by opening a bug report in our [http://bugs.limesurvey.org bug tracker] (please mark it as private).
 ==Linux file permissions== <!--T:4-->

NPEUWebmaster at 10:40, 14 January 2021

2021-01-14T10:40:11Z

← Older revision		Revision as of 12:40, 14 January 2021
Line 146:		Line 146:
	Also, '''don't use "admin" as the default user'''. Go to your MySQL database (or the one in which you installed LimeSurvey) and change default user name "admin" to whatever you prefer (e.g. "admin_xyz"). It will now be much harder to guess the administrator's new user name. Remember, this is one of the two variables intruders can use to gain access. The admin password is the other variable. So choose both of them with extreme caution.		Also, '''don't use "admin" as the default user'''. Go to your MySQL database (or the one in which you installed LimeSurvey) and change default user name "admin" to whatever you prefer (e.g. "admin_xyz"). It will now be much harder to guess the administrator's new user name. Remember, this is one of the two variables intruders can use to gain access. The admin password is the other variable. So choose both of them with extreme caution.


			=== Content Security Policy (CSP) ===

			'''DISCLAIMER - The CSP provided here is an example only and is not meant to used verbatim. It is meant as a starting point and you MUST adapt it to your needs and test it thoroughly.'''
			<nowiki><IfModule mod_headers.c>
			Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests" "expr=%{CONTENT_TYPE} =~ m#text\/(html\|javascript)\|application\/pdf\|xml#i"
			</IfModule></nowiki>
	</translate>		</translate>

StuartJKondziella at 14:59, 18 October 2017

2017-10-18T14:59:58Z

← Older revision		Revision as of 16:59, 18 October 2017
Line 144:		Line 144:

	<!--T:57-->		<!--T:57-->
	Also, '''don't use "admin" as the default user'''. Go to your MySQL database (or the one in which you installed LimeSurvey ~~on different database~~) and change default user name "admin" to whatever you prefer (e.g. "admin_xyz"). It will be ~~now~~ much harder to guess administrator's new user name. Remember, this is one of the two variables intruders can use to gain access. The admin password is the other variable. So choose both of them with extreme ~~care~~.		Also, '''don't use "admin" as the default user'''. Go to your MySQL database (or the one in which you installed LimeSurvey) and change default user name "admin" to whatever you prefer (e.g. "admin_xyz"). It will now be much harder to guess the administrator's new user name. Remember, this is one of the two variables intruders can use to gain access. The admin password is the other variable. So choose both of them with extreme caution.

	</translate>		</translate>

StuartJKondziella at 14:58, 18 October 2017

2017-10-18T14:58:52Z

← Older revision		Revision as of 16:58, 18 October 2017
Line 105:		Line 105:

	<!--T:35-->		<!--T:35-->
	Another way to secure this information can be to put the ~~certain~~ information from the /application/config/config.php file in a non-web directory, i.e. for Apache users this is the directory above the htdocs (also known as public_html or www) folder. Basically, you will use config.php, but have one line in it - a line that includes the file with ACTUAL configuration information (ex: <code><?php return include("/home/hostfolder/safedata/configreal.php"); ?></code>). Remove all actual configuration information from /application/config/config.php and paste it into the other file (configreal.php) that is mentioned in the /application/config/'''config.php''' file. This other file should be located in a non-web directory. Then /application/config/config.php will not contain database passwords, etc. - just the name of the file that '''DOES''' contain the database info.		Another way to secure this information can be to put the information from the /application/config/config.php file in a non-web directory, i.e. for Apache users this is the directory above the htdocs (also known as public_html or www) folder. Basically, you will use config.php, but have one line in it - a line that includes the file with ACTUAL configuration information (ex: <code><?php return include("/home/hostfolder/safedata/configreal.php"); ?></code>). Remove all actual configuration information from /application/config/config.php and paste it into the other file (configreal.php) that is mentioned in the /application/config/'''config.php''' file. This other file should be located in a non-web directory. Then, /application/config/config.php will not contain database passwords etc. - just the name of the file that '''DOES''' contain the database info.

	<!--T:67-->		<!--T:67-->
	This avoids having to change all the other files that include /application/config/config.php, since config.php 're-directs them' towards the configuration file that is located in a non-web directory ~~that~~ includes all the real configuration information. However, you will need to edit configreal.php and change the follow parameters to use absolute directory paths to work properly:		This avoids having to change all the other files that include /application/config/config.php, since config.php 're-directs them' towards the configuration file that is located in a non-web directory which includes all the real configuration information. However, you will need to edit configreal.php and change the follow parameters to use absolute directory paths to work properly:

	<!--T:36-->		<!--T:36-->

StuartJKondziella at 14:56, 18 October 2017

2017-10-18T14:56:16Z

← Older revision		Revision as of 16:56, 18 October 2017
Line 91:		Line 91:

	<!--T:33-->		<!--T:33-->
	The following are recommendations only. LimeSurvey in general is very safe without these additional ~~measure~~. If you however collect extremely sensitive data a little additional security can help:		The following are recommendations only. LimeSurvey in general is very safe without these additional measures. If you however collect extremely sensitive data, a little additional security can help:

	===SSL usage=== <!--T:64-->		===SSL usage=== <!--T:64-->

StuartJKondziella at 14:52, 18 October 2017

2017-10-18T14:52:17Z

← Older revision		Revision as of 16:52, 18 October 2017
Line 74:		Line 74:
	<!--T:28-->		<!--T:28-->
	In the managed server case, the server needs write access to some directories in order for the script to work properly:		In the managed server case, the server needs write access to some directories in order for the script to work properly:
	*The "/limesurvey/tmp" directory is used for imports/uploads and should be set to ''Read & Write'' for your web server.		*The /limesurvey/tmp directory is used for imports/uploads and should be set to ''Read & Write'' for your web server
	*The upload/directory and all its sub-directories must also have ''Read & Write'' for your web server in order to enable pictures and media files upload.		*The upload/directory and all its sub-directories must also have ''Read & Write'' for your web server in order to enable pictures and media files upload
	* The other directories and files should be set to ''Read Only''.		* The other directories and files should be set to ''Read Only''

	<!--T:29-->		<!--T:29-->
	<div class="simplebox">[[File:help.png]] '''Hint:'''		<div class="simplebox">[[File:help.png]] '''Hint:'''
	* Depending on your web server configuration, you will have to chmod the rights on the writable folders to 755 or 777 to make it writable for the web server. Try 755 first, if it does not work, 'upgrade' to 777.		* Depending on your web server configuration, you will have to chmod the rights on the writable folders to 755 or 777 to make it writable for the web server. Try 755 first, if it does not work, 'upgrade' to 777
	* You can also try to remove other users' read access to config.php by setting this file's permissions to 750 - if it does not work, 'upgrade' to 755.</div>		* You can also try to remove other users' read access to config.php by setting this file's permissions to 750 - if it does not work, 'upgrade' to 755</div>

	==Windows file permissions== <!--T:30-->		==Windows file permissions== <!--T:30-->

StuartJKondziella at 14:47, 18 October 2017

2017-10-18T14:47:25Z

← Older revision		Revision as of 16:47, 18 October 2017
Line 41:		Line 41:
	<!--T:19-->		<!--T:19-->
	For the script to work properly, the write access to some directories is needed:		For the script to work properly, the write access to some directories is needed:
	*The /limesurvey/application/config directory requires ''Read & Write'' for saving the application configuration settings.		*The /limesurvey/application/config directory requires ''Read & Write'' for saving the application configuration settings
	*The '/limesurvey/tmp' directory and its sub-directories are used for imports/uploads and should be set to ''Read & Write'' for your web server.		*The /limesurvey/tmp directory and its sub-directories are used for imports/uploads and should be set to ''Read & Write'' for your web server
	*The upload/directory and all its sub-directories must also have set ''Read & Write'' permissions in order to enable pictures and media files upload.		*The upload/directory and all its sub-directories must also have set ''Read & Write'' permissions in order to enable pictures and media files upload
	* All other directories and files can be set to ''Read Only''.		* All other directories and files can be set to ''Read Only''

	<!--T:20-->		<!--T:20-->
	<div class="simplebox">[[File:help.png]] '''Hint:''' ~~Supposing~~ you've followed the above ~~recommendations~~ on owner/group, these settings can be applied by the following commands:		<div class="simplebox">[[File:help.png]] '''Hint:''' supposing you've followed the recommendations above on owner/group, these settings can be applied by the following commands:

	<!--T:21-->		<!--T:21-->