430 lines
14 KiB
HTML
430 lines
14 KiB
HTML
|
<!DOCTYPE html>
|
||
|
|
<!--[if IE 8]><html class="no-js lt-ie9" lang="en" > <![endif]-->
|
||
|
|
<!--[if gt IE 8]><!--> <html class="no-js" lang="en" > <!--<![endif]-->
|
||
|
|
<head>
|
||
|
|
<meta charset="utf-8">
|
||
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
|
|
|
||
|
|
|
||
|
|
<link rel="shortcut icon" href="../img/favicon.ico">
|
||
|
|
<title>Server security - Shaarli Documentation</title>
|
||
|
|
<link href='https://fonts.googleapis.com/css?family=Lato:400,700|Roboto+Slab:400,700|Inconsolata:400,700' rel='stylesheet' type='text/css'>
|
||
|
|
|
||
|
|
<link rel="stylesheet" href="../css/theme.css" type="text/css" />
|
||
|
|
<link rel="stylesheet" href="../css/theme_extra.css" type="text/css" />
|
||
|
|
<link rel="stylesheet" href="../css/highlight.css">
|
||
|
|
<link href="../github-markdown.css" rel="stylesheet">
|
||
|
|
|
||
|
|
<script>
|
||
|
|
// Current page data
|
||
|
|
var mkdocs_page_name = "Server security";
|
||
|
|
var mkdocs_page_input_path = "Server-security.md";
|
||
|
|
var mkdocs_page_url = "/Server-security/";
|
||
|
|
</script>
|
||
|
|
|
||
|
|
<script src="../js/jquery-2.1.1.min.js"></script>
|
||
|
|
<script src="../js/modernizr-2.8.3.min.js"></script>
|
||
|
|
<script type="text/javascript" src="../js/highlight.pack.js"></script>
|
||
|
|
|
||
|
|
</head>
|
||
|
|
|
||
|
|
<body class="wy-body-for-nav" role="document">
|
||
|
|
|
||
|
|
<div class="wy-grid-for-nav">
|
||
|
|
|
||
|
|
|
||
|
|
<nav data-toggle="wy-nav-shift" class="wy-nav-side stickynav">
|
||
|
|
<div class="wy-side-nav-search">
|
||
|
|
<a href=".." class="icon icon-home"> Shaarli Documentation</a>
|
||
|
|
<div role="search">
|
||
|
|
<form id ="rtd-search-form" class="wy-form" action="../search.html" method="get">
|
||
|
|
<input type="text" name="q" placeholder="Search docs" />
|
||
|
|
</form>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
<div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
|
||
|
|
<ul class="current">
|
||
|
|
|
||
|
|
|
||
|
|
<li class="toctree-l1">
|
||
|
|
|
||
|
|
<a class="" href="..">Home</a>
|
||
|
|
</li>
|
||
|
|
|
||
|
|
<li class="toctree-l1">
|
||
|
|
|
||
|
|
<span class="caption-text">Setup</span>
|
||
|
|
<ul class="subnav">
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Download-and-Installation/">Download and Installation</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Upgrade-and-migration/">Upgrade and migration</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Server-requirements/">Server requirements</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Server-configuration/">Server configuration</a>
|
||
|
|
</li>
|
||
|
|
<li class=" current">
|
||
|
|
|
||
|
|
<a class="current" href="./">Server security</a>
|
||
|
|
<ul class="subnav">
|
||
|
|
|
||
|
|
<li class="toctree-l3"><a href="#phpini">php.ini</a></li>
|
||
|
|
|
||
|
|
<ul>
|
||
|
|
|
||
|
|
<li><a class="toctree-l4" href="#locate-ini-files">Locate .ini files</a></li>
|
||
|
|
|
||
|
|
</ul>
|
||
|
|
|
||
|
|
|
||
|
|
<li class="toctree-l3"><a href="#fail2ban">fail2ban</a></li>
|
||
|
|
|
||
|
|
<ul>
|
||
|
|
|
||
|
|
<li><a class="toctree-l4" href="#read-shaarli-logs-to-ban-ips">Read Shaarli logs to ban IPs</a></li>
|
||
|
|
|
||
|
|
</ul>
|
||
|
|
|
||
|
|
|
||
|
|
<li class="toctree-l3"><a href="#robots-restricting-search-engines-and-web-crawler-traffic">Robots - Restricting search engines and web crawler traffic</a></li>
|
||
|
|
|
||
|
|
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Shaarli-configuration/">Shaarli configuration</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Plugins/">Plugins</a>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
|
||
|
|
<li class="toctree-l1">
|
||
|
|
|
||
|
|
<span class="caption-text">Docker</span>
|
||
|
|
<ul class="subnav">
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Docker-101/">Docker 101</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Shaarli-images/">Shaarli images</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Reverse-proxy-configuration/">Reverse proxy configuration</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Docker-resources/">Docker resources</a>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
|
||
|
|
<li class="toctree-l1">
|
||
|
|
|
||
|
|
<span class="caption-text">Usage</span>
|
||
|
|
<ul class="subnav">
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Features/">Features</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Bookmarklet/">Bookmarklet</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Browsing-and-searching/">Browsing and searching</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Firefox-share/">Firefox share</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../RSS-feeds/">RSS feeds</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../REST-API/">REST API</a>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
|
||
|
|
<li class="toctree-l1">
|
||
|
|
|
||
|
|
<span class="caption-text">How To</span>
|
||
|
|
<ul class="subnav">
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Backup,-restore,-import-and-export/">Backup, restore, import and export</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Copy-an-existing-installation-over-SSH-and-serve-it-locally/">Copy an existing installation over SSH and serve it locally</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Create-and-serve-multiple-Shaarlis-(farm)/">Create and serve multiple Shaarlis (farm)</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Download-CSS-styles-from-an-OPML-list/">Download CSS styles from an OPML list</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Datastore-hacks/">Datastore hacks</a>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
|
||
|
|
<li class="toctree-l1">
|
||
|
|
|
||
|
|
<a class="" href="../Troubleshooting/">Troubleshooting</a>
|
||
|
|
</li>
|
||
|
|
|
||
|
|
<li class="toctree-l1">
|
||
|
|
|
||
|
|
<span class="caption-text">Development</span>
|
||
|
|
<ul class="subnav">
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Development-guidelines/">Development guidelines</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Continuous-integration-tools/">Continuous integration tools</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../GnuPG-signature/">GnuPG signature</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Coding-guidelines/">Coding guidelines</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Directory-structure/">Directory structure</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../3rd-party-libraries/">3rd party libraries</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Plugin-System/">Plugin System</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Release-Shaarli/">Release Shaarli</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Versioning-and-Branches/">Versioning and Branches</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Security/">Security</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Static-analysis/">Static analysis</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Theming/">Theming</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Unit-tests/">Unit tests</a>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
|
||
|
|
<li class="toctree-l1">
|
||
|
|
|
||
|
|
<span class="caption-text">About</span>
|
||
|
|
<ul class="subnav">
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../FAQ/">FAQ</a>
|
||
|
|
</li>
|
||
|
|
<li class="">
|
||
|
|
|
||
|
|
<a class="" href="../Community-&-Related-software/">Community & Related software</a>
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
|
||
|
|
</ul>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
</nav>
|
||
|
|
|
||
|
|
<section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">
|
||
|
|
|
||
|
|
|
||
|
|
<nav class="wy-nav-top" role="navigation" aria-label="top navigation">
|
||
|
|
<i data-toggle="wy-nav-top" class="fa fa-bars"></i>
|
||
|
|
<a href="..">Shaarli Documentation</a>
|
||
|
|
</nav>
|
||
|
|
|
||
|
|
|
||
|
|
<div class="wy-nav-content">
|
||
|
|
<div class="rst-content">
|
||
|
|
<div role="navigation" aria-label="breadcrumbs navigation">
|
||
|
|
<ul class="wy-breadcrumbs">
|
||
|
|
<li><a href="..">Docs</a> »</li>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<li>Setup »</li>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
<li>Server security</li>
|
||
|
|
<li class="wy-breadcrumbs-aside">
|
||
|
|
|
||
|
|
<a href="https://github.com/shaarli/Shaarli/edit/master/docs/Server-security.md"
|
||
|
|
class="icon icon-github"> Edit on GitHub</a>
|
||
|
|
|
||
|
|
</li>
|
||
|
|
</ul>
|
||
|
|
<hr/>
|
||
|
|
</div>
|
||
|
|
<div role="main">
|
||
|
|
<div class="section">
|
||
|
|
|
||
|
|
<h2 id="phpini">php.ini</h2>
|
||
|
|
<p>PHP settings are defined in:
|
||
|
|
- a main configuration file, usually found under <code>/etc/php5/php.ini</code>; some distributions provide different configuration environments, e.g.
|
||
|
|
- <code>/etc/php5/php.ini</code> - used when running console scripts
|
||
|
|
- <code>/etc/php5/apache2/php.ini</code> - used when a client requests PHP resources from Apache
|
||
|
|
- <code>/etc/php5/php-fpm.conf</code> - used when PHP requests are proxied to PHP-FPM
|
||
|
|
- additional configuration files/entries, depending on the installed/enabled extensions:
|
||
|
|
- <code>/etc/php/conf.d/xdebug.ini</code></p>
|
||
|
|
<h3 id="locate-ini-files">Locate .ini files</h3>
|
||
|
|
<h4 id="console-environment">Console environment</h4>
|
||
|
|
<pre><code class="bash">$ php --ini
|
||
|
|
Configuration File (php.ini) Path: /etc/php
|
||
|
|
Loaded Configuration File: /etc/php/php.ini
|
||
|
|
Scan for additional .ini files in: /etc/php/conf.d
|
||
|
|
Additional .ini files parsed: /etc/php/conf.d/xdebug.ini
|
||
|
|
</code></pre>
|
||
|
|
|
||
|
|
<h4 id="server-environment">Server environment</h4>
|
||
|
|
<ul>
|
||
|
|
<li>create a <code>phpinfo.php</code> script located in a path supported by the web server, e.g.<ul>
|
||
|
|
<li>Apache (with user dirs enabled): <code>/home/myself/public_html/phpinfo.php</code></li>
|
||
|
|
<li><code>/var/www/test/phpinfo.php</code></li>
|
||
|
|
</ul>
|
||
|
|
</li>
|
||
|
|
<li>make sure the script is readable by the web server user/group (usually, <code>www</code>, <code>www-data</code> or <code>httpd</code>)</li>
|
||
|
|
<li>access the script from a web browser</li>
|
||
|
|
<li>look at the <em>Loaded Configuration File</em> and <em>Scan this dir for additional .ini files</em> entries</li>
|
||
|
|
</ul>
|
||
|
|
<pre><code class="php"><?php phpinfo(); ?>
|
||
|
|
</code></pre>
|
||
|
|
|
||
|
|
<h2 id="fail2ban">fail2ban</h2>
|
||
|
|
<p><code>fail2ban</code> is an intrusion prevention framework that reads server (Apache, SSH, etc.) and uses <code>iptables</code> profiles to block brute-force attempts:
|
||
|
|
- <a href="http://www.fail2ban.org/wiki/index.php/Main_Page">Official website</a>
|
||
|
|
- <a href="https://github.com/fail2ban/fail2ban">Source code</a></p>
|
||
|
|
<h3 id="read-shaarli-logs-to-ban-ips">Read Shaarli logs to ban IPs</h3>
|
||
|
|
<p>Example configuration:
|
||
|
|
- allow 3 login attempts per IP address
|
||
|
|
- after 3 failures, permanently ban the corresponding IP adddress</p>
|
||
|
|
<p><code>/etc/fail2ban/jail.local</code></p>
|
||
|
|
<pre><code class="ini">[shaarli-auth]
|
||
|
|
enabled = true
|
||
|
|
port = https,http
|
||
|
|
filter = shaarli-auth
|
||
|
|
logpath = /var/www/path/to/shaarli/data/log.txt
|
||
|
|
maxretry = 3
|
||
|
|
bantime = -1
|
||
|
|
</code></pre>
|
||
|
|
|
||
|
|
<p><code>/etc/fail2ban/filter.d/shaarli-auth.conf</code></p>
|
||
|
|
<pre><code class="ini">[INCLUDES]
|
||
|
|
before = common.conf
|
||
|
|
[Definition]
|
||
|
|
failregex = \s-\s<HOST>\s-\sLogin failed for user.*$
|
||
|
|
ignoreregex =
|
||
|
|
</code></pre>
|
||
|
|
|
||
|
|
<h2 id="robots-restricting-search-engines-and-web-crawler-traffic">Robots - Restricting search engines and web crawler traffic</h2>
|
||
|
|
<p>Creating a <code>robots.txt</code> with the following contents at the root of your Shaarli installation will prevent <em>honest</em> web crawlers from indexing each and every link and Daily page from a Shaarli instance, thus getting rid of a certain amount of unsollicited network traffic.</p>
|
||
|
|
<pre><code>User-agent: *
|
||
|
|
Disallow: /
|
||
|
|
</code></pre>
|
||
|
|
|
||
|
|
<p>See:
|
||
|
|
- http://www.robotstxt.org/
|
||
|
|
- http://www.robotstxt.org/robotstxt.html
|
||
|
|
- http://www.robotstxt.org/meta.html</p>
|
||
|
|
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
<footer>
|
||
|
|
|
||
|
|
<div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
|
||
|
|
|
||
|
|
<a href="../Shaarli-configuration/" class="btn btn-neutral float-right" title="Shaarli configuration">Next <span class="icon icon-circle-arrow-right"></span></a>
|
||
|
|
|
||
|
|
|
||
|
|
<a href="../Server-configuration/" class="btn btn-neutral" title="Server configuration"><span class="icon icon-circle-arrow-left"></span> Previous</a>
|
||
|
|
|
||
|
|
</div>
|
||
|
|
|
||
|
|
|
||
|
|
<hr/>
|
||
|
|
|
||
|
|
<div role="contentinfo">
|
||
|
|
<!-- Copyright etc -->
|
||
|
|
|
||
|
|
</div>
|
||
|
|
|
||
|
|
Built with <a href="http://www.mkdocs.org">MkDocs</a> using a <a href="https://github.com/snide/sphinx_rtd_theme">theme</a> provided by <a href="https://readthedocs.org">Read the Docs</a>.
|
||
|
|
</footer>
|
||
|
|
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
</section>
|
||
|
|
|
||
|
|
</div>
|
||
|
|
|
||
|
|
<div class="rst-versions" role="note" style="cursor: pointer">
|
||
|
|
<span class="rst-current-version" data-toggle="rst-current-version">
|
||
|
|
|
||
|
|
<a href="https://github.com/shaarli/Shaarli" class="fa fa-github" style="float: left; color: #fcfcfc"> GitHub</a>
|
||
|
|
|
||
|
|
|
||
|
|
<span><a href="../Server-configuration/" style="color: #fcfcfc;">« Previous</a></span>
|
||
|
|
|
||
|
|
|
||
|
|
<span style="margin-left: 15px"><a href="../Shaarli-configuration/" style="color: #fcfcfc">Next »</a></span>
|
||
|
|
|
||
|
|
</span>
|
||
|
|
</div>
|
||
|
|
<script src="../js/theme.js"></script>
|
||
|
|
|
||
|
|
</body>
|
||
|
|
</html>
|