Hardening the xF installation

[psTubble27]

Is there a thread that deals with the question of hardening your xF installation?

Specifically I mean, whether we should do anything regarding:
-the /install directory
-the /data and /internal_data directories
-correctly using robots.txt (if at all)
-correctly using .htaccess (if at all)
-potential ways to harden admin.php
-etc.

 

[Paul B]

You don't need to do anything except follow the instructions here: http://xenforo.com/help/installation/

If you wish you can protect the directories, but it's not required: http://xenforo.com/community/thread...d-the-install-directory-using-htaccess.13768/

 

[digitalpoint]

Another thing that wouldn't be a bad idea is to disallow PHP from executing from within your data folder. In theory PHP files should never get in there, but it's just something my paranoid self does... if the web server is somehow exploited, it has permissions to write files to that directory... Would really not like to have someone being able to inject PHP files to my web server that they could then turn around and use/run.

Again... totally a paranoia thing, but better to disallow PHP running from there before someone finds an exploit for your web server, rather than wish you did after.

 

[Rigel Kentaurus]

Another thing that wouldn't be a bad idea is to disallow PHP from executing from within your data folder. In theory PHP files should never get in there, but it's just something my paranoid self does... if the web server is somehow exploited, it has permissions to write files to that directory... Would really not like to have someone being able to inject PHP files to my web server that they could then turn around and use/run.

Again... totally a paranoia thing, but better to disallow PHP running from there before someone finds an exploit for your web server, rather than wish you did after.

I don't think it's paranoia, it's common sense. If you can have that directory off the webserver, that's the best way to go.

That could not be the default because of all the people running on shared hosts that pretty much only have the webserver directory, but if you have the whole hd at your disposition doing that is a really good idea. I moved mine just after /home, not reachable by the webserver at all

Then just change it in config.php, config['internalDataPath']

 

[Rigel Kentaurus]

For people that want maximum security, some recommendations are

• .htaccess password protect the install directory, admin.php file, internal_data directory
• Password protect the library directory (nothing there gets called directly, always through the FrontController)
• Delete the /install directory, it is not needed for anything, and on the next upgrade you will have a new one anyway

Optional

• Move internal_data out of the web server directory

Why do all of that?

There might be a bug in one of the XenForo controllers, models or whatever, you don't want those files to be called directly
There might be a bug with the upload process, which enables users to upload php files to the internal_data directory, and then execute them
There might be a bug that gives the user access to the install script, and they could wipe your forum installation (has happened to me before)

Assuming the XenForo developers take care of everything (they are actually pretty good, and the package is rock solid), they are still humans, dealing with software, that is prone to bugs. And even assuming that XenForo were 100% perfect, you still have any addon you installed to worry about.

 

[psTubble27]

Look at this:
A MyBB forum was hacked, by the hacker including PHP code inside a Jpeg image:

http://www.webpagetest.org/forums/showthread.php?tid=10958
http://blog.patrickmeenan.com/2012/04/anatomy-of-mybb-forum-hack.html

Is XF hardened against this?

 

[Ghan_04]

I doubt that there is anything Xenforo could do to stop this as a piece of software. There aren't a whole lot of details here, but it seems that if you can upload this file to the server and get it to execute as a PHP file, you could be in trouble. I'd be interested to see what this image can do to a server that is using suexec and suhosin.

 

[digitalpoint]

Considering webpagetest.org is running Ngnix, I suspect it's more of an issue with a poorly configured Ngnix server... See this:

https://nealpoole.com/blog/2011/04/...trust-the-tutorials-check-your-configuration/