Security recommendations

All web application software is highly complex, and every application has security issues that are found from time to time, usually involving some combination of input that the programmers did not anticipate. The Moodle project takes security seriously, and is continuously improving Moodle to close such holes as we find them.

Introduction

• This page contains important security measures for your Moodle installation.
• You should report security problems directly at http://security.moodle.org - because developers might overlook it elsewhere, and they must not be released to general public until they are solved (to prevent attacks).
• You should not post actual exploits in the tracker or forums, for exactly the same reasons.

Simple security measures

• The best security strategy is a good backup! But you don't have a good backup unless you are able to restore it. Test your restoration procedures!
• Load only software or services you will use
• Perform regular updates
• Model your security after the layers of clothing you wear on a cold winter day

Basic recommendations

• Update Moodle regularly on each release

Published security holes draw crackers attention after release. The older the version, the more vulnerabilities it is likely to contain.

• Disable register globals

This will help prevent against possible XSS problems in third-party scripts.

• Use strong passwords for admin and teachers

Choosing "difficult" passwords is a basic security practice to protect against "brute force" cracking of accounts.

• Only give teacher accounts to trusted users. Avoid creating public sandboxes with free teacher accounts on production servers.

Teacher accounts have much freer permissions and it is easier to create situations where data can be abused or stolen.

• Separate your systems as much as possible

Another basic security technique is to use different passwords on different systems, use different machines for different services and so on. This will prevent damage being widespread even if one account or one server is compromised.

Run regular updates

• Use auto update systems
• Windows Update
• Linux: up2date, yum, apt-get

Consider automating updates with a script scheduled via cron

• Mac OSX update system
• Stay current with php, apache, and moodle

Use mailing lists to stay updated

• CERT - http://www.us-cert.gov/cas/signup.html
• PHP - http://www.php.net/mailing-lists.php - sign up for Announcements list
• MySQL - http://lists.mysql.com - sign up for MySQL Announcements

Firewalls

• Security experts recommend a dual firewall

Differing hardware/software combinations

• Disabling unused services is often as effective as a firewall

Use netstat -a to review open network ports

• Not a guarantee of protection
• Allow ports

80, 443(ssl), and 9111 (for chat),

Remote admin: ssh 22, or rpd 3389

Password policy

Template:Moodle 1.9In Moodle 1.9 onwards, a password policy may be set up via Administration > Security > Site policies.

There is a check box to determine if password complexity should be enforced or not, the option to set the minimum length of the password, the minimum number of digits, the minimum number of lowercase characters, the minimum number of uppercase characters and the minimum number of non alphanumeric characters.

If a user enters a password that does not meet those requirements, they are given an error message indicating the nature of the problem with the entered password.

Enforcing password complexity along with requiring users to change their initial password go a long way in helping ensure that users choose and are in fact using "good passwords".

Be prepared for the worst

• Have backups ready
• Practice recovery procedures ahead of time
• Use a rootkit detector on a regular basis
  • Linux/MacOSX - http://www.chkrootkit.org/
  • Windows - http://www.sysinternals.com/Utilities/RootkitRevealer.html

Moodle security alerts

• Register your site with Moodle.org

Registered users receive email alerts

• Security alerts also posted online
• Web - http://moodle.org/security
• RSS feed - http://moodle.org/rss/file.php/1/1/forum/996/rss.xml

Miscellaneous considerations

These are all things you might consider that impact your overall security:

• Turn off opentogoogle, esp for K12 sites
• Use SSL, httpslogins=yes
• Disable guest access by hiding the guest login button (in Administration > Users > Authentication)
• Place enrollment keys on all courses
• Use good passwords (for Moodle 1.9 onwards, set up a password policy)
• Use the secure forms setting
• Set the mysql root user password
• Turn off mysql network access

Most secure/paranoid file permissions

Note: The following information applies to Linux/Unix based installations only, as MS Windows permission system is quite different.

Depending on your server setup there are two differente scenarios:

1. You are running Moodle on your own dedicated server.
2. You are running Moodle on a shared hosting environment.

In the sections below, you are required to use the web service user account to set the permissions, so you need to know it. This can vary quite a bit from server to server but if this feature has not been disabled, you can go to http://your.moodle.site/admin/phpinfo.php (logging in as admin), and then search for the line that reads 'User/Group', inside the 'apache' table. For example, I get 'www-data' for the user account and 'www-data' for the group too.

Running Moodle on a dedicated server

Assuming you are running Moodle on a sealed server (i.e. no user logins allowed on the machine) and that root takes care of the modifications to both moodle code and moodle config (config.php), then this are the most tight permissions I can think of:

1. moodledata directory and all of its contents (and subdirs, includes sessions):

owner: apache user (apache, httpd, www-data, whatever)
group: apache group (apache, httpd, www-data, whatever)
perms: 700 on directories, 600 on files

2. moodle directory and all of its contents and subdirs (including config.php):

owner: root
group: root
perms: 755 on directories, 644 on files.

If you allow local logins for regular users, then 2. should be:

owner: root
group: apache group
perms: 750 on directories, 640 on files

Think of these permissions as the most paranoid ones. You can be secure enough with less tighter permissions, both in moodledata and moodle directories (and subdirectories).

Running Moodle on a shared hosting environment

If you are running Moodle on a shared hosting environment, then above permissions are probably wrong. If you set 700 as the permission for directories (and 600 for files), you are probably denying the web service account access to your directories and files.

If you want to tighten your permissions as much as possible, you will need to know:

1. the user account and the group the web service is running under (see above).
2. the owner of the directories/files (this should normally be your client user account), and the group of the directories/files. You can usually get this information from the file manager of your hosting control panel. Go to the moodle folder and pick any directory or file and try to view/change the permissions, owner and group of that file. That would normally show the current permissions, owner and group.

Then, depending on the following scenarios you could use a different set of permissions (listed from more secure to less secure):

1. if the web service account and the owner of the directories/files is the same, you could use 700 for directories and 600 for files.
2. if the web service group and the group of the directories/files is the same, you could use 770 for directories and 660 for the files.
3. if none of the above, you'll need to use 777 for directories and 666 for files (which is less secure, but it is your only option).

See also

• Security FAQ

Using Moodle forum discussions:

• Guide to Securing your Moodle Server
• How to secure Moodle website from hacking including recommendations on emergency recovery