<p class="note">Maybe we should take a look at the security in this "Security" page. :-/ Should it be a protected page maintained directly by http://security.moodle.org? Please, give us your opinion on this in the "page comments" label in this page.</p>

All web application software is highly complex, and every application has security issues that are found from time to time, usually involving some conbination of input that the programmers did not anticipate. The Moodle project takes security seriously, and is continuously improving Moodle to close such holes as we find them.

==Before all==
*In this document, you will find important security measures for your Moodle installation.
*You should report security problems directly at http://security.moodle.org - because developers might overlook it elsewhere, and they must not be released to general public until they are solved (to prevent attacks).
*You should not post actual exploits in the bugtracker or forums, for exactly the same reasons.

==Simple security measures==
*The best security strategy is a good backup! But you don't have a good backup unless you are able to restore it. Test your restoration procedures!
*Load only software or services you will use
*Perform regular updates
*Model your security after the layers of clothing you wear on a cold winter day

==Basic recommendations==
*Update Moodle regularly on each release
**Published security holes draw crackers attention after release. The older the version, the more vulnerabilities it is likely to contain.
*Disable register globals
**This will help prevent against possible XSS problems in third-party scripts.
*Use strong passwords for admin and teachers
**Choosing "difficult" passwords is a basic security practice to protect against "brute force" cracking of accounts.
*Only give teacher accounts to trusted users. Avoid creating public sandboxes with free teacher accounts on production servers.
**Teacher accounts have much freer permissions and it is easier to create situations where data can be abused or stolen.
*Separate your systems as much as possible
**Another basic security technique is to use different passwords on different systems, use different machines for different services and so on. This will prevent damage being widespread even if one account or one server is compromised.

==Run regular updates==
*Use auto update systems
*Windows Update
*Linux: up2date, yum, apt-get
**Consider automating updates with a script scheduled via cron
*Mac OSX update system
*Stay current with php, apache, and moodle

==Use mailing lists to stay updated==
*CERT
**http://www.us-cert.gov/cas/signup.html
*PHP
**http://www.php.net/mailing-lists.php
**Sign up for Announcements list
*MySQL
**http://lists.mysql.com
**Sign up for MySQL Announcements

==Firewalls==
*Security experts recommend a dual firewall
**Differing hardware/software combinations
*Disabling unused services is often as effective as a firewall
**Use netstat -a to review open network ports
*Not a guarantee of protection
*Allow ports
**80, 443(ssl), and 9111 (for chat),
**Remote admin: ssh 22, or rpd 3389

==Be prepared for the worst==
*Have backups ready
*Practice recovery procedures ahead of time
*Use a rootkit detector on a regular basis
**Linux/MacOSX:
***http://www.chkrootkit.org/
**Windows:
***http://www.sysinternals.com/Utilities/RootkitRevealer.html

==Moodle security alerts==
*Register your site with Moodle.org
**Registered users receive email alerts
*Security alerts also posted online
*Web
**http://security.moodle.org/
*RSS feed
**http://security.moodle.org/rss/file.php/1/1/forum/1/rss.xml

==Miscellaneous considerations==
*These are all things you might consider that impact your overall security
*Turn off opentogoogle, esp for K12 sites
*Use SSL, httpslogins=yes
*Disable guest access
*Place enrollment keys on all courses
*Use good passwords
*Use the secure forms setting
*Set the mysql root user password
*Turn off mysql network access

==Most secure/paranoid file permissions==
Assuming you are running this on a sealed server (i.e. no user logins allowed on the machine) and that root
takes care of the modifications to both moodle code and moodle config (config.php),
then this are the most tight permissions I can think of:

1.- moodledata directory and all of its contents (and subdirs, includes sessions):
owner: apache user (apache, httpd, www-data, whatever).
group: apache group (apache, httpd, www-data, whatever)
perms: 700 on directories, 600 on files.

2.- moodle directory and all of its contents and subdirs (including config.php):
owner: root
group: root
perms: 755 on directories, 644 on files.

If you allow local logins, then 2.- should be:
owner: root
group: apache group
perms: 750 on directories, 640 on files

Think of these permissions as the most paranoid ones. You can be secure enough with less tighter permissions, both in moodledata and moodle directories (and subdirectories).

==Running Moodle with PHP safe_mode=on==

Does any security guru dare to document that? I think it is possible to do that (both to run Moodle with safe_mode=on and to write the document). ;-)

==See also==
*[http://moodle.org/mod/forum/discuss.php?d=39404 "Guide to Securing your Moodle Server" discussion] at [http://moodle.org http://moodle.org]

[[Category:Administrator]]

2006-02-12T20:16:59Z

Davidds: Added "Guide to Securing your Moodle Server" discussion

Security recommendations

2006-02-12T17:58:43Z

Davidds: Added

Moodle in education

2006-02-12T11:56:37Z

Davidds: Reverted to previous version: blocks howto is just for developers, sorry

<p class="note">'''Note for contributors:''' Design and/or style improvements to this page are welcome :-) Please add additional teacher documentation links to the See also section.</p>
__NOTOC__
__NOEDITSECTION__
{| cellpadding="1" style="border: 1px solid #aaa; background: #f9f9f9; padding: 5px; margin: 5px 0 15px 0; width: 100%;"
|-
| style="padding: 0 5px 0 5px; background:#e4e4e4;" align="center" | <h2 style="border: 0; margin: 0">[[Activity modules]]</h2>
|-
| align="center" style="font-size: 100%;" | [[mod/assignment/index|Assignments]] | [[mod/chat/index|Chats]] | [[mod/choice/index|Choices]] | [[mod/forum/index|Forums]] | [[mod/glossary/index|Glossaries]] | [[mod/hotpot/index|Hot Potatoes]] | [[mod/lesson/index|Lessons]] | [[mod/quiz/index|Quizzes]] | [[mod/scorm/index|SCORM]] | [[mod/survey/index|Surveys]] | [[mod/wiki/index|Wikis]] | [[mod/workshop/index|Workshops]]
|}

{| cellpadding="1" style="border: 1px solid #aaa; background: #f9f9f9; padding: 5px; margin: 5px 0 15px 0; width: 100%;"
|-
| style="padding: 0 5px 0 5px; background:#e4e4e4" align="center" | <h2 style="border: 0; margin: 0">[[mod/resource/index|Resources]]</h2>
|-
| align="center" style="font-size: 100%;" | [[course/mod/text|Text page]] | [[course/mod/html|Web page]] | [[course/mod/file|File or website link]] | [[course/mod/directory|Directory]] | [[course/mod/label|Label]]
|}

{| cellpadding="1" style="border: 1px solid #aaa; background: #f9f9f9; padding: 5px; margin: 5px 0 10px 0; width: 100%;"
|-
| style="padding: 0 5px 0 5px; background:#e4e4e4" align="center" | <h2 style="border: 0; margin: 0">[[Blocks]]</h2>
|-
| align="center" style="font-size: 100%;" | [[Activities]] | [[Administration]] | [[Calendar]] | [[Courses]] | [[Course/Site Description]] | [[HTML]] | [[Latest News]] | [[Messages]] | [[Online Users]] | [[People]] | [[Quiz Results]] | [[Random Glossary Entry]] | [[Recent Activity]] | [[RSS feeds]] | [[Search Forums]] | [[Section Links]] | [[Upcoming Events]]
|}

{| cellpadding="1" style="border: 1px solid #aaa; background: #f9f9f9; padding: 5px; margin: 5px 0 10px 0; width: 100%;"
|-
| style="padding: 0 5px 0 5px; background:#e4e4e4" align="center" | <h2 style="border: 0; margin: 0">[[Tools]]</h2>
|-
| align="center" style="font-size: 100%;" | [[Gradebook]]
|}

{| cellpadding="1" style="border: 1px solid #aaa; background: #f9f9f9; padding: 5px; margin: 5px 0 10px 0; width: 100%;"
|-
| style="padding: 0 5px 0 5px; background:#e4e4e4" align="center" | <h2 style="border: 0; margin: 0">[[Teaching with Moodle]]</h2>
|-
| align="center" style="font-size: 100%;" | [[Teaching FAQ]] | [[Teaching Good Practices (K-12) | Good Practices (K-12)]]
|}

== See also ==
*[[Using Moodle book]]
*[[course/view|The course homepage]]
*[[Course sections]]
*[[Formatting options]]
*[[HTML in Moodle]]
*[[Presentations]]
*[[Moodle manuals]]
*[[Adding resources and activities|Adding resources and activities to your course]]
*[[Non-standard modules]]
*[[Non-standard blocks]]
*[[Teaching FAQ]]
*[[Teaching Best Practices (K-12) | Teaching with Moodle - Good Practices (K-12)]]

[[Category:Teacher]]

Moodle in education

2006-02-12T11:53:13Z

Davidds: Added Blocks howto

<p class="note">'''Note for contributors:''' Design and/or style improvements to this page are welcome :-) Please add additional teacher documentation links to the See also section.</p>
__NOTOC__
__NOEDITSECTION__
{| cellpadding="1" style="border: 1px solid #aaa; background: #f9f9f9; padding: 5px; margin: 5px 0 15px 0; width: 100%;"
|-
| style="padding: 0 5px 0 5px; background:#e4e4e4;" align="center" | <h2 style="border: 0; margin: 0">[[Activity modules]]</h2>
|-
| align="center" style="font-size: 100%;" | [[mod/assignment/index|Assignments]] | [[mod/chat/index|Chats]] | [[mod/choice/index|Choices]] | [[mod/forum/index|Forums]] | [[mod/glossary/index|Glossaries]] | [[mod/hotpot/index|Hot Potatoes]] | [[mod/lesson/index|Lessons]] | [[mod/quiz/index|Quizzes]] | [[mod/scorm/index|SCORM]] | [[mod/survey/index|Surveys]] | [[mod/wiki/index|Wikis]] | [[mod/workshop/index|Workshops]]
|}

{| cellpadding="1" style="border: 1px solid #aaa; background: #f9f9f9; padding: 5px; margin: 5px 0 15px 0; width: 100%;"
|-
| style="padding: 0 5px 0 5px; background:#e4e4e4" align="center" | <h2 style="border: 0; margin: 0">[[mod/resource/index|Resources]]</h2>
|-
| align="center" style="font-size: 100%;" | [[course/mod/text|Text page]] | [[course/mod/html|Web page]] | [[course/mod/file|File or website link]] | [[course/mod/directory|Directory]] | [[course/mod/label|Label]]
|}

{| cellpadding="1" style="border: 1px solid #aaa; background: #f9f9f9; padding: 5px; margin: 5px 0 10px 0; width: 100%;"
|-
| style="padding: 0 5px 0 5px; background:#e4e4e4" align="center" | <h2 style="border: 0; margin: 0">[[Blocks]]</h2>
|-
| align="center" style="font-size: 100%;" | [[Activities]] | [[Administration]] | [[Blocks howto]] | [[Calendar]] | [[Courses]] | [[Course/Site Description]] | [[HTML]] | [[Latest News]] | [[Messages]] | [[Online Users]] | [[People]] | [[Quiz Results]] | [[Random Glossary Entry]] | [[Recent Activity]] | [[RSS feeds]] | [[Search Forums]] | [[Section Links]] | [[Upcoming Events]]
|}

{| cellpadding="1" style="border: 1px solid #aaa; background: #f9f9f9; padding: 5px; margin: 5px 0 10px 0; width: 100%;"
|-
| style="padding: 0 5px 0 5px; background:#e4e4e4" align="center" | <h2 style="border: 0; margin: 0">[[Tools]]</h2>
|-
| align="center" style="font-size: 100%;" | [[Gradebook]]
|}

{| cellpadding="1" style="border: 1px solid #aaa; background: #f9f9f9; padding: 5px; margin: 5px 0 10px 0; width: 100%;"
|-
| style="padding: 0 5px 0 5px; background:#e4e4e4" align="center" | <h2 style="border: 0; margin: 0">[[Teaching with Moodle]]</h2>
|-
| align="center" style="font-size: 100%;" | [[Teaching FAQ]] | [[Teaching Good Practices (K-12) | Good Practices (K-12)]]
|}

== See also ==
*[[Using Moodle book]]
*[[course/view|The course homepage]]
*[[Course sections]]
*[[Formatting options]]
*[[HTML in Moodle]]
*[[Presentations]]
*[[Moodle manuals]]
*[[Adding resources and activities|Adding resources and activities to your course]]
*[[Non-standard modules]]
*[[Non-standard blocks]]
*[[Teaching FAQ]]
*[[Teaching Best Practices (K-12) | Teaching with Moodle - Good Practices (K-12)]]

[[Category:Teacher]]

About Moodle

2006-02-11T15:35:07Z

Davidds: Added Moodle at Wikipedia

{{About Moodle}}
Moodle is a software package for producing internet-based courses and web sites. It's an ongoing development project designed to support a [[Philosophy|social constructionist]] framework of education.

Moodle is provided freely as [http://www.opensource.org/docs/definition_plain.html Open Source] software (under the [http://www.gnu.org/copyleft/gpl.html GNU Public License]). Basically this means Moodle is copyrighted, but that you have additional freedoms. You are allowed to copy, use and modify Moodle provided that you agree to: '''provide the source to others; not modify or remove the original license and copyrights''', and '''apply this same license to any derivative work'''. Read the [[License|license]] for full details and please contact the [http://moodle.org/user/view.php?id=1&course=1 copyright holder] directly if you have any questions.

Moodle will run on any computer that can run [http://www.php.net/ PHP], and can support many types of database (particularly [http://www.mysql.com/ MySQL]).

The word Moodle was originally an acronym for Modular Object-Oriented Dynamic Learning Environment, which is mostly useful to programmers and education theorists. It's also a verb that describes the process of lazily meandering through something, doing things as it occurs to you to do them, an enjoyable tinkering that often leads to insight and creativity. As such it applies both to the way Moodle was developed, and to the way a student or teacher might approach studying or teaching an online course. Anyone who uses Moodle is a Moodler.

Come [http://moodle.org/community/ moodle with us]!

==See also==
[http://en.wikipedia.org/wiki/Moodle Moodle at Wikipedia]

[[Category:Core]]
[[Category:Administrator]]
[[Category:Teacher]]

Broken/Developer documentation

2006-02-09T12:33:29Z

Davidds: Added Using Moodle book

*[[Roadmap]]

*[[Developer notes]]
*[[Developer conference|Developer conferences]]
*[[Coding|Coding guidelines]]
*[[CVS|Moodle CVS for developers]]
*[[Moodle architecture]]

===Documentation for specific modules===

*[[Quiz developer docs|Quiz module]]
*[[SCORM schema|SCORM module 1.5 schema]]

===How you can contribute===

Even if you are not a programmer there are things you can change or help with.
*[[Activity modules]]
*[[Themes]]
*[[Translation]]
*[[Database Schemas|Database schemas]]
*[[Course formats]]
*[[Bug tracker|Participating in the bug tracker]]

== See also ==

*[http://moodle.org/blocks/HOWTO.html A step-by-step guide to creating blocks]
*[http://moodle.org/bugs/ Moodle bug tracker] - bug reports, feature requests and other tracked issues
*[http://cvs.sourceforge.net/viewcvs.py/moodle/moodle/ CVS code]
*[http://moodle.org/xref/nav.html?index.html Cross reference] - phpxref output for browsing Moodle source code
*[http://moodle.org/mod/resource/view.php?id=1267 Core API]
*[http://moodle.sourceforge.net/dhawes-phpdoc/ Moodle PHP doc reference]
*[http://security.moodle.org/ Moodle Security Centre]
*[http://moodle.com/partners/ Moodle Partners] - providers of custom Moodle development services
*[[Presentations]]
*[[Moodle manuals]]
*[[Using Moodle book]]

[[Category:Core]]
[[Category:Developer]]

Administrator documentation

2006-02-09T12:32:37Z

Davidds: Added Using Moodle book

<p class="note">'''Note for contributors:''' Design and/or style improvements to this page are welcome :-)</p>

== Site management ==

==== Installation ====

*[[Installing Moodle]]
*[[Windows installation]]
*[[Installation FAQ]]
*[[Installing AMP|Installing Apache, MySQL and PHP]]
*[[Upgrading|Upgrading Moodle]]

==== Configuration ====

*[[admin/config|Variables]]
*[[admin/site|Site settings]]
*[[Themes]]
*[[admin/lang|Language]]
*[[admin/modules|Modules]]
*[[admin/blocks|Blocks]]
*[[admin/filters|Filters]]
*[[admin/backup|Backup]]
*[[admin/editor|Editor settings]]
*[[admin/calendar|Calendar]]
*[[admin/maintenance|Maintenance mode]]

==== Performance ====

*Please see [[Performance]]
*[[Large installations|List of large Moodle installations (1000 or more users)]]

==== See also ====

*[[Administration FAQ]]
*[[Backup FAQ]]
*[[Block layout]]
*[[CVS|CVS documentation]]
*[[Email processing]]
*[[Messaging]]
*[[Migration]]
*[[Search engine optimization]]
*[[Presentations]]
*[[Moodle manuals]]
*[[Using Moodle book]]

== Users ==

*[[User Authentication|Authentication]]
*[[admin/uploaduser|Upload users]]
*[[admin/enrol|Enrolments]]
*[[admin/admin|Assign admins]]

==Course management==

*[[Course Categories|Course categories]]
*[[Metacourses]]

[[Category: Administrator]]

Moodle in education

2006-02-09T12:31:42Z

Davidds: Added Using Moodle book

<p class="note">'''Note for contributors:''' Design and/or style improvements to this page are welcome :-) Please add additional teacher documentation links to the See also section.</p>
__NOTOC__
__NOEDITSECTION__
{| cellpadding="1" style="border: 1px solid #aaa; background: #f9f9f9; padding: 5px; margin: 5px 0 15px 0; width: 100%;"
|-
| style="padding: 0 5px 0 5px; background:#e4e4e4;" align="center" | <h2 style="border: 0; margin: 0">[[Activity modules]]</h2>
|-
| align="center" style="font-size: 100%;" | [[mod/assignment/index|Assignments]] | [[mod/chat/index|Chats]] | [[mod/choice/index|Choices]] | [[mod/forum/index|Forums]] | [[mod/glossary/index|Glossaries]] | [[mod/hotpot/index|Hot Potatoes]] | [[mod/lesson/index|Lessons]] | [[mod/quiz/index|Quizzes]] | [[mod/scorm/index|SCORM]] | [[mod/survey/index|Surveys]] | [[mod/wiki/index|Wikis]] | [[mod/workshop/index|Workshops]]
|}

{| cellpadding="1" style="border: 1px solid #aaa; background: #f9f9f9; padding: 5px; margin: 5px 0 15px 0; width: 100%;"
|-
| style="padding: 0 5px 0 5px; background:#e4e4e4" align="center" | <h2 style="border: 0; margin: 0">[[mod/resource/index|Resources]]</h2>
|-
| align="center" style="font-size: 100%;" | [[course/mod/text|Text page]] | [[course/mod/html|Web page]] | [[course/mod/file|File or website link]] | [[course/mod/directory|Directory]] | [[course/mod/label|Label]]
|}

{| cellpadding="1" style="border: 1px solid #aaa; background: #f9f9f9; padding: 5px; margin: 5px 0 10px 0; width: 100%;"
|-
| style="padding: 0 5px 0 5px; background:#e4e4e4" align="center" | <h2 style="border: 0; margin: 0">[[Blocks]]</h2>
|-
| align="center" style="font-size: 100%;" | [[Activities]] | [[Administration]] | [[Calendar]] | [[Courses]] | [[Course/Site Description]] | [[HTML]] | [[Latest News]] | [[Messages]] | [[Online Users]] | [[People]] | [[Quiz Results]] | [[Random Glossary Entry]] | [[Recent Activity]] | [[RSS feeds]] | [[Search Forums]] | [[Section Links]] | [[Upcoming Events]]
|}

{| cellpadding="1" style="border: 1px solid #aaa; background: #f9f9f9; padding: 5px; margin: 5px 0 10px 0; width: 100%;"
|-
| style="padding: 0 5px 0 5px; background:#e4e4e4" align="center" | <h2 style="border: 0; margin: 0">[[Tools]]</h2>
|-
| align="center" style="font-size: 100%;" | [[Gradebook]]
|}

{| cellpadding="1" style="border: 1px solid #aaa; background: #f9f9f9; padding: 5px; margin: 5px 0 10px 0; width: 100%;"
|-
| style="padding: 0 5px 0 5px; background:#e4e4e4" align="center" | <h2 style="border: 0; margin: 0">[[Teaching with Moodle]]</h2>
|-
| align="center" style="font-size: 100%;" | [[Teaching FAQ]] | [[Teaching Good Practices (K-12) | Good Practices (K-12)]]
|}

== See also ==
*[[Using Moodle book]]
*[[course/view|The course homepage]]
*[[Course sections]]
*[[Formatting options]]
*[[HTML in Moodle]]
*[[Presentations]]
*[[Moodle manuals]]
*[[Adding resources and activities|Adding resources and activities to your course]]
*[[Non-standard modules]]
*[[Non-standard blocks]]
*[[Teaching FAQ]]
*[[Teaching Best Practices (K-12) | Teaching with Moodle - Good Practices (K-12)]]

[[Category:Teacher]]

Using Moodle book

2006-02-09T12:30:16Z

Davidds: Added link to Jason Cole profile in Moodle.org

[[Image:UsingMoodleBook.jpg|left]]
[http://moodle.org/user/view.php?id=9318&course=5 Jason Cole] has kindly allowed us to freely use excerpts from his book "'''Using Moodle'''" on MoodleDocs. If you do use it on a page then please add the [[Template:excerpted from Jason Cole]] at the bottom of the page.

For more information about the book see its [http://www.amazon.com/gp/product/0596008635/ page on amazon.com].

Using Moodle book

2006-02-09T12:27:31Z

Davidds:

[[Image:UsingMoodleBook.jpg|left]]
Jason Cole has kindly allowed us to freely use excerpts from his book "Using Moodle" on MoodleDocs. If you do use it on a page then please add the [[Template:excerpted from Jason Cole]] at the bottom of the page.

For more information about the book see its [http://www.amazon.com/gp/product/0596008635/ page on amazon.com].