Security:Insecure configuration management: Difference between revisions
From MoodleDocs
(New page: This page forms part of the Moodle security guidelines. ==What is the danger?== Evil Hacker somehow gets access to your server some time and installs some nasty ...) |
Eric Merrill (talk | contribs) (Update to represent more recent version of Moodle (and using git).) |
||
| (4 intermediate revisions by 2 users not shown) | |||
| Line 6: | Line 6: | ||
Unfortunately, you have no procedures in place for detecting that this is happening. | Unfortunately, you have no procedures in place for detecting that this is happening. | ||
Another problem is not updating to the latest Moodle release, which means that you will be running a version of Moodle with know security holes. | |||
| Line 20: | Line 22: | ||
==What you need to do as an administrator== | ==What you need to do as an administrator== | ||
* Think about how you deploy the Moodle code to your server. For example, if you [[ | * Keep up-to-date with the latest Moodle release from whichever branch you are using. | ||
* Alternatively, if you upload the Moodle code manually, delete all the old code except config.php before you upload a new version. | ** Register your Moodle site, so you get notified of security problems before the general public. | ||
* Think about how you deploy the Moodle code to your server. For example, if you [[:en:Git_for_Administrators|use git]], then 'git status' will tell you which files have been edited. | |||
** Alternatively, if you upload the Moodle code manually, delete all the old code except config.php before you upload a new version. | |||
* Be very careful who can access your servers. | * Be very careful who can access your servers. | ||
| Line 30: | Line 34: | ||
* [[Coding]] | * [[Coding]] | ||
[[Category:Security]] | [[Category:Security]] | ||
Revision as of 22:00, 12 September 2013
This page forms part of the Moodle security guidelines.
What is the danger?
Evil Hacker somehow gets access to your server some time and installs some nasty code. For example, they could add some code to the login page that records every username and password entered, and sends it back to evel-hacker.com.
Unfortunately, you have no procedures in place for detecting that this is happening.
Another problem is not updating to the latest Moodle release, which means that you will be running a version of Moodle with know security holes.
How Moodle avoids this problem
This is not really a problem that can be solved from within Moodle code. However, any Moodle code that does install other PHP code (for example admin/langimport.php) must be written with extreme care.
What you need to do in your code
- If you are writing code like admin/langimport.php, make sure you know what you are doing.
What you need to do as an administrator
- Keep up-to-date with the latest Moodle release from whichever branch you are using.
- Register your Moodle site, so you get notified of security problems before the general public.
- Think about how you deploy the Moodle code to your server. For example, if you use git, then 'git status' will tell you which files have been edited.
- Alternatively, if you upload the Moodle code manually, delete all the old code except config.php before you upload a new version.
- Be very careful who can access your servers.
