Actions

Installation security hints

From LimeSurvey Manual

Revision as of 15:37, 20 May 2009 by Anonymous (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

General

LimeSurvey relies on its own security system which is activated by default. The authors of this software takes no responsibility and makes no claims in relation to the appropriateness or secureness of this software. However we take security issues very serious and react quickly - if you know of any security problems with LimeSurvey please let us know: info@limesurvey.org .

Linux file permissions

If you are using a Linux server, setting file permissions is required to secure your LimeSurey installation.

Basic facts about Linux/*nix file permissions

A Linux/*nix operating system is multi-user. This means that, apart from your personal account, other user accounts exist on the system and you should take care of what permissions you give to other users.

Help.png Hint: Setting file permissions is especially important in order to secure configuration files holding critical data such as passwords.

Note however that the 'root' account will always be granted permission to access your files (no matter what file permissions you set) as it is the super-admin user.

The webserver (which runs LimeSurvey), is also running under a given identity (user). On Linux, this is usually the 'www','www-data' (on Debian/Ubuntu), 'apache' or 'nobody' user. However, some hosting companies use systems (such as suexec) which make it possible to run LimeSurvey scripts with your personal user. Of course the webserver user must have the right to read LimeSurvey files. However, only a small subset of LimeSurvey subdirectories must be writeable by the webserver user.

Help.png Hint: It is very valuable to revoke write permission for the webserver user to these LimeSurvey subdirectories that do not require it. Indeed, even if a LimeSurvey vulnerability is discovered, the main files will still be protected from an illicit modification thanks to the file system permissions.

Setting file permissions on a self-managed Linux system

If you're managing your webserver and operating system configuration (you are the owner of the physical server or are renting a virtual server on which you have root access), you can follow these recommendations.

You can first set the owner and group of your LimeSurvey files so that it will ease the file permissions setup.

A possible strategy is to set the owner of the LimeSurvey files to your personal username, and the group of the LimeSurvey files to the webserver group. Usually this webserver group only contains the webserver account (and possibly another webmaster account).

For instance if your username is 'myaccount' and the webserver user is 'apache' in the 'apache' group, then, from a shell access, you can use the following commands:

$ chown -R myaccount limesurvey/

$ chgrp -R apache limesurvey/

Then set the file and subdirectories permissions.

For the script to work properly it needs write access to some directories:

  • The "/limesurvey/tmp" directory is used for import-uploads and should be set to Read & Write for your webserver.
  • You should also set Read & Write for your webserver for the "limesurvey/template" directory and its sub-directories and files if you want to be able to edit and copy templates.
  • The upload/ directory and all its subdirectories must also have Read & Write for your webserver in order to enable picture and media files upload.
  • The other directories and files should be set to Read Only
Help.png Hint: Supposing you've followed the above recommendations on owner/group, these settings can be applied by the following commands:

$ chmod -R o-r-w-x limesurvey/

$ chmod -R -w limesurvey/

$ chmod -R 770 limesurvey/tmp

$ chmod -R 770 limesurvey/templates

$ chmod -R 770 limesurvey/upload    

Setting file permissions on a hosted webserver

Giving a standard procedure to secure a web application on a hosted environment is rather difficult because hosted environments differ in so many ways.

As in the managed server case, for the script to work properly it needs write access to some directories:

  • The "/limesurvey/tmp" directory is used for import-uploads and should be set to Read & Write for your webserver.
  • You should also set Read & Write for your webserver for the "limesurvey/template" directory and its sub-directories and files if you want to be able to edit and copy templates.
  • The upload/ directory and all its sub directories must also have Read & Write for your webserver in order to enable picture and media files upload.
  • The other directories and files should be set to Read Only
Help.png Hint:
  • Depending on your webserver configuration you will have to chmod the rights on the writable folders to 755 or 777 to make it writable for the webserver. Try 755 first - if it does not work 'upgrade' to 777.
  • You can also try to remove read access to config.php to others by setting this file's permissions to 750 - if it does not work 'upgrade' to 755.

Windows file permissions

If you are using a windows server your should ensure that the admin folder allows the owner of the webserver process to write files to this directory, however all other files can be set to read-only and execute.

.htaccess files

For additionally security protect sensitive directories, such as /admin/*, with .htaccess files. For example you could restrict access to a certain IP Address range.

Other security issues

The config.php file contains a user name and password for your database server. This poses certain security issues, particularly if you are using a login that has high level administrative access to your database. In the event of some error returning the content of this php file to a user's browser, your database password and other details could be compromised. One way to minimize risk (a little) is set up a specific login that only has specific rights to your limesurvey database.

A better way to secure this information is to put the config.php file in a non-web directory, i.e. for Apache users this is the directory above the htdocs (aka public_html or www) folder. Begin by copying your working config.php file to the directory above the htdocs directory. Before doing any of these things, back up your files!

NOTE: You will need to modify every php file in the survey script, changing the line (that will occur near the top of the file) that reads `include ("config.php");` to the full path of your config.php file (eg: `include("c:/program files/apache group/apache/phpsafe/config.php");`.  This is NOT tested If you give it a try let us know how it goes - please post in the bugtracker or the forums about it! Future versions of LimeSurvey might consider a simpler way to refer to this file. The advantage of this method is that admin changes to your limesurvey installation should automatically change the config.php file.

Another idea is to continue to use config.php, but have one line in it - a line that includes the file with ACTUAL configuration information (ex: <?php include("/home/hostfolder/safedata/configreal.php"); ?>). Remove all actual configuration information from config.php, and paste it into the other file (configreal.php) that is included by config.php. This other file should be located in a non-Web directory. Then config.php will not contain database passwords, etc. - just the name of the file that DOES contain the database info. This avoids having to change all the other files that include config.php, since they can still include it, and it will include the real config information. You'll also will need to fillout the $rootdir value in your realconfig.php file. For example: $rootdir = '/home/hostfolder/public_html/limesurvey';

I see in the paragraph above that feeback is requested. I did not try changing ALL php files, but I DID implement the method in this paragraph, of having the config.php file just include another file, which contains the config information. This did work.

Don't use "admin" as the default user. Go to your MySQL database (or other one if you installed LimeSurvey on different database) and change default user name "admin" to whatever you prefer (e.g. "admin_xyz"). It will be now much harder to guess administrator's new user name. Remember, this is one of the two variables intruders can use to gain access. The admin password is the other variable. So choose it with extreme care.