Installations-Sicherheitshinweise
From LimeSurvey Manual
Generelles
LimeSurvey relies on its own security, which is activated by default. The authors of this software takes no responsibility and makes no claims in relation to the appropriateness or the security level of this software. However, we take security issues very serious and react quickly - if you know of any security problems with LimeSurvey, please let us know either by sending us an e-mail at info@limesurvey.org or by opening a bug report in our bug tracker (please mark it as private).
Dateirechte in Linux
Wenn sie einen Linux-Server verwenden, sollten Sie entsprechende Dateiberechtigungen setzen, damit Ihre Installation gesichert ist.
Grundlegende Fakten über Linux/*nix Dateiberechtigungen
Ein Linux/*nix System ist normalerweise ein Mehrbenutzersystem. Das bedeutet, dass abgesehen von Ihrem persönlichen Zugang noch andere Benutzerzugänge auf dem System bestehen könnten und daher sollten Sie darauf achten, welche Berechtigungen Sie diesen anderen Benutzern geben.
Hinweis: Das Setzen von Dateiberechtigungen ist besonders wichtig bei Konfigurationsdateien, die normalerweise sensible Daten enthalten, wie z.B. Kennworte.Bear in mind that the 'root' account will always be granted permission to access your files (no matter what file permissions you set) as it is the super-admin user.
The web server (which runs LimeSurvey) is also running under a given identity (user). On Linux, this is usually the 'www', 'www-data' (on Debian/Ubuntu), 'apache' or 'nobody' user. However, some hosting companies use systems (such as suexec) that make possible the running of LimeSurvey scripts with your personal user. Of course, the web server user must have the right to read LimeSurvey files. However, only a small subset of LimeSurvey sub-directories must be writable by the web server user.
Hint: It is very valuable to revoke write permission for the web server user to these LimeSurvey sub-directories that do not require it. Indeed, even if a LimeSurvey vulnerability might be discovered, the main files will still be protected from an illicit modification thanks to the file system permissions.Setzen von Berechtigungen auf einem selbstverwalteten Linux-System
If you're managing your web server and operating system configuration (you are the owner of the physical server or are renting a virtual server on which you have root access), you can follow the following the recommendations from below.
You can first set the owner and group of your LimeSurvey files so that it will ease the file permissions setup. A possible strategy is to set the owner of the LimeSurvey files to your personal username, and the group of the LimeSurvey files to the web server group. Usually, this web server group only contains the web server account (and possibly another webmaster account). For instance, if your username is 'myaccount' and the webserver user is 'apache' in the 'apache' group, then, from a shell access, you can use the following command: $ chown -R myaccount:apache limesurvey/. Then set the file and sub-directories permissions.
For the script to work properly, the write access to some directories is needed:
- The /limesurvey/application/config directory requires Read & Write for saving the application configuration settings.
- The "/limesurvey/tmp" directory and its sub-directories are used for imports/uploads and should be set to Read & Write for your web server.
- The upload/directory and all its sub-directories must also have set Read & Write permissions in order to enable pictures and media files upload.
- All other directories and files can be set to Read Only.
$ chmod -R o-r-w-x limesurvey/
$ chmod -R -w limesurvey/
$ chmod -R 770 limesurvey/application/config
$ chmod -R 770 limesurvey/tmp
$ chmod -R 770 limesurvey/upload
Setting file permissions on a hosted web server
Giving the difficulty of a standard procedure to secure a web application on a hosted environment, it is rather difficult because hosted environments differ in so many ways.
In the managed server case, the server needs write access to some directories in order for the script to work properly:
- The "/limesurvey/tmp" directory is used for imports/uploads and should be set to Read & Write for your web server.
- The upload/directory and all its sub-directories must also have Read & Write for your web server in order to enable pictures and media files upload.
- The other directories and files should be set to Read Only.
Hint:
- Depending on your web server configuration, you will have to chmod the rights on the writable folders to 755 or 777 to make it writable for the web server. Try 755 first, if it does not work, 'upgrade' to 777.
- You can also try to remove other users' read access to config.php by setting this file's permissions to 750 - if it does not work, 'upgrade' to 755.
Dateirechte in Windows
If you are using a Windows server, your should ensure that the admin folder allows the owner of the web server process to write files to this directory, The rest of the files can be set to read-only and execute.
Weitere Sicherheitsvorkehrungen
Die Datei config.php beinhaltet den Benutzernamen und das dazugehörige Passwort für den Datenbankserver. Dieses zieht weitere Sicherheitsaspekte nach sich, insbesondere, wenn sie einen Benutzer mit weitreichenden Zugriffsrechten auf die Datenbank verwenden. Wenn sie das Risiko etwas minimieren möchten, empfiehlt es sich, einen eigenen Benutzer anzulegen, welche nur über die entsprechenden Rechte verfügt, welche für eine Verwendung von LimeSurvey von Nöten sind.
SSL usage
We generally recommend the usage of SSL for sensitive survey data. You usually enable SSL by configuring your web server correctly and using a SSQL certificate. If you have enabled SSL, you should enforce SSL all the time via the [Global settings] option of LimeSurvey. Additionally, you could set only to use 'secure' cookies by editing/adding the related option in config.php.
The access to the config.php file
You must update application/config/config.php only after the first installation is done and it works.
The /application/config/config.php file contains a user name and password for your database server. This poses certain security issues, particularly if you are using a login that has high level administrative access to your database. In the event of some error returning the content of this PHP file to a user's browser, your database password and other details could be compromised (please note, that this is a very unlikely scenario). The best way to minimize risk is to set up a specific login that has specific rights only to your LimeSurvey database.
Another way to secure this information can be to put the certain information from the /application/config/config.php file in a non-web directory, i.e. for Apache users this is the directory above the htdocs (also known as public_html or www) folder. Basically, you will use config.php, but have one line in it - a line that includes the file with ACTUAL configuration information (ex: <?php return include("/home/hostfolder/safedata/configreal.php"); ?>). Remove all actual configuration information from /application/config/config.php and paste it into the other file (configreal.php) that is mentioned in the /application/config/config.php file. This other file should be located in a non-web directory. Then /application/config/config.php will not contain database passwords, etc. - just the name of the file that DOES contain the database info.
This avoids having to change all the other files that include /application/config/config.php, since config.php 're-directs them' towards the configuration file that is located in a non-web directory that includes all the real configuration information. However, you will need to edit configreal.php and change the follow parameters to use absolute directory paths to work properly:
'basePath' => dirname(dirname('''FILE''')),
'runtimePath' => dirname(dirname(dirname('''FILE'''))).DIRECTORY_SEPARATOR.'tmp'.DIRECTORY_SEPARATOR.'runtime',
[...]
'urlManager' => array(
[...]
'rules' => require('routes.php'),
[...]
);
Example:
'basePath' => '/var/www/htdocs/limesurvey',
'runtimePath' => '/var/www/htdocs/limesurvey/tmp/runtime',
[...]
'urlManager' => array(
[...]
'rules' => require('/var/www/htdocs/limesurvey/config/routes.php'),
[...]
);
Also, don't use "admin" as the default user. Go to your MySQL database (or the one in which you installed LimeSurvey on different database) and change default user name "admin" to whatever you prefer (e.g. "admin_xyz"). It will be now much harder to guess administrator's new user name. Remember, this is one of the two variables intruders can use to gain access. The admin password is the other variable. So choose both of them with extreme care.