Actions

Difference between revisions of "Moving sensitive files outside the web root"

From Joomla! Documentation

(while under review, please see this forum topic)
m (reason parameter added with reason page should be archived)
(21 intermediate revisions by 7 users not shown)
Line 1: Line 1:
{{review}}
+
{{archived|68318|Where can you learn more about file permissions?|Security Checklist|reason=As the page notice indicated, the security information on this page is generally accepted by the security moderators as no longer relevant and provides no additional or very minimal additional security to a website. }}
 
+
== while under review, please see this [http://forum.joomla.org/viewtopic.php?f=432&t=490901 forum topic] ==
+
 
+
 
+
 
+
 
+
One challenge in Joomla! is ensuring that certain PHP files in ''public_html'' (or otherwise known as ''httpdocs'' or'' www'' depending on your server setup) containing executable code or confidential data are protected from direct Internet access.
+
 
+
There are various ways to protect such files, but most are not optimal. Many users and developer groups, such as [http://gallery.menalto.com/ Gallery2] and [http://www.apache.org/ Apache.org] strongly recommend against keeping vulnerable files and confidential data inside public_html.
+
 
+
The following method is one way to protect the Joomla configuration.php, perhaps the most confidential file of any Joomla! site.
+
 
+
Using the following method, the Joomla configuration.php file does not reside in the public_html directory but resides instead outside of (or above) the public_html directory and is much better protected from the internet access.
+
 
+
=== Directions ===
+
 
+
<font color="#ff0000">'''WARNING:''' Do not attempt this procedure unless you understand what you are doing and are willing to possibly break your site while testing. This is not for beginners or inexperienced persons, ensure you have a back up of your site and also of the files you will be modifying before attempting this modification.
+
</font>
+
 
+
 
+
1. Create a directory in your domain outside of your public_html directory. You can name it anything you want but it should reflect the site name in some way. We used the name '''design2-files''' for the directory name in this example.
+
'''Note:''' If you have multiple Joomla installs then each Joomla install you have should have its own directory outside of public_html to contain its configuration.php file.
+
 
+
2) Place a copy of your current configuration.php file, completely unaltered and '''NOT''' renamed into this directory. I have permissions set at 644 on the file in this directory and the directory set to 755 permissions.
+
 
+
3. If your Joomla site is installed in the root of the public_html directory and not in a subdirectory under public_html, then create a new configuration.php file for your joomla install in the public_html directory containing only the following code:
+
 
+
1) Create a directory immediately above your public web directory (which is often public_html). I'll call this directory "configuration" all lower case, quotes aren't part of the directory name.
+
 
+
2) Go to the root/includes/ directory in your Joomla install and open the file defines.php in your favorite editor
+
 
+
3) Around line 26 you will see this:
+
 
+
<pre>
+
define('JPATH_CONFIGURATION',JPATH_ROOT);
+
</pre>
+
 
+
Replace it with this:
+
 
+
<pre>
+
define('JPATH_CONFIGURATION',JPATH_ROOT.DS.'/../design2-files');
+
</pre>
+
 
+
If Joomla has been installed in a subdirectory under public_html ( public_html/subdirectory/ )
+
then replace it with this
+
<pre>
+
('JPATH_CONFIGURATION',JPATH_ROOT.DS.'../../'.DS.'design2-files');
+
 
+
</pre>
+
 
+
 
+
'''4) Repeat these exact same steps with the same file (defines.php) that is located in the root/administrator/includes/ directory. If you don't do this access to your admin area will be prevented.'''
+
 
+
5) Go to the root of your installation and rename the configuration.php file to something like somefile.html or whatever while testing the modifications.
+
 
+
6) Using a browser, go to your website and test as many pages as you can to make certain it is working correctly.
+
 
+
7) Delete the old renamed configuration.php file from the root of your Joomla installation
+
 
+
8) Retest your website thoroughly to make sure everything works correctly.
+
 
+
9) Make sure you add the new directory (design2-files) with the configuration.php file in it to your backup job so it doesn't get missed.
+
 
+
10) You can access and modify the Joomla configuration as you would normally from the Joomla administration area. This access will not create a new configuration.php file, but will modify the moved configuration.php file.
+
 
+
'''NOTE:'''
+
 
+
The above procedure modifies core files in a Joomla install. Later Joomla upgrades, updates, re-installs etc. may remove these core modifications. Modifying core files may make the Joomla install incompatible with certain extensions.
+
 
+
 
+
=== Contributors & Editing ===
+
[http://forum.joomla.org/memberlist.php?mode=viewprofile&u=28000 mandville]
+
[http://forum.joomla.org/memberlist.php?mode=viewprofile&u=67439 PhilD]
+
[http://forum.joomla.org/memberlist.php?mode=viewprofile&u=396945 jacksun]
+
 
+
=== Editing and saving/applying ===
+
+
<font color="#ff0000">'''Warning!!'''
+
Do not use the Joomla web administrator interface global configuration button to edit the global configuration.</font>
+
 
+
If you need to change configuration settings, do so manually by downloading the relocated joomla.conf file, making the needed edits and uploading it back.
+
 
+
Making edits to the global configuration in the Joomla web administration interface will overwrite the 3 line configuration.php file pointing to the real configuration file with the real configuration.php file contents upon saving or applying the edits. This will undo your efforts to move and protect the configuration.php file by placing it in a directory outside of public_html.
+
 
+
 
+
[[Category:FAQ]]
+
[[Category:Administration FAQ]]
+
[[Category:Installation FAQ]]
+
[[Category:Version 1.5 FAQ]]
+
[[Category:Tutorials]][[Category:Security]]
+

Revision as of 07:55, 26 November 2012