Manual:Security/zh


 * 如果你认为自己在MediaWiki或维基媒体网站中发现了安全问题，请参阅以获得联系信息，以便我们修复错误. 



保持最新
您可以采取的最重要的安全措施是使您的软件保持最新， Both MediaWiki and the software it depends on will occasionally produce new versions correcting newly-discovered security vulnerabilities which may affect you.

MediaWiki开发人员强烈建议任何运行MediaWiki的人订阅mediawiki-announce邮件列表， 这是一个低流量列表，仅发送新版本公告.

根据MediaWiki的版本生命周期，每个版本将获得一年的安全更新. 较旧的版本可能包含已知但未修补的安全漏洞. Older releases may contain known-but-unpatched security holes.

Don't forget to also keep up with updates to Apache, PHP, MySQL/MariaDB, and any other software running on your servers – both the operating system and other web applications.

Several people's MediaWiki 1.3.x installations were affected in Fall 2004 by a worm attacking a flaw in phpBB; once it had gotten in through other customers' unpatched phpBB sites it added a "you are hacked" message to other writable .php files on the system, including the compiled templates that MediaWiki 1.3 used.

Be careful about which extensions you use
There are a wide variety of extensions available for MediaWiki. Unfortunately these extensions are also of a wide variety of quality levels. Using a low quality extension with MediaWiki is one of the most common causes of security issues for MediaWiki.

Before deciding to use an extension, you should do basic research on the extension. Extensions made by prominent members of the MediaWiki development community are usually quite safe. Similarly any extension used on a wiki run by the Wikimedia Foundation has probably been looked at carefully, and is probably safe (There are of course no guarantees). However if you find an extension floating around github that hasn't been touched in many years and was developed by someone with little experience in web development, it is probably pretty high risk.

At the end of the day, you should evaluate the security risk of installing an extension the same way you would evaluate the security risk of installing any other piece of software.

Extensions also need to be kept up to date like any other piece of software. Extensions bundled with MediaWiki have security announcements made to mediawiki-announce mailing list, but other extensions do not. Some, but definitely not all extensions announce security issues on mediawiki-l mailing list.

File permissions
Another very important thing you should do to secure your MediaWiki installation: Make sure the user running php does not have write access to any web-accessible file or directory that php is enabled to run on.

On Debian-based systems this means the  user should not own the php files.

On unix-like systems, you can do this by ensuring that the mediawiki directory/files are owned by someone other than your web server user (www-data) or mysql server user. Depending on how you installed MediaWiki this may already be the case, but if not can be accomplished by doing where username is a user other than the webserver or mysql user (commonly you would use your own username provided mysql and php are not running as your username). After doing that step, you may however need to change the owner of the image directory back to the php user, as uploaded files need to go there, so MediaWiki needs to be able to write there (e.g. ). Next you run  to remove write access from all other users besides the file owners. After doing that step you may need to re-enable write access to the images directory.

Directories that MediaWiki needs write access to (such as $wgCacheDirectory if that feature is enabled) should be located outside of the web root. The exception being the images directory, which must be in the web root. However, it is important to disable php in the images directory. The details on how to do this varies with webserver, but on apache it can sometimes be accomplished by using  in a .htaccess file. If you do accomplish this via a config file in the images directory itself, you should ensure the config file is not writable by the webserver. See the section below on upload security for more details.

Your LocalSettings.php file must be readable by the php user, however it should not be world readable, to prevent other processes from discovering your database password and other sensitive information. Like all MediaWiki files, the php user should not be able to write to LocalSettings.php.

Transport Layer Security (TLS, HTTPS)
To protect against firesheep style attacks and general privacy leaks, it is recommended to host your site using TLS (HTTPS). A guide for setting up TLS is out of the scope of this document, however it should be noted that this is much cheaper now that letsencrypt.org provides free certificates.

If you do setup TLS, it is important to test your site with ssllabs.com/ssltest/ to ensure that it is setup properly, as it is easy to accidentally misconfigure TLS.

If you enable TLS, you may also want to configure your webserver to send the  header. This will improve the security of your website against eavesdroppers quite a bit, but at the drawback that it means you cannot decide to stop using TLS for a set period of time.

General PHP recommendations

 *  Please refer to the OWASP PHP Security Cheat Sheet 

These bits of advice go for pretty much any PHP environment, and are not necessarily specific to MediaWiki.

PHP configuration recommendations, for or set otherwise:


 * Unless you require it specifically, disable.
 * Remote PHP code execution vulnerabilities may depend on being able to inject a URL into a  or  . If you don't require the use of remote file loading, turning this off can prevent attacks of this kind on vulnerable code.
 * MediaWiki may require this setting to be on for the Lucene search extension, the OAI harvester extension, the TitleBlacklist extension, and certain uses of Special:Import in 1.5. It should not however be required in a typical installation.
 * MediaWiki should be safe even if this is on; turning this off is a precaution against the possibility of unknown vulnerability.
 * 設置  為 off
 * If this is on, session IDs may be added to URLs sometimes if cookies aren't doing their thing. That can leak login session data to third-party sites through referrer data or cut-and-paste of links.
 * You should always turn this off if it's on.

For instance if you see this line in php.ini:

allow_url_fopen = On

然后将其改为：

allow_url_fopen = Off

Alternatively, you could add this apache directive to turn off allow_url_fopen on a per-directory basis:

php_flag allow_url_fopen off

Then restart Apache to reload the changes by  or   (SuSE).

On a multiuser system with PHP installed as an Apache module, all users' scripts will run under the same reduced-privilege user account. This may give other users access to read your configuration files (including database passwords), read and modify your login session data, or write files into your upload directory (if enabled).

For multiuser security, consider using a CGI/FastCGI configuration in which each user's scripts run under their own account.

General MySQL and MariaDB recommendations
In general, you should keep access to your MySQL or MariaDB database to a minimum. If it will only be used from the single machine it's running on, consider disabling networking support, or enabling local networking access only (via the loopback device, see below), so the server can only communicate with local clients over Unix domain sockets.

If it will be used over a network with a limited number of client machines, consider setting the IP firewall rules to accept access to TCP port 3306 (MySQL/MariaDB's port) only from those machines or only from your local subnet, and reject all accesses from the larger internet. This can help prevent accidentally opening access to your server due to some unknown flaw in the database server, a mistakenly set overly broad GRANT, or a leaked password.

If you create a new MySQL/MariaDB user for MediaWiki through MediaWiki's installer, somewhat liberal access is granted to it to ensure that it will work from a second server as well as a local one. You might consider manually narrowing this or establishing the user account yourself with custom permissions from just the places you need. The database user only needs to have SELECT, INSERT, UPDATE and DELETE permissions for the database.

In particular, the FILE privilege is a common cause of security issues. You should ensure that the MySQL/MariaDB user does not have this privilege or any of the "server administration" privileges.

Note that the  table in MediaWiki's database contains hashed user passwords and may contain user email addresses, and should generally be considered private data.



维护脚本
For the maintenance scripts, you might want to create a DB-admin-user with more rights. For this, set the following variables with the database credentials of that account:



See Manual:Maintenance scripts#Configuration for details on the needed MySQL/MariaDB rights.



更新MediaWiki
During upgrade, more MySQL/MariaDB rights might be needed.



關於MySQL和MariaDB的更多

 * mysql command-line options.
 * Setting  in your my.ini (under section  ) will cause MySQL/MariaDB to only listen on the loopback interface. This is the default in the EasyPHP install for Windows. (If you are using MySQL/MariaDB on a Unix machine, the setting may be   instead in the my.cnf file.)
 * GRANT and REVOKE syntax

If the MySQL or MariaDB database has leaked
If the database has leaked to the public, in LocalSettings.php:


 * 1) Change  if that leaked too
 * 2) 改變一些在裡面的字母
 * 3) Reset the user_token column in your user table so that it can't be used to impersonate your users

If LocalSettings.php has leaked
If LocalSettings.php has leaked to the public, reprotect it and:


 * 1) Change
 * 2) Replace  with a different random string of letters and numbers
 * 3) Make a different  (optional)
 * 4) Reset the user_token column in your user table so that it can't be used to impersonate any users



数据库密碼
See for some precautions you may wish to take to reduce the risk of MySQL/MariaDB passwords being presented to the web.



替代文件布局
MediaWiki 被设计为在从分发压缩包中提取后就地运行. 这种方法很方便，但会导致安全性降低或不必要的文件重复.

为了安全起见，您可以通过手动重定位或合并各种文件来避免批量安装中的重复文件或将敏感文件保留在 Web 根目录之外.

Moving the main includes and skin files may require carefully picking and choosing and altering the  set in your. Experiment with this as desired.

If working to improve security, keep in mind that  uses the current directory as a base. This means that only setting your  may not help to improve the security of your installation.

Move sensitive information
Consider moving the database password or other potentially sensitive data from  to another file located outside of the web document root, and including that file from   (through  ). This can help to ensure that your database password will not be compromised if a web server configuration error disables PHP execution and reveals the file's source text.

Similarly, editing  with some text editors will leave a backup file in the same directory with an altered file extension, causing the copy to be served as plain text if someone requests, for example,. If you use such an editor, be sure to disable backup generation or move sensitive data outside the web root.

A MediaWiki debug logfile as it is used for debugging also contains sensitive data. Make sure to always disallow access for non authorized persons and the public as explained, delete remains of such logfiles when they are not needed, and comment or clear the logfile lines in your.

Set DocumentRoot to /dev/null
A more secure option for the Apache Web Server is to set the  to an empty or non-existent directory, and then use   directives in the Apache configuration to expose only the scripts and directories that need to be web-accessible.

Loader scripts
A PHP-only solution that will work with any web server is to write a series of scripts that explicitly  to a specific directory and then require one or more source files. For example:



用户脚本
Anyone able to edit the user-interface system messages in the MediaWiki: namespace can introduce arbitrary HTML and JavaScript code into page output. This includes wiki users who have the editinterface permission, as well as anyone with direct write access to the text table in the database.

HTML is disabled on many system messages, particularly those displayed at the login screen, so the risk of password-snarfing JavaScript should be minimal. Malicious code could still attempt to exploit browser vulnerabilities (install spyware, etc.), though, so, you should make sure that only trusted people can modify system messages.



上传目录

 * 參見：

主要关注的问题是：我们如何防止用户上传恶意文件？

文件上传是MediaWiki的一个可选功能，默认是未启用. 如果你启用了文件上传功能，同时会在Web根目录中提供一个Web服务器用户可写的目录.

这可能会牵扯出几个安全隐患：


 * 这个目录可能会被设置为所有人可写，或者只被Web服务器指定的用户帐户拥有. 在一个多用户系统中，其它本地用户可能会将恶意软件偷偷放入你的上传目录. （见上述多用户说明. ） 请尽量将目录设置为Web服务器用户可写，不要设置为所有人可写.
 * 虽然PHP的配置设置了可以上传的单个最大文件限制，MediaWiki并没有对总上传设置任何限制. 恶意用户（或者过于热心的用户）可能会上传大量的文件用尽硬盘空间.
 * Generated thumbnails and uploaded files held for overwrite confirmation may be kept in images/thumb and images/tmp without visible notice in the MediaWiki web interface. Keep an eye on their sizes as well.

默认配置会限制可以上传的文件类型以确保安全：


 * 默认设置下，png、gif、jpg、jpeg和webp类型的文件会在白名单列表.
 * 各种可行性文件和脚本扩展会直接被列入黑名单，即使你允许用户更改白名单.
 * Several known image file extensions have their types verified using PHP's function.
 * Uploaded files are checked to see if they could trip file type detection bugs in Internet Explorer and Safari which might cause them to display as HTML.

As a precaution, you should explicitly disable server-side execution of PHP scripts (and any other scripting types you may have) in the uploads directory (by default, ).

For instance, an Apache .conf file fragment to do this if your MediaWiki instance is in /Library/MediaWiki/web might look something like:

If you don't have access to apache configuration files, but you can use .htaccess files to override configuration settings on specific directories, you can put an .htaccess file on the upload directory that looks like this:

Your exact configuration may vary. In particular, the use of options may complicate handling of uploads.

If you use any of the above solution, you can check whether it's really working with this simple test.


 * Create a 'test.php' file in the upload directory.
 * Put  in the file.
 * Visit the file path in a web browser. If you see just the text of the file you are good, otherwise something is wrong somewhere.

在Nginx上禁用PHP的解决方案： http://serverfault.com/a/585559/162909

For best security, you should also consider using a separate domain for uploaded files. For full security it is best to have uploads served from an entirely separate domain, not a subdomain, but even a subdomain will provide additional security. This is especially important if you allow uploading SVG files since that file format is so similar to HTML. MediaWiki checks SVG uploads for security, but it is best to have multiple layers of defense. See for configuring a different domain to serve media files.



外部链接

 * may be executed for edit conflict merging.
 * If ImageMagick support for thumbnails or SVG images is enabled,  may be run on uploaded files.
 * If enabled, Math extension will call  executable, which calls ,  , and   (which calls  ).



参见

 *  General 
 * Configuration Settings: Access
 * meta:Category:MediaWiki authentication
 *  Planning/Requirements gathering 
 *  User authorization 
 * AuthManager - describes plug-in architecture for determining user identity
 * - configuration variable used by plug-in architecture
 * - authorization extensions available
 * - reseting a MediaWiki user's password
 *  Monitoring user activity 
 *  Assignment of access rights by IP, user identity 
 * Access control
 * FAQ/Initial user was not created by installer
 * FAQ/Anti-spam
 * - describes configuration of the default MediaWiki rights architecture
 * - various tips and how-to guides
 * - IP/user-based restrictions on access to images
 * - extensions that assist in user rights management
 * Configuration variables:, , ,
 *  Security-enhanced MediaWiki versions/sample installations 
 *  Security alerts 
 * - how to report problems, receive notifications
 * ModSecurity
 *  Technical details 
 * database schema: User groups table, User table, Revision table, Recentchanges table
 * hooks:, , , ,
 * code:
 * - instructions for designing access rights-aware special pages.
 *  Open Web Application Security Project (OWASP) 
 *  Web Application Security - Modsecurity Rules (WAS) 
 *  - for developers
 * ModSecurity
 *  Technical details 
 * database schema: User groups table, User table, Revision table, Recentchanges table
 * hooks:, , , ,
 * code:
 * - instructions for designing access rights-aware special pages.
 *  Open Web Application Security Project (OWASP) 
 *  Web Application Security - Modsecurity Rules (WAS) 
 *  - for developers