Security Tips: Difference between revisions

Revision as of 16:38, 15 June 2012

Keep your SMF version up to date and be on the lookout for security updates. You can also heed the following advice.

Password Security

Be sure to change your passwords often and don't use the same password for everything. You should have different passwords for each of the following.

FTP
Database (MySQL, PostgreSQL, or SQLite)
PhpMyAdmin
SMF Administrator Account

The most important password is the database password. This is the same password you use with PhpMyAdmin or any other database management control panel. This password is stored in the Settings.php file. Don't re-use this password for your FTP or your forum administrator account.

Additional Security Tips for your forum

To keep anyone from taking over your forum, make sure your passwords are difficult to guess. You can do this by making sure your passwords do not relate to you (i.e. your spouses name), by mixing capital and lowercase letters with numbers, and by using special characters where applicable.
Frequently backup your database and FTP files and make sure you understand how to restore these backups.
Delete temporary files such as install.php, converters, recovery tools, etc.
Delete any login failures made by administrators from the error log.

Additional Security Tips to protect your users

Do not allow guests to upload anything -- guests could upload things you don't want on your forum.
Do not allow .exe or Flash files to be uploaded or displayed -- you don't want users to upload malware and persuade other users to download and open/execute it.

Backups with tilde (~)

Whenever some file is modified (by the mod operation for example) SMF creates a backup of it with a tilde (~). For example if some mod has modified index.template.php, SMF will create this file: index.template.php~. Notice that those files can be accessed through the browser, so it can be a possible vulnerability. To prevent these you can either disable this option in Administration Center or you can periodically delete them.

As an administrator

Main

Configuration

Forum

Members

Maintenance

Miscellaneous

@@ Line 10: / Line 10: @@
 The most important password is the database password. This is the same password you use with PhpMyAdmin or any other database management control panel. This password is stored in the Settings.php file. Don't re-use this password for your FTP or your forum administrator account.
-===Additional Security Tips===
+===Additional Security Tips for your forum===
-*Make sure your passwords are difficult to guess. You can do this by making sure your passwords do not relate to you (i.e. your spouses name), by mixing capital and lowercase letters with numbers, and by using special characters where applicable.
+*To keep anyone from taking over your forum, make sure your passwords are difficult to guess. You can do this by making sure your passwords do not relate to you (i.e. your spouses name), by mixing capital and lowercase letters with numbers, and by using special characters where applicable.
 *Frequently backup your database and FTP files and make sure you understand how to restore these backups.
 *Delete temporary files such as install.php, converters, recovery tools, etc.
 *Delete any login failures made by administrators from the error log.
-*Do not allow guests to upload anything.
+===Additional Security Tips to protect your users===
-*Do not allow .exe or Flash files to be uploaded or displayed.
+*Do not allow guests to upload anything -- guests could upload things you don't want on your forum.
+*Do not allow .exe or Flash files to be uploaded or displayed -- you don't want users to upload malware and persuade other users to download and open/execute it.
 ====Backups with tilde (~)====

Navigation

Search

Tools