SmashD

Tweet

This small guide will help you making your Joomla installation alot safer.

As you may know safety can not be guarenteed but the risk of getting a victim can be minimized. Just follow these steps and feel better.

First of all let us take a look at what the main security issues are. Joomla itself is -assuming you are doing the security updates- quite safe.

In my opinion there are 3 main possible security risks:


1. badly written 3rd party components, modules and mambots

Check all your 3rd party php files for this line right at the start

defined( '_VALID_MOS' ) or die( 'Direct Access not allowed.' );
If this line is missing ADD IT!

Additionally:
To stop external access directly to components or modules you could also add this to your htaccess - it makes every access condtional on someone actually being on your site.

Note: I use this to stop content in wrappers being directly accessed from outside of the site itself, and have not tried it on components, but it should work just the same.

Code:

# Blocking direct access
 RewriteCond %{HTTP_REFERER} !^http://www.domain.com/.*$ [NC]
 RewriteCond %{HTTP_REFERER} !^http://domain.com/.*$ [NC]
 RewriteCond %{REQUEST_URI} ^.*index\\.php$
 RewriteRule .* - [F]


Replacing domain.com with your domain, of course!

And keep checking for updated extension files!!

2. more or less silly settings in the php.ini of your host

register_globals Off
allow_url_fopen Off
php_safe_mode On

Of course, Joomla and its 3rd party add-ons are/is not that compatible with safe mode on, but disabling the first two variables (maybe has to be done by your host) is not that bad.

If you have components that require register_globals, you can use the Joomla globals.php emulation. This emulates register_globals on while protecting from vulnerabilities if it is enabled through your server space.
If you are running your site under CGI then the .htaccess directive given above may not work for you. You will need to ask your host for assistance with turning register_globals OFF.

{mos_sb_discuss:49}