DokuWiki is a very nice wiki programmed in PHP that does not use any
database. It is very simple to setup and use. As I am using the lighttpd web server
instead of Apache, making a secure installation requires a
configuration a bit different from the usual one.
Here is the configuration I am using. Contrary to our installation in Niadomo, I'm using the original source tarball and not the Debian package. It is heavily inspired by installation documentation and security documentation of DokuWiki. I strongly recommend to read this security documentation before doing any installation.
DokuWiki installation
We firstly download and configure DokuWiki so the installed wiki is
available as example.com/mydoku, assuming example.com is the name of
your web site. I am assuming /var/www is the root directory of your lighttpd server.
$ cd /tmp $ wget http://www.splitbrain.org/_media/projects/dokuwiki/dokuwiki-2009-02-14b.tgz $ tar zxf dokuwiki-2009-02-14b.tgz $ sudo mv /tmp/dokuwiki-2009-02-14 /var/www/mydoku $ sudo chown -R www-data:www-data /var/www/mydoku
We then access the configuration script http://example.com/mydoku/install.php
to configure it. I won't detail this part as it is up to you to choose a
configuration that suites your needs. Refer to DokuWiki install.php instructions for further details.
Making DokuWiki secure
Firstly, we remove the installation script no longer necessary.
$ sudo rm /var/www/mydoku/install.php
Secondly, we move data/ and bin/ dokuwiki's directories in a separated
directory, /usr/local/installed/mydoku. You can choose any directory
that suites your setting but it should be outside of the root directory of your web server, in my case /var/www.
$ sudo mkdir -p /usr/local/installed/mydoku $ sudo mv /var/www/mydoku/bin /usr/local/installed/mydoku/ $ sudo mv /var/www/mydoku/data /usr/local/installed/mydoku/ $ sudo mv /var/www/mydoku/README /usr/local/installed/mydoku/ $ sudo mv /var/www/mydoku/VERSION /usr/local/installed/mydoku/ $ sudo mv /var/www/mydoku/COPYING /usr/local/installed/mydoku/
Then we configure conf/local.php so that the installed dokuwiki knows
how to look for its data and binaries. We use for this the
$conf['savedir'] functionnality[1]. We also configure allowdebug to 0, to avoid giving
information to attackers in case of error.
$ sudo vi /var/www/mydoku/conf/local.php
We add the following two lines:
$conf['savedir'] = '/usr/local/installed/mydoku/data'; $conf['allowdebug'] = 0;
We then configure lighttpd to avoid deny accesses to inc/ and conf/
directories. We use the very specific Debian way, creating a dedicated
lighttpd configuration file and activating it.
$ cat > /etc/lighttpd/conf-available/11-dokuwiki.conf
Add following content:
$HTTP["url"] =~ "^/mydoku/inc" {
url.access-deny = ("")
}
else $HTTP["url"] =~ "^/mydoku/conf" {
url.access-deny = ("")
}
I am simply using regular expressions to deny access to the two directories.
We then enable this configuration and restart dokuwiki.
$ sudo lighty-enable-mod dokuwiki $ sudo invoke-rc.d lighttpd restart
You can now check that the accesses to
http://example.com/mydoku/conf/local.php or
http://example.com/mydoku/inc/io.php are now denied.
Have fun with your new wiki!
Notes
[1] Some people would call that a hack. ;-)