<?xml version="1.0" encoding="iso-8859-1"?>
<chapter id="setup_security">
  <title>Securing your moregroupware setup</title>
  
  <para>Here are some hints and remarks on security in
    moregroupware.
  </para>
  
  <orderedlist>
    
    <listitem>
      <para>Check the rights on your installation files and
        folders. No directories except the cache directories of some modules
        and the <filename>templates_c</filename> folder need to be writable
        by the webserver. And those directories need to be writable only by
        the webserver, there is no need to have them world-writable.
      </para>
    </listitem>
    
    <listitem>
      <para>
        The <filename>store</filename> directory of the file manager and
        the storage folders of the webmail2 module contain files that are not
        meant to be accessible from outside of more.groupware. Thus you should
        use something like this <filename>.htaccess</filename> file to avoid
        direct access to them:
        <programlisting><![CDATA[
Order deny, allow
Deny from all]]>
        </programlisting>
        Such files are already present for the files and webmail2 module, but
        you should check if they work. Depending on your webservers
        configuration the usage of .htaccess files may be restricted. If you
        are not using the Apache webserver, take similar measures for your
        setup.
      </para>
      
      <para>Additionally you should make them only accessible to the
        webserver user and/or group on filesystem level, by changing folder
        access permissions accordingly, if they allow access to others.
      </para>
    </listitem>
    
    <listitem>
      <para>If you are concerned about cross-site scripting attacks,
        you should remember that those are almost always used to hijack a
        session. Because you can lock your session to an IP address in
        more.groupware (this is true by default), having access to the session
        ID doesn't give you access to the session in most cases.
      </para>
      
      <para>And you need a valid login to the system to be able to inject
        such malicious content. And if you can't trust your users, secure
        software is only worth that much.
      </para>
      
      <para>Nevertheless do we plan to disallow such attacks in the next
        release.
      </para>
    </listitem>
    
    <listitem>
      <para>You should delete the
        <filename>setup/</filename> folder after successfully installing your
        installation of moregroupware.
      </para>
    </listitem>
    
    <listitem>
      <para>Think about the scripts in the
        <filename>scripts/</filename> folder of moregroupware, some might give
        others the possibility to gather information about your system, you
        would rather like to keep private
        (e.g. <filename>systeminfo.php</filename>). You should restrict
        access to this folder or move it elsewhere. If you don't need it's
        contents, you can safely delete it.
      </para>
    </listitem>
    
    <listitem>
      <para>If you use moregroupware outside of a closed network
        environment, consider using SSL. moregroupware is completely
        SSL-transparent, i.e. you can use it without any changes on an
        SSL-enabled webserver.
      </para>
    </listitem>
    
    <listitem>
      <para>There is no need to worry about the
        <filename>sess_*</filename> files in your webserver's
        <filename>/tmp</filename> directory, as long as these files are only
        readable by the user your webserver runs as. You don't need to delete
        them as well, PHP will do this automatically with a given probability
        after a sessions expired. See the PHP manual for more
        information.
      </para>
    </listitem>
    
  </orderedlist>
  
  <para>We are trying hard to make the moregroupware code itself as
    secure as possible, by checking all input data, etc. This work is
    still progressing, so be aware of those risks.
  </para>
  
</chapter>
