Archive

Articles taggués ‘php’

Auto-hébergement: YunoHost Bêta 1 est disponible

01/07/2020 Comments off

Source: linuxfr.org

La distribution home-serveur YunoHost, basée sur Debian, a sortie le 31/05/12 sa première version publique. Encore en développement intensif, la Bêta 1 nous donne un avant-goût de ce qui a pour but de devenir une distribution serveur grand public.

Au programme de cette version : Un serveur mail, XMPP et LAMP auto-configuré à base de LDAP, ainsi qu’une installation simplifiée par rapport au standard Debian.

Un développement expéditif

C’est lors d’un constat alarmant de l’état de l’auto-hébergement en France que les deux développeurs du projet ont décidé de réagir: L’auto-hébergement peut être bénéfique au plus grand nombre mais reste très difficile d’accès, et des initiatives comme Beedbox ou Freedombox peinent à voir le jour.

Ainsi, 3 mois de développement auront suffit à l’administrateur système et au développeur web en charge du projet pour sortir cette première Bêta. Bien sûr, beaucoup de travail reste à faire avant que Madame Michu ne relève ses mails sur son propre serveur, mais l’idée était avant tout de proposer un support sur lequel baser une communauté de contributeurs motivés.

Techniquement

La distribution inclut par défaut les composants standards Debian suivant :

  • Apache 2
  • MySQL
  • PHP
  • Postfix
  • Dovecot
  • Ejabberd
  • OpenLDAP

Elle utilise LemonLDAP::NG comme SSO, et le reste sont des paquets YunoHost disponible par un dépôt Debian dédié.

Lors de l’installation, tous les services sont configurés pour fonctionner avec l’annuaire LDAP, et une interface d’administration Web (« admin.mondomaine.fr ») permet de gérer, entre autre, les utilisateurs de celui-ci.

Les développeurs ont également mis en place un système d’installation automatique d’applications web, sous forme de paquets Debian également, et installables depuis l’interface web. Un portail d’application devient ensuite accessible par l’URL “apps.mondomaine.fr”, et bénéficie de l’authentification unique de LemonLDAP.

Encore des lacunes

Toujours dans un souci de « Release early, release often » (sortir tôt, sortir souvent), l’équipe a concédé plusieurs lacunes importantes techniquement :

D’une part, l’interface web d’administration est codée en PHP et permet un large choix d’opérations serveurs (installation de paquet, redémarrage de services, consultation de logs), ce qui peut et pourra présenter de conséquentes failles de sécurité.
D’autre part, certains composants intégrés sont assez gourmand en ressources (Apache, Ejabberd et MySQL en particulier), ce qui oblige un utilisateur modeste à disposer d’un minimum de 512Mo de mémoire vive pour faire tourner correctement la distribution.
Enfin, le SSO LemonLDAP::NG – bien que très fonctionnel – restreint l’architecture requise aux processeurs x86 uniquement, ce qui empêche pour le moment la distribution de s’installer sur des NAS ou autres boîtiers ARM.

Categories: Logiciel, Système Tags: , , ,

Increase upload size in your php.ini

19/06/2020 Comments off

note: increasing PHP upload size is different from increasing PHP memory limit. You can learn to increase memory limit here.

Drupal’s limits on upload file size are determined by your server’s PHP settings (as well as Drupal specified settings that can be set at Admin > Site Configuration > File Upload). The default values for PHP will restrict you to a maximum 2 MB upload file size.

On the settings page for the upload module, Drupal calculates and displays the maximum file size that you can set based upon two PHP settings: ‘post_max_size’ and ‘upload_max_filesize’. Since ‘post_max_size’ is the limit for all the content of your post, many people choose ‘post_max_size’ to be a multiple of ‘upload_max_filesize’ to allow multiple files to be uploaded, but this is not essential. The upload module limits the size of a single attachment to be less than either post_max_size, or upload_max_filesize, whichever is smaller. The default PHP values are 2 MB for upload_max_filesize, and 8 MB for post_max_size.
Lire la suite…

Categories: Logiciel Tags: , ,

Thumbnail Generation PHP Memory Limit NextGEN Gallery

28/05/2020 Comments off

Source: Visser Labs Blog

When uploading a set of admittedly large images using NextGEN Gallery to my WordPress site I exceeded my web hosts default memory usage allocation for PHP applications. The error was:

Follow thumbnails could not created. sample.jpg (Error : Exceed Memory limit. Require : 80.65 MByte)

This issue can be resolved by increasing the memory usage allocation at a per-plugin level for PHP applications that require more grunt than others. It’s quick and easy!

  1. Open an FTP connection to your root WordPress directory
  2. Open /wp-content/plugins/nextgen-gallery/lib/gd.thumbnail.inc.php with your favourite text editor (e.g. UltraEdit, etc.)
  3. On line #168 un-comment (remove the //) from before @ini_set('memory_limit', '128M');
  4. Save and upload changes
  5. Delete image/s that failed to generate a thumbnail and re-upload using NextGEN Gallery’s standard Upload Images feature

If you find 128MB is too ‘conservative’ this can be increased again to any figure of your liking, I find 128MB appropriate for most commercial and personal usage but if you’re a HD photographer then you’re going to hit this limit very quickly… that’s it!

 

Categories: Logiciel Tags: , ,

How To Install and Secure phpMyAdmin on Ubuntu 16.04

21/05/2020 Comments off

Introduction

While many users need the functionality of a database management system like MySQL, they may not feel comfortable interacting with the system solely from the MySQL prompt.

phpMyAdmin was created so that users can interact with MySQL through a web interface. In this guide, we’ll discuss how to install and secure phpMyAdmin so that you can safely use it to manage your databases from an Ubuntu 16.04 system. 

Prerequisites

Before you get started with this guide, you need to have some basic steps completed.

First, we’ll assume that you are using a non-root user with sudo privileges, as described in steps 1-4 in the initial server setup of Ubuntu 16.04.

We’re also going to assume that you’ve completed a LAMP (Linux, Apache, MySQL, and PHP) installation on your Ubuntu 16.04 server. If this is not completed yet, you can follow this guide on installing a LAMP stack on Ubuntu 16.04.

Finally, there are important security considerations when using software like phpMyAdmin, since it:

  • Communicates directly with your MySQL installation
  • Handles authentication using MySQL credentials
  • Executes and returns results for arbitrary SQL queries

For these reasons, and because it is a widely-deployed PHP application which is frequently targeted for attack, you should never run phpMyAdmin on remote systems over a plain HTTP connection. If you do not have an existing domain configured with an SSL/TLS certificate, you can follow this guide on securing Apache with Let’s Encrypt on Ubuntu 16.04.

Once you are finished with these steps, you’re ready to get started with this guide.

Lire la suite…

Categories: Bases de données Tags: , ,

How to turn off server signature on Apache2 web server

07/04/2020 Comments off

Question: Whenever Apache2 web server returns error pages (e.g., 404 not found, 403 access forbidden pages), it shows web server signature (e.g., Apache version number and operating system info) at the bottom of the pages. Also, when Apache2 web server serves any PHP pages, it reveals PHP version info. How can I turn off these web server signatures in Apache2 web server?

Revealing web server signature with server/PHP version info can be a security risk as you are essentially telling attackers known vulnerabilities of your system. Thus it is recommended you disable all web server signatures as part of server hardening process.

14902970545_c3d406322f_o14879982016_7c7b8bbf3d_o

Disable Apache Web Server Signature

Disabling Apache web server signature can be achieved by editing Apache config file.

On Debian, Ubuntu or Linux Mint:

$ sudo vi /etc/apache2/apache2.conf

On CentOS, Fedora, RHEL or Arch Linux:

$ sudo vi /etc/httpd/conf/httpd.conf

Add the following two lines at the end of Apache config file.

ServerSignature Off
ServerTokens Prod

Then restart web server to activate the change:

$ sudo service apache2 restart (Debian, Ubuntu or Linux Mint)
$ sudo service httpd restart (CentOS/RHEL 6)
$ sudo systemctl restart httpd.service (Fedora, CentOS/RHEL 7, Arch Linux)

The first line ‘ServerSignature Off‘ makes Apache2 web server hide Apache version info on any error pages.

14879982016_7c7b8bbf3d_o

However, without the second line ‘ServerTokens Prod‘, Apache server will still include a detailed server token in HTTP response headers, which reveals Apache version number.

14902970535_e84ec23090_z

What the second line ‘ServerTokens Prod‘ does is to suppress a server token in HTTP response headers to a bare minimal.

So with both lines in place, Apache will not reveal Apache version info in either web pages or HTTP response headers.

14902970505_d79225f25d_z

Hide PHP Version

Another potential security threat is PHP version info leak in HTTP response headers. By default, Apache web server includes PHP version info via “X-Powered-By” field in HTTP response headers. If you want to hide PHP version in HTTP headers, open php.ini file with a text editor, look for “expose_php = On”, and change it to “expose_php = Off”.

14899917981_aaef71eb0a

On Debian, Ubuntu, or Linux Mint:

$ sudo vi /etc/php5/apache2/php.ini

On CentOS, Fedora, RHEL or Arch Linux:

$ sudo vi /etc/php.ini

expose_php = Off

Finally, restart Apache2 web server to reload updated PHP config file.

Now you will no longer see “X-Powered-By” field in HTTP response headers.

Source: Xmodulo

Categories: Logiciel, Sécurité Tags: , ,