\documentclass{article}
\usepackage{ulem}
\usepackage{graphicx}
\usepackage{hyperref}
\pagestyle{headings}
\begin{document}
\part{Horde Security Tips}
The content of this page is mainly derived from the security-section in the Horde documentation. It is aimed at system administrators who want to add some extra security to their Horde installations (or for those who are a bit paranoid ;) )

Also see the file \texttt{docs/SECURITY}, <a href="http://www.horde.org/apps/horde/docs/SECURITY">available online</a> too.


\noindent\rule{\textwidth}{1pt}
\subsection{Introduction}
The configuration examples here have been tested by me on a Fedora Core 3 system running Apache 2.2.3 with mod\_ssl and Horde 3.1.3.<br />
My Apache is serving most files out of \texttt{/var/www/html}. Thus my Horde installation lives in \texttt{/var/www/html/horde}. Please keep this in mind if you are applying any of these configurations on your system.


\noindent\rule{\textwidth}{1pt}
\subsection{Filesystem Permissions}
<pre><code>
chown -R apache.apache /var/www/html/horde
</code></pre>
This will change the user and the group of all files belonging to your Horde installation to the user and group of your Apache webserver. If your Apache shipps with suexec, Horde will be started with the permissions of your webserver from now on.

If you want more restrictive settings, you might try the following:

<pre><code>
chmod -R go-rwx /var/www/html/horde/config
chmod -R go-rwx /var/www/html/horde/*/config
</code></pre>
This will prevent any of your config-files to be accessed from the outside. If that's not enough for you, try this:

<pre><code>
chmod -R a-w   /var/www/html/horde/
</code></pre>
That's a bit overkill IMHO but makes all the files belonging to Horde unwritable by anyone except root. Take note that this might (and will) cause problems if you are planning to use Horde's built-in administration routines. To lift this a bit, you can restrict write-access to the only files that really need to be written by the webserver:

<pre><code>
chmod u+w /var/www/html/horde/config/conf.php*
chmod u+w /var/www/html/horde/*/config/conf.php*
</code></pre>
Explanation: conf.php will be your newly generated configuration file, conf.php.bak will be a backup of your old one.


\noindent\rule{\textwidth}{1pt}
\subsection{Apache/PHP Configuration}
The Horde documentation suggests an awful lot of <Directory> instructions to secure Horde. I've found a way to limit those to one <Directory> and one <DirectoryMatch> instruction \textit{and} statisfy Horde's needs towards PHP on the fly:

<pre><code>
<Directory "/var/www/html/horde/">
  Options none
  \# Only needed if you have got safe\_mode globally on
  php\_admin\_flag  safe\_mode        off

  \# /usr/share/pear is needed for PEAR. /var/www/html/horde is needed for Horde itself
  \# You might want to add /usr/bin for applications like Chora that are calling external binaries
  \# TODO: Set an appropriate include\_path, too. Might even increase speed a bit.
  php\_admin\_value open\_basedir     "/var/www/html/horde:/usr/share/pear" 

  \# always a good idea :)
  php\_admin\_flag  expose\_php       off

  \# If you do this (recomended by the PHP documentation, btw)...
  php\_admin\_flag  display\_errors   off

  \# ... you need to set this also - otherwise you'll have no idea what's wrong if something doesn't work.
  \# Don't forget to specify a logfile in your php.ini or elsewhere!
  php\_admin\_flag  log\_errors       on
  php\_admin\_flag  register\_globals off
</Directory>

\# Deny access to files that are not served directly by the webserver
<DirectoryMatch "\^{}/var/www/html/horde/(.*/)?(config|lib|locale|po|scripts|templates)/(.*)?">
  order deny,allow
  deny  from all
</DirectoryMatch>

\# Deny access to the test.php files except from localhost
<LocationMatch "\^{}/horde/(.*/)?test.php">
  order deny,allow
  deny  from all
  allow from localhost
</LocationMatch>
</code></pre>
This way you can safely switch \texttt{php\_safe\_mode} globaly on and still have Horde working. Please notice that you might need to modify the \texttt{open\_basedir} directive. It includes \texttt{/var} in this example because there are a lot of important things in \texttt{/var} on my server (i.e. the cache and the logfile for Horde),

Please take note that you need to put this into your httpd.conf because the \texttt{php\_admin\_*} instructions won't work in a .htaccess file. If you do so, don't forget to use \texttt{httpd -t} to check for syntax errors in your httpd.conf before you restart your Apache. Apache 2.0.x allows you to place a config file into \texttt{/etc/httpd/conf.d/} so you can place the whole thing into a new file \texttt{/etc/httpd/conf.d/horde.conf}. If the directory \texttt{/etc/httpd} doesn't exist on your system, you may execute the following command on a shell to find out, what your Apache's config-directoy is:

<pre><code>
httpd -V | grep HTTPD\_ROOT
httpd -V | grep SERVER\_CONFIG\_FILE
</code></pre>
Also note that I used escaped slashes in the RegEx for the <DirectoryMatch> instruction. Apache seems to cope with unescaped metacharacters. But since I'm using perl-RegEx most of the time, I'm used to escape those.

The <DirectoryMatch>-instruction is restricting access to the folders \textit{config}, \textit{lib}, \textit{locale}, \textit{po}, \textit{scripts} and \textit{templates} in Horde and all its applications.<br />
<LocationMatch> prevents Horde's test.php scripts being accessed from the outside. The Horde documentation is suggesting to restrict \textit{all} hosts. This example allows access from your local host so you can run the tests via <a href="http://lynx.browser.org/">lynx</a> or a SSH tunnel.

\begin{itemize}
\item Guide on <a href="http://www.regular-expressions.org/">RegularExpressions</a>


\item <a href="http://www.php.net/manual/en/ini.php">List of core php.ini directives</a>


\item <a href="http://www.php.net/manual/en/security.php">PHP Security Manual</a>


\item Apache 2.0 documentation on the <a href="http://httpd.apache.org/docs-2.0/mod/core.html#directory"><Directory></a> instruction


\item Apache 2.0 documentation on the <a href="http://httpd.apache.org/docs-2.0/mod/core.html#directorymatch"><DirectoryMatch></a> instruction


\item Apache 2.0 documentation on the <a href="http://httpd.apache.org/docs-2.0/mod/core.html#locationmatch"><LocationMatch></a> instruction


\end{itemize}

\noindent\rule{\textwidth}{1pt}
\subsection{MySQL Configuration}
There's little to do. If you do not need the networking part of your MySQL installation and can rely on UNIX-sockets, you can disable it by adding the following line into your \texttt{etc/my.cnf} in the \texttt{[mysqld](mysqld)} section:

<pre><code>
skip-networking
</code></pre>
This will also decrease the size of your mysql-threads. if you want even more free RAM, also add:

<pre><code>
skip-innodb
skip-bdb
</code></pre>
This will turn off the InnoDB addon and support for Berkeley Databases. You should leave InnoDB enabled if you use that type of table.

If you absolutely \textit{need} TCP-connections to your MySQL server, you can specify port and IP-address in the same section:

<pre><code>
bind-address=127.0.0.1
port=3306
</code></pre>
This example will bind the !MySQL-server to the local host at port 3306 (MySQL default).

Also make sure that your password for Horde's database is \textit{safe} (even if you disabled networking support).<br />
\textbf{Hint:} phpMyAdmin 2.7+ lets you generate randomized passwords consisting of all printable characters with sufficient length.

\begin{itemize}
\item MySQL Documentation -- <a href="http://dev.mysql.com/doc/refman/5.0/en/server-options.html">mysqld Command-Line Options</a>


\item MySQL Documentation -- <a href="http://dev.mysql.com/doc/refman/5.0/en/security.html">General Security Issues</a>


\item MySQL Documentation -- <a href="http://dev.mysql.com/doc/refman/5.0/en/optimizing-the-server.html">MySQL Optimizations</a>


\item Informations about the <a href="http://dev.mysql.com/doc/refman/5.0/en/bdb-storage-engine.html">Berkeley Storage Engine</a> (BDB)


\item Informations about the <a href="http://dev.mysql.com/doc/refman/5.0/en/innodb.html">InnoDB Storage Engine</a>


\item <a href="http://www.vbulletin.com/forum/archive/index.php/t-93517">Tweaked my.cnf</a>


\end{itemize}

\noindent\rule{\textwidth}{1pt}
\subsection{PEAR Security}
There's only one thing: Keep your installation of PEAR up to date. Here's how:

<pre><code>
pear upgrade-all
</code></pre>
You'll want to test after upgrades to ensure that nothing has changed or broken, as packages have been known to have bugs now and then, but generally the releases are good. If you are less inclined to blindly upgrade everything, you can find out what new releases are available with:

<pre><code>
pear list-upgrades
</code></pre>
Then you can upgrade packages individually with:

<pre><code>
pear upgrade package-name
</code></pre>
\begin{itemize}
\item <a href="http://pear.php.net/">PHP Extension and Application Repository</a> (PEAR) Homepage


\end{itemize}
\end{document}
