DEDECMS Site Directory Security Configuration Tutorial

First of all, we should upgrade the Dede and patch, after the upgrade to file verification to see if the intrusion or have unnecessary dangerous files:

After the upgrade and verification of the files we do the site's security settings:
To turn off write permissions for the entire Web site (full station) first
Turn on some (few) directory write permissions that require write access
And then turn off the execution permissions on the dangerous directory (provided that these directories do not need to execute dynamic code such as PHP, only static files or attachments or JS, etc.)
Data, Templets, uploads, a, or HTML directories (the Save directory that generates HTML static pages), open write access, and turn off execution permissions.
Do not need a project, it is recommended to delete the special directory, you need to be able to generate HTML, delete special/index.php and then open the directory to write permission (if you start to turn off the full station write permission here without additional settings), close the execution authority;
Include, member, plus, admin directory (default to Dede directory) to open Execute permissions (by default, execute permissions are already available, do not need to be turned on), turn off Write permission (if you start to turn off the full station write permission this is not a different setting). (with additional modules installed, book, ask, company, group directories are also set).
Although the install directory has been rigorously handled, we still recommend that it be removed for security reasons.

Other matters needing attention
(1) Although the install directory has been strictly dealt with, but for the sake of security, we still recommend that it be deleted;
(2) Do not use the site directly to the MySQL root user permissions, to each site to set up a separate MySQL user account, permission is:
SELECT, INSERT, UPDATE, DELETE
Create, DROP, INDEX, ALTER, create temporary TABLES
Because Dede does not use stored procedures anywhere, it is important to disable file, execute, and so on to execute stored procedures or file operations.

3, how to set the directory permissions?
For users who will use Linux, I believe most of them already know these things, IIS users, please look at the following figure:

3.1 Set the directory to read-only permissions
First copy under Permissions

Set directory as read-only permission

3.2 Set directory does not allow script execution

Also note that the problem is that both IIS and Apache do not include. PHP and. inc files in MIME, so the system will prevent downloading of these files.

4. Apache Site security Settings
If you are Windows2003, you can do the following for Apache:
4.1 In the Computer Management of local users and groups to create an account, such as: Dedeapache, password set to Dedeapachepwd, join the Guests group (if there is a problem, you can give user permissions);

4.2 Open-> Administration Tool-> Local Security policy, select "Log on as service" in "User Rights Assignment", add Dedeapache user;

4.3. Computer Management to select Services, find apache2.2, first stop the service, right click the-> attribute, select login, switch the radio box from the local System account to this account, and then find the choice of Dedeapache, enter the password dedeapachepwd, Then click OK (this time Apache can not start normally, the general situation will certainly be the error: Apache2.2 service due to 1 (0x1) Services error and stop. ）；

4.4. To give the Apache installation directory (such as: d:/apache2.2) and the Web directory (such as d:/wwwroot) Dedeapache account read and Write permissions, remove the root directory of each disk except Administror and system of all permissions, To give the Dedeapache installation directory the disk root directory where the Apache account has read column directory permissions

We can add the following content in the site configuration:

<directory "D:dedecmswwwuploads" >
<filesmatch ". php" >
Order Allow,deny
Deny from all
</FilesMatch>
</Directory>
<directory "D:dedecmswwwdata" >
<filesmatch ". php" >
Order Allow,deny
Deny from all
</FilesMatch>
</Directory>
<directory "D:dedecmswwwtemplets" >
<filesmatch ". php" >
Order Allow,deny
Deny from all
</FilesMatch>
</Directory>
<directory "D:DEDECMSWWWA" >
<filesmatch ". php" >
Order Allow,deny
Deny from all
</FilesMatch>
</Directory>
This corresponds to canceling the script execution permissions for the corresponding directory.

5, the Data directory path changes
In addition, in Dedecms V5.7 users can also set the data directory to the previous level of non-Web Access directory, the basic operation is as follows:
5.1. Move the data directory to the previous level, where you can cut the past directly;
5.2. Configure Dededata files in include/common.inc.php

Define (' Dededata ', dederoot. /data ');

Can be changed into classes such as:

Define (' Dededata ', dederoot. /.. /.. /data ');
5.3. Background settings Template Cache path

You must pay attention to these security issues, especially the use of dream-weaving friends