Need help ensuring my public mediawiki is safe before launch

Submitted ⁨⁨8⁩ ⁨months⁩ ago⁩ by ⁨xnx@lemm.ee⁩ to ⁨selfhosted@lemmy.world⁩

Hi, I’m setting up a public wiki using mediawiki and I’d like some help ensuring the server and mediawiki is safely setup before I start sharing it publicly. I installed it on Vultr using the mediawiki app from the Vultr Marketplace. Are there any things I should ensure before publicly sharing the link?

Some things I’ve done so far:

I disabled password login to the server so its only possible to login via ssh
I made it so I have to approve of any edits to the wiki
I still haven’t enabled uploads of files because I want to ensure I only allow jpeg\png uploads.

I’m relatively new to running servers so any tips are highly appreciated.

source

Comments

Sort:hotnew top

mudeth@lemmy.ca ⁨8⁩ ⁨months⁩ ago
Install fail2ban. Prevents brute force access to your server. The defaults should be fine.

source

Decronym@lemmy.decronym.xyz ⁨8⁩ ⁨months⁩ ago

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters	More Letters
HTTP	Hypertext Transfer Protocol, the Web
HTTPS	HTTP over SSL
SSH	Secure Shell for remote terminal access
SSL	Secure Sockets Layer, for transparent encryption

[Thread #74 for this sub, first seen 23rd Aug 2023, 08:05] [FAQ] [Full list] [Contact] [Source code]

source

saint@group.lt ⁨8⁩ ⁨months⁩ ago
Get some WAF for the public facing app, maybe at least github.com/nbs-system/naxsi .

source
- xnx@lemm.ee ⁨8⁩ ⁨months⁩ ago
  ELI5? 😅
  
  The install section of naxsi is a whole lotta stuff I’ve never touched before
  
  source
  - saint@group.lt ⁨8⁩ ⁨months⁩ ago
    sorry, this is kinda like a firewall, but protecting websites, so many vulnerabilities are filtered out. it does not protect you 100% percent (nothing does). it might be hard to setup, in that case there is an option to use waf as a service, i.e. - cloudflare has such offering, maybe there are others as well. i have looked into vultr - they seem to offer only a “usual” type of firewall, not http/application based.
    
    source
    -> View More Comments
Illecors@lemmy.cafe ⁨8⁩ ⁨months⁩ ago

I disabled password login to the server so its only possible to login via ssh

Phrasing is a bit strange. Does this mean ssh can only be used to login with a key? If so - great!

Since you’re using an “app” - not sure there’s much we can help you with. The control has been ceded to the maker of said app.

I would normally set up some limits on the firewall and change the ssh port so logs are less polluted, not sure it’s possible for you.

source