Server rental store

Encryption

# Encryption on MediaWiki Servers

This article details the encryption configurations available and recommended for MediaWiki servers. Proper encryption is crucial for protecting sensitive data, including user credentials, edit history, and content itself. This guide is aimed at system administrators and server engineers responsible for maintaining a secure MediaWiki installation.

Overview

Encryption on a MediaWiki server covers several layers: data in transit (connections between users and the server), data at rest (data stored on the server’s disks), and database encryption. Each layer requires different configuration and tools. We will cover each aspect in detail below, focusing on best practices for a secure deployment. It is highly recommended to review our Security best practices page before implementing any of these configurations.

Data in Transit: TLS/SSL Configuration

Protecting data while it's being transmitted between users and the MediaWiki server is paramount. This is achieved through Transport Layer Security (TLS), formerly known as Secure Sockets Layer (SSL).

Here's a breakdown of typical TLS/SSL configurations:

Parameter Value
Protocol TLS 1.3 (recommended), TLS 1.2 (minimum)
Cipher Suites ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-GCM-SHA256
Certificate Authority Let's Encrypt (recommended), DigiCert, Sectigo
Certificate Type Domain Validated (DV), Organization Validated (OV), Extended Validation (EV)

It is *strongly* advised to use Let's Encrypt for obtaining free, automatically-renewing TLS certificates. Configuration typically involves using tools like `certbot` with your web server (Apache or Nginx). See our Web Server Configuration page for more details. Always force HTTPS redirection to prevent unencrypted connections. This can be configured in your web server’s virtual host settings. Regularly check your SSL/TLS configuration using tools like SSL Labs Server Test to ensure it meets current security standards. Furthermore, consider implementing HTTP Strict Transport Security (HSTS) for enhanced security. Review the HSTS implementation guide for detailed instructions.

Data at Rest: Disk Encryption

Encrypting the entire disk on which the MediaWiki files and database reside is a crucial step in protecting data at rest. This prevents unauthorized access to the data if the server is physically compromised.

The following table outlines common disk encryption options:

Encryption Method Description Considerations
LUKS (Linux Unified Key Setup) Standard disk encryption for Linux. Provides strong encryption and flexible key management. Requires careful key management. Bootloader configuration is critical.
dm-crypt Lower-level disk encryption component used by LUKS. More complex to configure directly than LUKS.
File-level encryption (e.g., eCryptfs, EncFS) Encrypts individual files or directories. Less secure than full disk encryption; can be vulnerable to certain attacks.

LUKS is the recommended approach for most MediaWiki installations. During server setup, it's best practice to encrypt the root partition and any partitions containing MediaWiki data or the database. Ensure strong passphrases are used for encryption keys, and store these keys securely (e.g., using a HSM). Consider implementing a robust Backup and recovery strategy that accounts for encrypted disks.

Database Encryption

Protecting the database is paramount, as it contains sensitive information like user credentials and wiki content.

Database System Encryption Options Notes
MySQL/MariaDB Transparent Data Encryption (TDE), encryption at rest using file system encryption TDE requires Enterprise Edition or similar. File system encryption provides broader protection.
PostgreSQL pgcrypto extension, Transparent Data Encryption (TDE) via extensions pgcrypto allows for encryption of individual columns.
SQLite SQLCipher Can be used for encrypting the SQLite database file.

For MySQL/MariaDB, enabling Transparent Data Encryption (TDE) is the preferred method, but it typically requires a commercial license. Alternatively, relying on file system encryption (LUKS) provides a simpler, though less granular, level of protection. PostgreSQL offers the `pgcrypto` extension for encrypting specific database columns. For SQLite databases, SQLCipher provides a robust encryption solution. Regularly review your database server's Database security configuration for best practices. Also, consider using strong passwords for database users and restricting access to only necessary personnel. Refer to the documentation for your specific database system for detailed encryption instructions.

Key Management

Secure key management is fundamental to the effectiveness of any encryption system.

⚠️ *Note: All benchmark scores are approximate and may vary based on configuration. Server availability subject to stock.* ⚠️

View full article | Back to Server rental store