Network security
Here's the article, adhering to all specified constraints and requirements:
# Network Security Configuration for MediaWiki 1.40
This article details the network security configuration essential for a robust and secure MediaWiki 1.40 installation. Proper network setup is crucial for protecting your wiki from unauthorized access, data breaches, and denial-of-service attacks. This guide is aimed at system administrators and those responsible for maintaining the server infrastructure. It builds upon fundamental Server setup and assumes a basic understanding of networking concepts.
Understanding the Threat Landscape
Before diving into configuration, it's vital to understand potential threats. Common attacks include:
- **Brute-force attacks:** Attempts to guess usernames and passwords.
- **SQL Injection:** Exploiting vulnerabilities in database queries.
- **Cross-Site Scripting (XSS):** Injecting malicious scripts into web pages.
- **Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS):** Overwhelming the server with traffic.
- **Unauthorized Access:** Gaining access to sensitive data or administrative functions.
- **Man-in-the-Middle (MitM) Attacks:** Intercepting communication between the server and users.
- *Important Considerations:**
- **SSH Access:** Restrict SSH access to specific IP addresses. Consider using SSH keys for enhanced security.
- **Port Forwarding:** If your wiki is behind a router, ensure proper port forwarding (80 and 443) is configured. Refer to your router’s documentation.
- **Regular Review:** Firewall rules should be regularly reviewed and updated.
- **Logging:** Enable firewall logging to monitor traffic and identify potential attacks. See Server logs for details on log analysis.
- **Load Balancing:** Distributes traffic across multiple MediaWiki servers, improving performance and availability. See Scaling MediaWiki for more information.
- **Reverse Proxy:** Acts as an intermediary between clients and MediaWiki. It provides several benefits: * **SSL Termination:** Handles SSL encryption/decryption, reducing the load on MediaWiki servers. * **Caching:** Caches static content, improving response times. * **Security:** Hides the internal network structure and can provide additional security features like rate limiting and web application firewall (WAF) capabilities.
- **DNSSEC (DNS Security Extensions):** Adds cryptographic signatures to DNS records, verifying their authenticity.
- **Use a reputable DNS provider:** Choose a provider with robust security measures.
- **Regularly review DNS records:** Ensure accuracy and remove outdated records.
- Security policy
- Database security
- User account management
- Regular backups
- Disaster recovery plan
- MediaWiki security documentation
- Telegram: @powervps Servers at a discounted price
These threats necessitate a layered security approach. This article focuses on the network layer, complementing application-level security features within MediaWiki itself (discussed in Security extensions).
Firewall Configuration
A firewall is the first line of defense. It controls incoming and outgoing network traffic based on predefined rules. We'll discuss `iptables`, a common Linux firewall. Alternatives like `firewalld` exist, but `iptables` is widely used and well-documented.
| Rule | Description | Action |
|---|---|
| INPUT -p tcp --dport 80 | Allow incoming HTTP traffic | ACCEPT | |
| INPUT -p tcp --dport 443 | Allow incoming HTTPS traffic | ACCEPT | |
| INPUT -p tcp --dport 22 | Allow incoming SSH traffic (restrict source IP | ) | ACCEPT |
| INPUT -m state --state RELATED,ESTABLISHED | Allow established connections | ACCEPT | |
| INPUT -j DROP | Drop all other incoming traffic | DROP |
Load Balancing and Reverse Proxies
For high-traffic wikis, consider using a load balancer and a reverse proxy like Nginx or Apache.
Here's a simplified Nginx configuration snippet:
```nginx server { listen 80; server_name yourwiki.example.com; return 301 https://$host$request_uri; }
server { listen 443 ssl; server_name yourwiki.example.com;
ssl_certificate /path/to/your/certificate.pem; ssl_certificate_key /path/to/your/private.key;
location / { proxy_pass http://mediawiki_backend; # Assuming 'mediawiki_backend' is an upstream block proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } } ```
Network Segmentation
Network segmentation involves dividing the network into smaller, isolated segments. This limits the impact of a security breach.
| Segment | Purpose | Access Control |
|---|
| DMZ (Demilitarized Zone) | Hosts publicly accessible services (e.g., web server, reverse proxy) | Limited access to internal network |
| Internal Network | Hosts MediaWiki servers, database server | Restricted access, firewalled |
| Management Network | Used for server administration | Highly restricted access, often separate VLAN |
This separation prevents attackers from easily accessing critical infrastructure if they compromise the web server. Consider using Virtual LANs (VLANs) to implement segmentation. See Virtualization for related technologies.
DNS Security
Secure your DNS records to prevent DNS spoofing and cache poisoning attacks.
Technical Specifications Summary
| Component | Specification | Version |
|---|---|---|
| Firewall | iptables | 1.8.7 |
| Reverse Proxy | Nginx | 1.23.3 |
| Load Balancer (example) | HAProxy | 2.6.5 |
Monitoring and Intrusion Detection
Implement network monitoring and intrusion detection systems (IDS) to detect and respond to security incidents. Tools like Snort, Suricata, and Nagios can be helpful. Regularly review Server monitoring data.
Further Resources
Intel-Based Server Configurations
| Configuration | Specifications | Benchmark |
|---|---|---|
| Core i7-6700K/7700 Server | 64 GB DDR4, NVMe SSD 2 x 512 GB | CPU Benchmark: 8046 |
| Core i7-8700 Server | 64 GB DDR4, NVMe SSD 2x1 TB | CPU Benchmark: 13124 |
| Core i9-9900K Server | 128 GB DDR4, NVMe SSD 2 x 1 TB | CPU Benchmark: 49969 |
| Core i9-13900 Server (64GB) | 64 GB RAM, 2x2 TB NVMe SSD | |
| Core i9-13900 Server (128GB) | 128 GB RAM, 2x2 TB NVMe SSD | |
| Core i5-13500 Server (64GB) | 64 GB RAM, 2x500 GB NVMe SSD | |
| Core i5-13500 Server (128GB) | 128 GB RAM, 2x500 GB NVMe SSD | |
| Core i5-13500 Workstation | 64 GB DDR5 RAM, 2 NVMe SSD, NVIDIA RTX 4000 |
AMD-Based Server Configurations
| Configuration | Specifications | Benchmark |
|---|---|---|
| Ryzen 5 3600 Server | 64 GB RAM, 2x480 GB NVMe | CPU Benchmark: 17849 |
| Ryzen 7 7700 Server | 64 GB DDR5 RAM, 2x1 TB NVMe | CPU Benchmark: 35224 |
| Ryzen 9 5950X Server | 128 GB RAM, 2x4 TB NVMe | CPU Benchmark: 46045 |
| Ryzen 9 7950X Server | 128 GB DDR5 ECC, 2x2 TB NVMe | CPU Benchmark: 63561 |
| EPYC 7502P Server (128GB/1TB) | 128 GB RAM, 1 TB NVMe | CPU Benchmark: 48021 |
| EPYC 7502P Server (128GB/2TB) | 128 GB RAM, 2 TB NVMe | CPU Benchmark: 48021 |
| EPYC 7502P Server (128GB/4TB) | 128 GB RAM, 2x2 TB NVMe | CPU Benchmark: 48021 |
| EPYC 7502P Server (256GB/1TB) | 256 GB RAM, 1 TB NVMe | CPU Benchmark: 48021 |
| EPYC 7502P Server (256GB/4TB) | 256 GB RAM, 2x2 TB NVMe | CPU Benchmark: 48021 |
| EPYC 9454P Server | 256 GB RAM, 2x2 TB NVMe |
Order Your Dedicated Server
Configure and order your ideal server configurationNeed Assistance?
⚠️ *Note: All benchmark scores are approximate and may vary based on configuration. Server availability subject to stock.* ⚠️