[GLLUG] Securing Joomla

[Thomas Hruska]

Michael Watters wrote:
> Daniel Hedlund wrote:
>>
>> Have you considered running a second instance of Apache's SSL server 
>> on a different port?  That would get around any problems with sharing 
>> a certificate, ie. https://joomla.gllug.org:19876?  Also, an extension 
>> that
>>
> SSL isn't going to protect you from SQL injections or other php exploit 
> attempts.  You might want to consider installing mod_security if you 
> haven't already.

This is true, but if HTTPS is running on a different port from 443 on 
the same IP (a good idea, BTW), a signed client certificate that is 
installed in the browser can be required as well.  This will only allow 
authorized personnel to connect to the server in the first place - and 
those people won't be doing any exploits (or at least you should be able 
to assume as much - that the people you trust are trustworthy).

--
Thomas Hruska
CubicleSoft President
Ph: 517-803-4197

Safe C++ Design Principles (First Edition)
Learn how to write memory leak-free, secure,
stable, portable, and user-friendly software.

Learn more and view a sample chapter:
http://www.CubicleSoft.com/SafeCPPDesign/