How to Harden a Matomo Installation?

Unterberger.Media · March 13, 2023, 2:06pm

Same here, in my apache install (linux gentoo) no htaccess was created automatically. only some in config folder to blacklist access. but no htaccess in htdocs to whitelist files.

i need to read the code with the installer-wizard if it tries to copy or create this file.
as far as i can see this is all manual. and only the config is protected. but that’s not the discussion here.

I it was there, i would not even have started this discussion.

Unterberger.Media · March 13, 2023, 2:20pm

Some search in github shows there is indeed a file to create and put a htaccess there.

But when i used the wizard it connected DB etc. but didnt write the .htaccess file to my server.

So it seems to be a bug, which i was lucky to trigger with my server setup. (Shared Hosting)

github.com

matomo-org/matomo/blob/7fa84731896c4ecf1514d0281adbe8b4e97ef511/plugins/Installation/ServerFilesGenerator.php#L28


      
          {
              self::createHtAccessFiles();
              self::createWebConfigFiles();
              self::createWebRootFiles();
          }
          
          
/**
           * Generate Apache .htaccess files to restrict access
           * .htaccess files are created on all webservers even Nginx, as sometimes Nginx knows how to handle .htaccess files
           */
          public static function createHtAccessFiles()
          {
              $denyAll = self::getDenyAllHtaccessContent();
              $allow = self::getAllowHtaccessContent();
          
          
    $allowAny =
                  "# Allow any file in this directory\n" .
                  "<Files \"*\">\n" .
                  "\t" . $allow . "\n" .
                  "</Files>\n";

Still odd we are now down 21 comments in this thread, and it seems all I question already exists, and its a real bug in the installer wizard, maybe problems with file access rights to save to disk.

The second answer should have been in this thread.
“… it already exists, you have a bug in your installation …”

I need to make a new Install on another server and see if the htaccess is created, and why it is not on my main server.

Then it just would be a bug report if the wizard cannot write to disk or similar .

heurteph-ei · March 15, 2023, 3:11pm

Hi @Unterberger.Media
In case of discovered bug, you can create an issue at:

STATWebmaster2022 · March 17, 2023, 2:21pm

Hi!
I’m following this discussion since the start as I found it interesting that no .htaccess was created in the Matomo install directory three month ago when I first installed it on the server.

I do have it in:

/config
/js
/lang
/tmp

All other directories and the main install directory do not have one.

I’m still not clear if they are missing or not and how to create them after the installation if necessary.

I would be grateful if this could be explained better.

heurteph-ei · March 21, 2023, 3:18pm

@innocraft @matthieu do you have some clues for Xavier or Daniel?