reddyweb

Drupal 8 Securing Production Environment

Permissions

sudo chown -R MYUSER:www-data *
sudo find . -type d -exec chmod 755 {} \;
sudo find . -type f -exec chmod 640 {} \;
sudo find sites/default/files/config* -type f -exec chmod 664 {} \;

reddyweb

# Ignore directories generated by Composer
/drush/contrib/
/vendor/*

# Ignore sensitive information
/web/sites/*/settings*.php
/web/sites/*/services*.yml

# Ignore Drupal's file directory
/web/sites/*/files/

reddyweb

# prevent site fingerprinting via release related files
<FilesMatch "(^API|CHANGELOG|COPYRIGHT|INSTALL|LICENSE|PATCHES|MAINTAINERS|README|TODO|UPGRADE|UPDATE|update|install|authorize).*\.(md|txt|php)$">
  Order deny,allow
  Deny from all
</FilesMatch>

reddyweb

#!/bin/bash
# Based on https://www.drupal.org/node/244924

# Disable PHP insecure functions
disable_sys_funcs() {
	printf "\nDisabling PHP Dangerous/Insecure Functions ...\n"

	funcs_to_disable="apache_child_terminate, apache_setenv, define_syslog_variables, escapeshellarg, escapeshellcmd, eval, exec, fp, fput, ftp_connect, ftp_exec, ftp_get, ftp_login, ftp_nb_fput, ftp_put, ftp_raw, ftp_rawlist, highlight_file, ini_alter, ini_get_all, ini_restore, inject_code, mysql_pconnect, openlog, passthru, php_uname, phpAds_remoteInfo, phpAds_XmlRpc, phpAds_xmlrpcDecode, phpAds_xmlrpcEncode, popen, posix_getpwuid, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, posix_setuid, posix_uname, proc_close, proc_get_status, proc_nice, proc_open, proc_terminate, shell_exec, syslog, system, xmlrpc_entity_decode"

	PHP_ini=$(find /etc/ -name php.ini 2>&1 | grep apache)

reddyweb

#!/bin/bash
set -euo pipefail
IFS=$'\n\t'

# Ubuntu 16.04 Dev Server
# Run like - bash install_lamp.sh
# Script should auto terminate on errors

echo -e "\e[96m Adding PPA  \e[39m"
sudo add-apt-repository -y ppa:ondrej/apache2