Questions[mediawiki](server)

We enabled HSTS in httpd.conf in the Virtual Host handling port 443. We tried with and without the <IfModule mod_headers.c>:

<IfModule mod_headers.c>
    Header set Strict-Transport-Security "max-age=10886400; includeSubDomains"
</IfModule>

But the server does not include the header in a response. Below is from curl over HTTPS:

> GET / HTTP/1.1
> Host: www.cryptopp.com
> User-Agent: curl/7.51.0
> Accept: */*
> 
< HTTP/1.1 200 OK
< Date: Sat, 05 Nov 2016 22:49:25 GMT
< Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips
< Last-Modified: Wed, 02 Nov 2016 01:27:08 GMT
< ETag: "8988-5404756e12afc"
< Accept-Ranges: bytes
< Content-Length: 35208
< Vary: Accept-Encoding
< Content-Type: text/html; charset=UTF-8

The relevant section of httpd.conf is shown below. The cURL transcript is shown below. Apache shows mod_header is loaded, and grepping all the logs don't reveal an error.

The Apache version is Apache/2.4.6 (CentOS). The PHP version is 5.4.16 (cli) (built: Aug 11 2016 21:24:59). The Mediawiki version is 1.26.4.

What might be the problem here, and how could I solve this?

httpd.conf

<VirtualHost *:80>
    ServerName www.cryptopp.com
    ServerAlias *.cryptopp.com *.cryptopp.* cryptopp.com

    <IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteCond %{REQUEST_METHOD} ^TRACE
        RewriteRule .* - [F]
        RewriteCond %{REQUEST_METHOD} ^TRACK
        RewriteRule .* - [F]
        #redirect all port 80 traffic to 443
        RewriteCond %{SERVER_PORT} !^443$
        RewriteRule ^/?(.*) https://www.cryptopp.com/$1 [L,R]
   </IfModule>
</VirtualHost>

<VirtualHost *:443>
    ServerName www.cryptopp.com
    ServerAlias *.cryptopp.com *.cryptopp.* cryptopp.com

    <IfModule mod_headers.c>
        Header set Strict-Transport-Security "max-age=10886400; includeSubDomains"
    </IfModule>
</VirtualHost>

mod_headers

# cat /etc/httpd/conf.modules.d/00-base.conf | grep headers
LoadModule headers_module modules/mod_headers.so

# httpd -t -D DUMP_MODULES | grep header
 headers_module (shared)

error logs

# grep -IR "Strict-Transport-Security" /etc
/etc/httpd/conf/httpd.conf:        Header set Strict-Transport-Security "max-age=10886400; includeSubDomains" env=HTTPS  
# grep -IR "Strict-Transport-Security" /var/log/
# grep -IR "mod_headers" /var/log/
#

.htaccess

# find /var/www -name '.htaccess' -printf '%p\n' -exec cat {} \;
/var/www/html/w/cache/.htaccess
Deny from all
/var/www/html/w/languages/.htaccess
Deny from all
/var/www/html/w/extensions/MobileFrontend/dev-scripts/.htaccess
Deny from all
/var/www/html/w/maintenance/archives/.htaccess
Deny from all
/var/www/html/w/maintenance/.htaccess
Deny from all
/var/www/html/w/serialized/.htaccess
Deny from all
/var/www/html/w/images/temp/.htaccess
# Protect against bug 28235
<IfModule rewrite_module>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} \.[^\\/:*?\x22<>|%]+(#|\?|$) [nocase]
    RewriteRule . - [forbidden]
</IfModule>
/var/www/html/w/images/.htaccess
# Protect against bug 28235
<IfModule rewrite_module>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} \.[^\\/:*?\x22<>|%]+(#|\?|$) [nocase]
    RewriteRule . - [forbidden]
    # Fix for bug T64289
    Options +FollowSymLinks
</IfModule>
/var/www/html/w/images/deleted/.htaccess
Deny from all
/var/www/html/w/includes/.htaccess
Deny from all
/var/www/html/.htaccess
RewriteEngine on
RewriteRule ^wiki/?(.*)$ /w/index.php?title=$1 [L,QSA]
<IfModule mod_deflate.c>
<FilesMatch "\.(js|css|html)$">
SetOutputFilter DEFLATE
</FilesMatch>
</IfModule>

curl transcript

$ /usr/local/bin/curl -Lv cryptopp.com
* Rebuilt URL to: cryptopp.com/
*   Trying 192.210.150.121...
* TCP_NODELAY set
* Connected to cryptopp.com (192.210.150.121) port 80 (#0)
> GET / HTTP/1.1
> Host: cryptopp.com
> User-Agent: curl/7.51.0
> Accept: */*
> 
< HTTP/1.1 302 Found
< Date: Sat, 05 Nov 2016 22:49:25 GMT
< Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips
< Location: https://www.cryptopp.com/
< Content-Length: 209
< Content-Type: text/html; charset=iso-8859-1
< 
* Ignoring the response-body
* Curl_http_done: called premature == 0
* Connection #0 to host cryptopp.com left intact
* Issue another request to this URL: 'https://www.cryptopp.com/'
*   Trying 192.210.150.121...
* TCP_NODELAY set
* Connected to www.cryptopp.com (192.210.150.121) port 443 (#1)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /opt/local/share/curl/curl-ca-bundle.crt
  CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: OU=Domain Control Validated; OU=COMODO SSL Unified Communications
*  start date: Sep 17 00:00:00 2015 GMT
*  expire date: Sep 16 23:59:59 2018 GMT
*  subjectAltName: host "www.cryptopp.com" matched cert's "www.cryptopp.com"
*  issuer: C=GB; ST=Greater Manchester; L=Salford; O=COMODO CA Limited; CN=COMODO RSA Domain Validation Secure Server CA
*  SSL certificate verify ok.
> GET / HTTP/1.1
> Host: www.cryptopp.com
> User-Agent: curl/7.51.0
> Accept: */*
> 
< HTTP/1.1 200 OK
< Date: Sat, 05 Nov 2016 22:49:25 GMT
< Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips
< Last-Modified: Wed, 02 Nov 2016 01:27:08 GMT
< ETag: "8988-5404756e12afc"
< Accept-Ranges: bytes
< Content-Length: 35208
< Vary: Accept-Encoding
< Content-Type: text/html; charset=UTF-8
< 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  <title>Crypto++ Library 5.6.5 | Free C++ Class Library of Cryptographic Schemes</title>
  <meta name="description" content=
  "free C++ library for cryptography: includes ciphers, message authentication codes, one-way hash functions, public-key cryptosystems, key agreement schemes, and deflate compression">
  <link rel="stylesheet" type="text/css" href="cryptopp.css">
</head>
...

I have MediaWiki 1.16.2 on a the following LAMP platform, which performs quite good for other apps on a 16 GB RAM dual processor machine: CentOS 5.7 (64-bit) Apache 2.2.3 MySQL 5.0.77 PHP 5.1.6

It seems to depend somewhat on the used browser, but very frequently saving edited pages is too slow - not rare to wait 10 or 20 seconds for it even more for a very simple change.

Rendering the pages works pretty fast, but it's the saving after editing which is killing the user experience. I have detected some improvement when editing from a client running Opera than on Firefox (on a Fedora Linux platform).

Any hints about where can I tune up the server to make it better ?

Benchmarks of Apache run on the machine are impressive, BTW.

We are looking for ways in which to further enhance our documentation and our ability to allow easy access to the information as well as editing the information. With these ideas in mind, we created an internal wiki based upon the MediaWiki platform for our Tier 1 (Help Desk). This has been a huge success for the Help Desk and they use this extensively for their daily operations. Now, we are looking at ways in which to document things for our Tier 2 (Systems Administrators). We need to have the information for Tier 2 separate from the information for Tier 1 due to the sensitivity of the information and the fact that it will contain steps for how we build our servers, etc.

I am looking for ideas and suggestions in relation to how we can accomplish the following aims:

• Centralized documentation based upon the MediaWiki platform
• Separated content between Tier 1 and Tier 2
• We like the look and feel that we have for Tier 1 and that could be used for Tier 2
• Can this be ran on the same server if we were to run two different installations of MediaWiki? Is this even a good idea to run multiple installations of MediaWiki on the same machine?
• Support for FQDN and SSL certificates for each documentation installation
• Is there a way to slice or keep separate part of the Tier 1 MediaWiki installation based upon user or group membership?

Thank you in advance and I look forward to your ideas and suggestions.

We have a MediaWiki installation and are getting complaints that it is becoming slower. How can we increase the speed / performance?

I have one tip (which I'll add below) but I'm really interested in hearing more. Preferably one tip per answer.

We have a wiki which is used by over half our company. Generally it has been very positively received. However, there is a concern over security - not letting confidential information fall into the wrong hands (i.e. competitors).

The default answer is to create a complicated security matrix defining who can read what document (wiki page) based on who created it. Personally I think this mainly solves the wrong problem because it creates barriers within the company instead of a barrier to the external world. But some are concerned that people at a customer site might share information with a customer which then goes to the competitor.

The administration of such a matrix is a nightmare because (1) the matrix is based on department and not projects (this is a matrix organisation), and (2) because in a wiki all pages are by definition dynamic so what is confidential today might not be confidential tomorrow (but the history is always readable!).

Apart from the security matrix, we've considered restricting content on the wiki to non super secret stuff, but of course that needs to be monitored.

Another solution (the current) is to monitor views and report anything suspicious (e.g. one person at a customer site having 2000 views in two days was reported). Again - this is not ideal because this does not directly imply a wrong motive.

Does anyone have a better solution? How can a company wide wiki be made secure and yet keep its low threshold USP?

BTW we use MediaWiki with Lockdown to exclude some administrative staff.