: How can I secure an installation of MediaWiki? I want to run an installation of MediaWiki as a Internet-accessible personal wiki, running on wiki.mysite.com. However, I want to ensure that I

@Hamaas447

I found Lockdown works really well.

Vote Up Vote Down

@Sarah324

I've used MediaWiki as a CMS on quite a few occasions, though my goal has been to publish (i.e. allow anyone else to view and only editors access to write) content but restrict edit access.

To lock down write privileges:

$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['editpage'] = false;
$wgGroupPermissions['*']['edittalk'] = false;
$wgGroupPermissions['*']['createpage'] = false;
$wgGroupPermissions['*']['createtalk'] = false;

$wgGroupPermissions['sysop']['createaccount'] = true;
$wgGroupPermissions['sysop']['edit'] = true;
$wgGroupPermissions['sysop']['editpage'] = true;
$wgGroupPermissions['sysop']['edittalk'] = true;
$wgGroupPermissions['sysop']['createpage'] = true;
$wgGroupPermissions['sysop']['createtalk'] = true;


... and allow use of raw HTML (highly desirable if you're using MW to publish):

$wgRawHtml = true;


Using basic user authentication supported by your webserver sounds like a reasonable way to prevent unauthorized parties from reading the content of your wiki, though there is probably no need to prevent people who are already authenticated from writing on your wiki (unless you have three tiers of privilege - i.e. no-read,no-write/read,no-write/read,write).

Edit: For long-term use (and if you need to support a growing number of users' privileges) I think you'd be best-served to find a plugin which supports exactly what you're trying to do and/or customize your MW installation to handle user authentication for reading in addition to write access.

Note that many of the existing MW plugins intended to prevent read access on specific pages have been plagued with "bugs" (i.e. a user could use the MW Export functionality to see the content of the page) because MW itself was never intended to include the feature in question - if you're hosting stuff no one else should see, you'll likely need to lock a lot of things down.

One site you might be interested in would be mwusers.com - plenty of relevant discussion (including experience w/various strategies and plugins) there.


Can you elaborate on the permissions that MW has built in?


Bureaucrats (can promote user to sysop) > Sysops (can protect and import pages, can ban users) > Users (can read, write, and edit on default installation)

Check out the Help:Sysops and permissions page at MediaWiki.org for further details on the default functionality and Manual:User rights for built-in MW configuration options.

Vote Up Vote Down