3

In the Akeeba Backup docs, in the section "Securing the backup output directory" the following security recommendation is provided

Using a well known location would allow an attacker exploiting a security issue in a third party component to gain access to the backup archives. The only way around that is using a different directory, ideally one above your site's root. [emphasis added]

It seems to me that if one component can gain access to a directory (even one above the root), then any component can gain access to the same directory.

My question, therefore, is: Is it possible to secure a directory so that only a specific component (i.e. Akeeba Backup) can gain access to it? If yes, how would that be done?

Improve this question
1
  • 2
    Thought per-folder open_basedir-configuration would do the trick, but it probably will not work because everything goes through one Joomla PHP script which invokes all components.
    – Wieger
    Commented Feb 13, 2018 at 20:18

1 Answer 1

Reset to default
1

I really have no idea why people insist on using Akeeba Backups when you can just backup your website through a cron in cPanel/WHM (this is much more reliable).

Now let's go back to your question. What you can do is change the ownership and the permissions on the components folder to only allow Apache write access to specific components directories. Having said that, you cannot really do exactly what you want, which is allowing/disallowing access for a component on some specific directories, since components do not technically access directories, it is Apache (the webserver) that does that.

Improve this answer
3
  • 1
    To answer your question, Akeeba provides the tools for added convenience and security for creating automated, encrypted, offsite backups. For example, one recommended setup is to use the encrypted JPS format with 64 truly random character password, Amazon S3 with buckets for each site, a write-only IAM account, a policy for object lifecycle, saving certain older backups to Amazon Glacier and automatically removing the rest. I could be wrong, but I'm not sure creating this level of security and automation for backups is even possible through just the cPanel/WHM - at best it would be arduous.
    – NivF007
    Commented Feb 15, 2018 at 21:11
  • How often does a regular Joomla administrator use the above features? If you need only site backup, then the best (and, again, most reliable) method would be to use cPanel/WHM backup.
    – itoctopus
    Commented Feb 15, 2018 at 22:24
  • 1
    The cPanel/WHM option lacks facilities for automated offsite and encrypted backups therefore is neither secure nor reliable. You can do a search for best practices for backups, but it is generally accepted that a good policy will include remote storage, automated frequent and regular backups, a retention span policy, encrypted and protected from 3rd party access, use of RAID arrays and a stack of multiple solutions (i.e. some hosts take daily backups with a retention span of 30 days - a good addition to the above mentioned best practices). A conscientious admin will employ these practices.
    – NivF007
    Commented Feb 15, 2018 at 22:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.