Web server administration

tbd @

Server Software

This is the software I have experience in using while running a MediaWiki.

Software updates should always be configured to be applied automatically for security reasons.

Always use a different, large, generated password for all your accounts. Even if brute force attacks are prevented by your system, using weak passwords is just inviting trouble.

Instructions contains some links to some instructions that are potentially useful for a web server admin.

Aspect	Software	MediaWiki Link	Useful Links	Version Upgrades	Notes
Operating system	Ubuntu		Ubuntu version history	should be possible by using the web interface supplied by the Web hosting service	A web server should always be running a Linux-Kernel marked as LTS (Long-term support).
Web hosting control panel	Plesk		Plesk Updates	Plesk Upgrade; but it could be tied to the operating system by the Web hosting service	A web hosting control panel simplifies the administration of a web server. Many configurations can be changed by using the web browser interface, and it can be expanded with additional #Plesk Components and Extensions. Plesk also has the option of configuring automatic database backups; I would not recommend this, because Plesk uses the database management system too - and if the DMS does not start anymore (happened to us in 2019), the Plesk interface and thus the backups will also not be available. We currently use a backup-Script.
Web application firewall	ModSecurity		documentation	automatically	ModSecurity will deny certain harmful requests based on a ruleset. Not to be confused with the Plesk Firewall extension.
intrusion prevention software framework	Fail2ban		github-page	automatically	Fail2Ban will block IPs from which a certain number of denied requests originate. This stops Brute-force attacks.
Job scheduler	Cron		Cron	automatically	Systemd could probably be used too.
Web server	Apache	Apache configuration	documentation mod_deflate mod_expires mod_rewrite mod_fcgid mod_limitipconn.c	automatically	nginx could be used too.
web server scripting language	PHP	PHP configuration Manual:Installation_requirements#PHP	documentation phpinfo FastCGI Process Manager (FPM) PHP Increase Upload File Size Limit	should be possible by using the web hosting control panel	The extension php-intl (required by MediaWiki) was not pre-installed on the server, so we added it via SSH: sudo apt install php php-intl php-mbstring php-apcu php-curl
Object cache	APCu	Manual:Performance tuning#Object caching	help.creoline.com cloudservices.store		APCu is a php extension which we need for the MediaWiki cache. It was not pre-installed on the server.
Database management system	MariaDB	Manual:MariaDB	Configuring MariaDB with Option Files mariadb commands mariadb-dump Restore the mysql database from .frm files	has to be done manually via SSH: Upgrade 5.1 to 5.5 Upgrade 5.5 to 5.6	Before upgrading, it is advisable to create #Backups of the databases by using mariadb-dump and by directly copying the database file: cp -a /var/lib/mysql /var/lib/mysql_backup If the upgrade does not work, it is possible to recover the databases (after reverting the upgrade): rm -fr /var/lib/mysql cp -a /var/lib/mysql_backup /var/lib/mysql Alternatively, and probably preferable, the mariadb-dump backup could be imported into the new system by using phpMyAdmin or by accessing mariadb via SSH.
Database administration	phpMyAdmin		documentation	automatically	Enables the administration of databases through the web browser. It works well for small databases, but operations on large databases should be done via SSH, because of the possibility of timeouts in the web interface.
Thumbnail creation	ImageMagick inkscape (for svg) poppler-utils (for pdf)	Manual:Image administration		automatically	These programs were not pre-installed on the server, so we added them via SSH: sudo apt -y install imagemagick inkscape poppler-utils
Texteditor on the web server	vi		VIM Basic vi Commands	automatically	Some configuration files can only be accessed via SSH, so sometimes it is necessary to use a text editor started from the command line. Luckily, one only has to learn a few commands in order to be able to change a few lines: open file with vi: vi filename change to edit mode: i exit edit mode: <Esc> save file: :w exit vi: :q exit vi without saving changes: :q!
Web analytics	GoAccess		documentation IP-location databases Setting up GeoIP	automatically	Web analytics programs will analyze access log files and generate statistical reports. If you (have to) care about data privacy protection, do not use google analytics. In Plesk, GoAccess is easy to activate: Tools&Settings -> Plesk -> Updates -> Add/Remove Components Web Hosting -> GoAcess Then, for every domain: Websites & Domains -> Hosting & DNS -> Hosting -> Web statistics -> GoAcess Then define a cron-job: /usr/local/psa/admin/sbin/statistics It does lack a geoIP database though, and thus will not display geo-information. Download a mmdb database and edit the conf file (find it with goaccess --dcf) with this line: geoip-database /path/to/your/database.mmdb If this does not work (did not for me thus far), you could try using other #log analysis programs.

Plesk Extensions

Aspect	Extension	Useful Links	Notes
Firewall	Plesk Firewall	documentation	The order of the firewall rules can be changed. The first fitting rule encountered in the list for a request will determine the behavior of the firewall: If a deny rule is found first, the request will be denied, and if an allow rule is found first, the request will be allowed, no matter which rules are further down the list.
System monitoring in Plesk UI	Monitoring		Shows server metrics as graphs, which is useful for finding time slots of unusual activity.
Log viewing in Plesk UI	Log Browser		Lets the user view the latest log entries of logs relevant to web server activity. Useful for inspecting incoming requests and analyzing errors.
Plesk configuration editing in Plesk UI	Panel.ini Editor		Enables the editing of the Plesk configuration in the Plesk UI.

404 errors

Some clients will ask for files which do not exist on your server.

There are three cases:

1. Some automated system is looking for some #standardized files which you do not provide. You could think about providing it.
2. Bad actors are #searching for weaknesses in your system. Such requests are good candidates for being redirected to Bot-trap via htaccess.
3. Someone follows a wrong or old link, or manually types a wrong URL into their web browser. If a wrong link originates somewhere on your own website, you could try to find and fix it.

searching for weaknesses

Any of the following 404 hits can be considered an attack, and the corresponding IP blocked by your system:

1. With the exception of .well-known (Well-known URI), any 404 hit of a dot file (I saw .azure, .aws, .claude, .bashrc, .vscode in my logs).
2. With the exception of the files of your system, any .php, .zip, .rar, .asp or .lua file (I saw a large number of those, some of them files which are used by non-MediaWiki CMSs for admin access).

Make sure dot files are not in your web-root if they don't have to be, and make sure the admin access to all your systems is well protected. Using a weak password, for example, is alike to begging for someone to breach your system.

standardized files

File	Explanation	Link	Fix
favicon.ico	this picture will be displayed in the web browser	Favicon	use favicon.ico to generate your favicon from an image file
robots.txt	this file is requested by well-behaved bots to gain information about which URLs they should not request; if you want to enforce these rules, you could use Bot-trap	robots.txt	create the file with whatever rules you wish
sitemap.xml	this file is intended to inform well-behaved bots about the URLs available on the website	sitemap.xml	use some script to create the file; in MediaWiki there is generateSitemap.php
age.xml age-de.xml	rating file from the Commission for Youth Media Protection in Germany (KJM)	jugendschutzprogramm.de	use the label generator or just create an empty file with that name
ads.txt	file for internet fraud prevention	ads.txt	create the file with the following content: placeholder.example.com, placeholder, DIRECT, placeholder, or fill it with your information
ai.txt	file intended to inform AI agents about your website	aitxt.ing ai.txt: A Domain-Specific Language for Guiding AI Interactions with the Internet	create an empty file with that name, or fill it with some text describing your website and what AI agents should or should not do with it

discontinued or non-standard

File	Explanation	Link	Fix
labels.rdf	discontinued rating file from the Internet Content Rating Association (ICRA)	java-samples.com	just create an empty file with that name
apple-touch-icon	apple expects websites to create a special icon, just for them	Manual:$wgAppleTouchIcon	just copy your site logo, or create an empty file with that name
trafficbasedsspsitemap.xml	bing bot expecting to find a non-standard sitemap	webmasters.stackexchange.com	just create an empty file with that name
browserconfig.xml	file expected by the Internet explorer	microsoft.com	just create an empty file with that name

Personal Computer Software

Software running on your own system which is helpful in administrating a web server.

Webserver Access

Aspect	Software	Useful Links	Notes
FTP access	FileZilla	FileZilla The dangers of ASCII mode Benutzer:StipenTreublatt/Usability-Fails#FileZilla	Although file transfer is certainly possible through SSH, I prefer FTP for working on the web folder. Warning: Never use ASCII-mode! Make sure FileZilla is configured to use binary mode, otherwise files might be corrupted.
SSH access	SSH (Linux) PuTTY (Windows)	Index of the Linux command line: bash + utilities Auto login in PuTTy with password	SSH access to a web server enables a user to run programs on the server through the command line. Use with caution.

log analysis

Software	Useful Links	Notes
Analog CE		continuation of Analog
Webalizer Xtended		fork of Webalizer

Working with Code

Aspect	Software	Useful Links	Notes
Data compression	7-Zip (Windows) gzip (Linux)	gzip	Software packages presented for download (like the MediaWiki software and it's extensions) are almost always compressed. You will need software to decompress the package before being able to use it.
Source code editing	PSPad (Windows) Geany (Linux) Kate (Linux)		In order to be able to edit source code (like the localsettings of MediaWiki) correctly, one has to use a source code editor. Warning: Never use texteditors like Windows Notepad or Microsoft Word for this, it will break your file.
IDE	VSCodium	vscodium.com	An IDE makes bugfixing or code rewriting a lot easier. VSCodium is the "telemetry-free" (read: surveillance-free) version of VS Code.