Skip to Content
Last modified by Alexandru Pentilescu on 2023/06/25 18:56
From version 36.1
edited by Alexandru Pentilescu
on 2022/06/09 22:38
Change comment: Upload new image "Denied.png", version 1.1
To version 46.1
edited by Alexandru Pentilescu
on 2022/06/09 23:19
Change comment: There is no comment for this version

Summary

Details

Page properties
Content
... ... @@ -241,12 +241,14 @@
241 241  Congratulations, you've finished your first installation!
242 242  
243 243  
244 -= Post-installation configurations that are a good idea=
244 += Post-installation configurations that are a good idea =
245 +
245 245  You've setup an administrative account, you installed the Standard flavor package and now the Wiki is up and running. You're pretty much done, right?
246 246  Well, not quite...
247 247  There are still certain configurations which are a good idea that you should do. First and foremost, you should disable account registration, if possible, to ensure that rogue visitors don't get to pollute your database with bogus names. The user registration process is available to all visitors, by default, and this means that literally anyone can register an account on your Wiki. Which may be what you want or it might not be. For me, I prefer creating user accounts manually as the administrator so I opted to turn off the registration option. I suggest you do the same.
248 248  
249 -== Disable guest registration==
250 +== Disable guest registration and configure unregistered users' rights ==
251 +
250 250  Log into your administrative account if you're not already logged in. Press the hamburger menu button at the top right of the grettings page and open the side menu. From there, select the "Administer Wiki" option.
251 251  On the new page, expand the "Users & Rights" left panel and then click on the "Rights" menu option. You should then be redirected to a "Global Administration: Rights" page. Here, you can micro-manage the rights of every single user and groups of users. Explaining user rights and the exact functions of each of these options is outside the scope of this wiki. For now, I'll only describe the disabling of the registration.
252 252  There's a horizontal combo box on the new page with the "Groups" and "Users" options, on the top of the page. Click on the "Users" option.
... ... @@ -255,8 +255,36 @@
255 255  In computer graphics design, one of the most fundamental lessons is that the element of a Checkbox is the graphical equivalent of a mathematical boolean variable (i.e. it must have only one of two states, at any point in time): a checkbox must either be checked or unchecked. The XWiki Rights panel has a different kind of checkbox, though, one that can take 1 of 3 states: empty, allowed and denied. In most cases, the default is the empty state.
256 256  Empty means that no particular configuration has been made with respect to that right for that user.
257 257  In our case, we wish to deny registration rights for unregistered users, so we have to set the "Registration" checkbox of the "Unregistered Users" row in that table to the "denied" state, like in the screenshot below:
260 +[[image:Denied.png]]
258 258  
262 +I intentionally left the "View" and "Comment" rights specifically allowed for "Unregistered Users" as I believe that visitors should, intrinsically, have the ability to contribute to content as they see fit, without having to register for an account. You may wish to tweak these user rights as you see fit, though.
263 +If you will allow unregistered users to comment, though, please consider checking the checkbox below for requiring them to solve a CAPTCHA for each comment, like I did. This will prevent technically savvy individuals from writing automated scripts or bots that will access your wiki and continously and automatically keep generating machine-generated text comments. While this will not prevent humans from posting spam on your Wiki, it should prevent bots from doing so.
264 +
265 +
266 +== Configuring an SMTP server for your XWiki ==
267 +
268 +Having a reachable SMTP server that your XWiki instance can use may come in handy, at some point.
269 +The most obvious example of this is when you forget your XWiki user's password. When this happens, you will not be able to login anymore and, if this was the password for your administrator account, then, you're out of luck.
270 +Having the option to reset your password via email will be really useful in this particular case. Of course, this implies that the email you set during your account setup is not outdated and still in your control.
271 +To configure an SMTP server, go to the "Administer Wiki" section of the hamburger menu again, then expand the "Mail" section of the options on the left side and finally click on the "Mail Sending" menu option.
272 +[[image:Mail.png]]
273 +Of course, the exact configuration options you have to enter depend on your SMTP server's configuration. If you configured mandatory authentication on your SMTP server, you will have to enter login credentials here. I don't have to do that, personally.
274 +The "EMAIL ADDRESS TO SEND FROM" can be any email address you wish to configure. Preferrably, it should be under the domain name of the machine where you're running your XWiki from (in my case, under "pentilescu.com").
275 +The "EMAIL SERVER" option is a bit trickier. Assuming you're using postfix as your SMTP server, this should be an email configured in the "inet_interfaces" setting from the "/etc/postfix/main.cf" configuration file.
276 +Also, if your postfix is not configured to accept email relays from outside its network, as mine does, you must remember to edit "/etc/postfix/main.cf" to add "192.168.80.3" to its "mynetworks" configuration, to, essentially, whitelist your docker container as a valid relay source, otherwise it will deny any email sending requests from it.
277 +Please be sure to use the appropriate IP address as configured in your "docker-compose.yml" file for your xwiki service.
278 +For more information about postfix and setting it up, please visit the "How to setup a postfix SMTP server" article in the external references section at the bottom of this article!
279 +
280 +== Modifying cookie encryption keys==
281 +XWiki has an interesting login mechanism. It doesn't use session tokens to keep track of your user account. What it does do is that it stores two session cookies in your browser: one for your username and one for your password.
282 +Every time you make a request to your server, these two session cookies are sent along with each request, effecitvely authenticating it.
283 +This might seem as a huge security problem, as the password is stored in the session cookie and it can be easily viewed by anyone with local access to the web browser's machine.
284 +To mitigate this security risk, XWiki encrypts both the username cookie's value and the password cookie's value using keys configured in a configuration file. These keys come with strong default values, by itself but, since these values are the same for everyone that downloads the docker image, are inherently public.
285 +As such, you, as the administrator, should change these encryption keys to your own, randomly generated ones. To do so, go to <your XWiki directory>/data/xwiki-data/data/ and modify the "xwiki.cfg" configuration file there. This file should have two configuration options called "xwiki.authentication.validationKey" and "xwiki.authentication.encryptionKey". Generate, from scratch, two different 32 character long encryption keys and replace the default ones with your ones. Uppercase and lowercase letters, as well as digits, are allowed. I don't believe other symbols are accepted though.
286 +Change these and restart the docker container, for the changes to apply.
287 +
259 259  = External references =
260 260  
261 261  [[Official docker guide for installing XWiki>>https://github.com/xwiki/xwiki-docker/blob/master/README.md]]
262 -How to setup an Nginx reverse proxy and also provide a global X.509 certificate for it -- NOT YET WRITTEN!--
291 +How to setup an Nginx reverse proxy and also provide a global X.509 certificate for it [NOT YET WRITTEN!]
292 +How to setup a postfix SMTP server [NOT YET WRITTEN]
Mail.png
Author
... ... @@ -1,0 +1,1 @@
1 +XWiki.AlexandruPentilescu
Size
... ... @@ -1,0 +1,1 @@
1 +156.4 KB
Content