2 Questions (phpmyadmin)(securing the server)

[Junior93]

Hi i am Junior and i have to questions about xampp.

I installed xampp today.

First:
I am having a problem with phpmyadmin, it never imports, it just gets canceled at the 300 second limit, some of if gets imported but not all (its not very big, zip compressed 3mb, without compression 20mb).

Second:
In a close future i will be instaling my SMF forum on the xampp server, and i want to know how to make it secure (other than adding the xampp example, mysql, php passwords). What will i have to do/install.


Best Regards.

[JonB]

A - Use the MySQL CLI - (command line interface) - no more time outs -
Here's a good page that explains it - (AND backing up)
http://www.webcheatsheet.com/SQL/mysql_ ... estore.php

B - I have a short guide on the Basics of XAMPP Security -
http://bravo.newnetenterprises.com/word ... age_id=387

Good luck & have a good time

[Junior93]

I have read that xampp should not be used to be accesed publicly.
What i want to do is put my SMF forum there, so people can access it on WAN (this would be accesing publicly. Would this affect me in any way?

[JonB]

The reason 'people' and the developers say XAMPP is not for 'production' environments, is that BY DEFAULT (when you 'just install it') - its not very secure. It was configured by the XAMPP developers to be that way - so that testing and devlopment work wouldn't hit a lot of roadblocks.

HOWEVER - inside XAMPP is the exact same source code Apache, PHP, Perl and MySQL as any other installation (all compiled for Win32, thread safe Apache). The difference is in the configuration values. If you follow good basic security procedures (make changes such as those I recommend) - your XAMPP install is not much different than any other AMP 'stack' built - they ALL come from the same source code, just like all Linux distributions start with the same Linux kernel. Its all in how you set them up. My guide takes you to the point its reasonably secure.

BTW - I have an SMF forum myself running on a W2K3/IIS6 server, so I'm familiar with what's needed. All Forums - effectively - have their own security, whether its YaBB, phpBB, or SMF just like blogs and CMS's. So all you 'really' have to secure is MySQL and phpMyAdmin - after that you are at the mercy of the built-in spam-guards and anti-hacking measures the devs on the various forums projects have built into the software and its configuration tools (like the 'included' .htaccess files).

That ECG Guide sits on a XAMPP server that also has two forums, a mulitingual PHP web portal built around a WordPress core, and a MySQL research database development project. They are all experiments, and I don't plan on really heavy trafiic. But that's all a function of hardware and bandwidth, not the software configuration. I won't jinx myself by saying 'feel free to attack my server', lOl. There are suites that can be used to 'beat up' servers - and I do that periodically with all my servers, kinda to see what's new and different in the way of attacks - Score to date - JonB has pitched consecutive shutouts, hehehe.

The relevant question is 'how many concurrent visitors'. If its in the hundreds, you need a 'real hosting setup' like a VPS - if its realistically 5 to 10 concurrent users - you would be very surprised how little hardware and bandwdith you need to keep it humming (either with a WAMP/XAMPP/LAMP stack or with IIS) - I have 'all those' in different flavors, including what anyone would call 'real dedicated servers' and VPS's running server OS' and installed in datacenters, so I'm not fussy what you want to run, I'm a realist/pragmatist.

[Junior93]

Thank you for your replys Jonb.
My forum gets maximun online at once 100. And visits per day about 200

[JonB]

Supporting 100 simultaneous users online - that actually post - is probably NOT a task running XAMPP on Windows would be well suited to in my opinion. Do you have traffic info that says you get that many users - that's a LOT - unless its a sports or TV forum where usage spikes at 'showtimes'. Don't forget that bots use trafffic as well. If its a lot of browsing traffic it might be doable. You also need good bandwidth and a husky machine. Every user requires multiple page generations, even if they just hit a few spots. I have never looked at the matter of caching for SMF, nor do I know exactly how it supports it. I would be real curious how many members, boards, topics and posts you currently have (or send me a link by PM) (and how long you have been up.)

You are aware that 'most users' stats are buffered in both YaBB and SMF by the time setting?? if set to 5 minutes, for instance an user will still be a guest for five minutes after they have gone - its so that people don't pop-in pop-out on the stats by closing, repopening windows, the browser etc.. It also is affected by users 'timing out' on their sessions.

I'd suggest you ask on the SMF forums, giving your machine specs, and bandwidth (and type) + what you just posted here. They woul;d be better judges than I.

Good Luck.