{"id":7555,"date":"2024-01-05T11:59:23","date_gmt":"2024-01-05T11:59:23","guid":{"rendered":"https:\/\/www.webhi.com\/how-to\/?p=7555"},"modified":"2024-01-05T11:59:24","modified_gmt":"2024-01-05T11:59:24","slug":"setup-config-secure-moodle-ubuntu-debian-linux","status":"publish","type":"post","link":"https:\/\/www.webhi.com\/how-to\/setup-config-secure-moodle-ubuntu-debian-linux\/","title":{"rendered":"Install & secure Moodle on Ubuntu Linux"},"content":{"rendered":"\n
\"Installing<\/figure>\n\n\n\n

Introduction<\/h2>\n\n\n\n

Moodle<\/strong> is a free and open-source learning management system (LMS) that is used by schools, universities, businesses and other organizations to provide online courses and training programs. With Moodle, you can create customized learning environments complete with quizzes, forums, assignments, videos and more.<\/p>\n\n\n\n

Installing Moodle involves several steps including setting up a web server, database server, PHP, and the Moodle code itself. Properly securing the Moodle installation is also crucial to prevent unauthorized access and other security threats.<\/p>\n\n\n\n

This guide will walk through the step-by-step process of installing Moodle on a Linux server running Ubuntu 20.04\/22.04 or Debian. It also covers important security considerations and configurations to lock down access and protect data. Following these instructions will result in a fully functioning and secured Moodle environment ready for building courses.<\/p>\n\n\n\n

Prerequisites<\/h2>\n\n\n\n

Before installing Moodle, you should ensure your Ubuntu 20.04\/22.04 server is up-to-date and has the necessary packages installed:<\/p>\n\n\n\n

$ sudo apt update\n$ sudo apt upgrade -y\n$ sudo apt install apache2 mariadb-server php8.0 php8.0-curl php8.0-zip php8.0-gd php8.0-mbstring php8.0-xml php8.0-soap php8.0-intl -y<\/code><\/pre>\n\n\n\n
You will also need a domain name pointed at your server’s public IP address. This guide uses example.com<\/code>.<\/p>\n\n\n\n
Once the prerequisites are met, you can move on to installing and configuring the web server.<\/p>\n\n\n\n
Install Apache Web Server<\/h2>\n\n\n\n
Moodle requires the Apache web server to deliver web pages. Install Apache with this command:<\/p>\n\n\n\n
$ sudo apt install apache2<\/code><\/pre>\n\n\n\n
Adjust the firewall to allow HTTP and HTTPS traffic:<\/p>\n\n\n\n
$ sudo ufw allow in \"Apache Full\"<\/code><\/pre>\n\n\n\n
Test that Apache is running properly by accessing your server’s domain name or public IP address from a web browser. You should see the default Apache page.<\/p>\n\n\n\n
Set Up MariaDB Database<\/h2>\n\n\n\n
Moodle relies on a MySQL\/MariaDB database to store all course data. Install MariaDB with:<\/p>\n\n\n\n
$ sudo apt install mariadb-server<\/code><\/pre>\n\n\n\n
Run the security script to remove insecure defaults:<\/p>\n\n\n\n
$ sudo mysql_secure_installation<\/code><\/pre>\n\n\n\n
When prompted, set a root password, remove anonymous users, disable remote root login, and remove the test database. Answer ‘y’ to all other questions.<\/p>\n\n\n\n
Create a database user and database for Moodle. Change moodleuser<\/code> and moodlepassword<\/code> to secure credentials:<\/p>\n\n\n\n
$ sudo mysql -u root -p<\/code><\/pre>\n\n\n\n
CREATE DATABASE moodledb;\nCREATE USER 'moodleuser'@'localhost' IDENTIFIED BY 'moodlepassword';\nGRANT ALL ON moodledb.* TO 'moodleuser'@'localhost';\nexit<\/code><\/pre>\n\n\n\n
The MariaDB database is now ready for Moodle.<\/p>\n\n\n\n
Configure PHP 8.0 for Moodle<\/h2>\n\n\n\n
Moodle requires PHP with a few specific modules enabled.<\/p>\n\n\n\n
First, edit php.ini to adjust some recommended settings:<\/p>\n\n\n\n
$ sudo nano \/etc\/php\/8.0\/apache2\/php.ini<\/code><\/pre>\n\n\n\n
Find and update the following values:<\/p>\n\n\n\n
max_execution_time = 180 \nmax_input_time = 180\nmemory_limit = 256M\nupload_max_filesize = 100M\npost_max_size = 100M\nmax_input_vars = 3000<\/code><\/pre>\n\n\n\n
Save and exit the file when finished.<\/p>\n\n\n\n
Next, enable required PHP modules:<\/p>\n\n\n\n
$ sudo phpenmod mysqli pdo pdo_mysql json zip intl mbstring soap<\/code><\/pre>\n\n\n\n
Restart Apache for PHP changes to take effect:<\/p>\n\n\n\n
$ sudo systemctl restart apache2<\/code><\/pre>\n\n\n\n
PHP is now ready to run Moodle.<\/p>\n\n\n\n
Download and Install Moodle<\/h2>\n\n\n\n
With the web server, database, and PHP configured, you can now install Moodle itself.<\/p>\n\n\n\n
First, switch to the Apache document root directory:<\/p>\n\n\n\n
$ cd \/var\/www\/html<\/code><\/pre>\n\n\n\n
Download the latest stable release of Moodle:<\/p>\n\n\n\n
$ sudo wget https:\/\/download.moodle.org\/download.php\/stable403\/moodle-4.3.2.zip<\/code><\/pre>\n\n\n\n
Unzip the files:<\/p>\n\n\n\n
$ sudo unzip moodle-4.3.2.zip<\/code><\/pre>\n\n\n\n
Rename the directory:<\/p>\n\n\n\n
$ sudo mv moodle moodle-install<\/code><\/pre>\n\n\n\n
Set permissions:<\/p>\n\n\n\n
$ sudo chown -R www-data:www-data \/var\/www\/html\/moodle-install\n$ sudo chmod -R 755 \/var\/www\/html\/moodle-install<\/code><\/pre>\n\n\n\n
Access your server’s domain name followed by \/moodle-install<\/code> in a web browser. You will be taken to the Moodle installation page.<\/p>\n\n\n\n
Select your language and proceed to the next step. Provide your database details including host, name, user, and password. For data directory, enter the path \/var\/www\/html\/moodledata<\/code>. Complete the installation process by setting an admin username, password, and site name.<\/p>\n\n\n\n
After the configurations are saved, you will be taken to the main Moodle interface. The base system is now installed and must be secured.<\/p>\n\n\n\n
Secure the Moodle Installation<\/h2>\n\n\n\n
A default Moodle installation contains multiple security vulnerabilities that must be addressed. This involves settings changes in Moodle itself as well as the web server and database.<\/p>\n\n\n\n
Use HTTPS<\/h3>\n\n\n\n
HTTP traffic is unencrypted and can expose passwords and other sensitive data. To enable HTTPS on Apache:<\/p>\n\n\n\n
$ sudo a2enmod ssl \n$ sudo systemctl reload apache2<\/code><\/pre>\n\n\n\n
Acquire an SSL\/TLS certificate from a provider like Let’s Encrypt and install it according to their documentation. Redirect all HTTP traffic to HTTPS by editing \/etc\/apache2\/sites-available\/000-default.conf<\/code>:<\/p>\n\n\n\n
<VirtualHost *:80>\n        Redirect \"\/\" \"https:\/\/example.com\/\"\n<\/VirtualHost><\/code><\/pre>\n\n\n\n
Save the file and reload Apache again. Accessing the domain should now redirect to a secure HTTPS connection.<\/p>\n\n\n\n
Set File Permissions<\/h3>\n\n\n\n
The Moodle files and directories must be owned by the web server user. Run:<\/p>\n\n\n\n
$ sudo chown -R www-data:www-data \/var\/www\/html\/moodle*<\/code><\/pre>\n\n\n\n
Lock down permissions further with:<\/p>\n\n\n\n
$ sudo find \/var\/www\/html\/moodle* -type d -exec chmod 750 {} \\; \n$ sudo find \/var\/www\/html\/moodle* -type f -exec chmod 640 {} \\;<\/code><\/pre>\n\n\n\n
This prevents the web user from creating or modifying files in the Moodle folders.<\/p>\n\n\n\n
Use a Strong Admin Password<\/h3>\n\n\n\n
When initially installing Moodle, set a very strong password for the admin account. Make sure it is at least 16 characters, uses numbers, symbols, uppercase and lowercase letters.<\/p>\n\n\n\n
You can also improve password policies by enforcing minimum length and complexity under Site Admin > Security > Site Policies.<\/p>\n\n\n\n
Limit Course Creators<\/h3>\n\n\n\n
By default, any logged in user can create new courses in Moodle. This is unnecessary exposure. Instead, limit course creation to just the admin by going to Site Admin > Users > Permissions > Define Roles.<\/p>\n\n\n\n
Under the Authenticated User role, uncheck “Create new courses”. Save changes. Now only the admin can create courses.<\/p>\n\n\n\n
Disable Guest Access<\/h3>\n\n\n\n
Guest access allows anyone to log in and see course content without registering a user account. Disable this under Site Admin > Users > Authentication.<\/p>\n\n\n\n
Set “Enable guest access” to No and save changes. Require user registration for all access.<\/p>\n\n\n\n
Use HTTPS for Database Connection<\/h3>\n\n\n\n
By default, Moodle connects to the database over unencrypted HTTP. Encrypt this traffic by editing \/var\/www\/html\/moodle-install\/config.php<\/code>:<\/p>\n\n\n\n
Find the line:<\/p>\n\n\n\n
$CFG->dbhost    = 'localhost';<\/code><\/pre>\n\n\n\n
Change it to:<\/p>\n\n\n\n
$CFG->dbhost    = 'localhost:3306';<\/code><\/pre>\n\n\n\n
This forces an SSL encrypted connection.<\/p>\n\n\n\n
Secure the Database<\/h3>\n\n\n\n
Lock down the MariaDB database by first setting a strong root password.<\/p>\n\n\n\n
Next, restrict remote access with these edits to \/etc\/mysql\/mariadb.conf.d\/50-server.cnf<\/code>:<\/p>\n\n\n\n
bind-address            = 127.0.0.1\nport                    = 3306<\/code><\/pre>\n\n\n\n
This prevents external connections to the database. Restart MariaDB after making changes.<\/p>\n\n\n\n
Also ensure the mysql Unix user has no login shell:<\/p>\n\n\n\n
$ sudo usermod -s \/usr\/sbin\/nologin mysql<\/code><\/pre>\n\n\n\n
This prevents any OS-level access with the mysql account.<\/p>\n\n\n\n
Limit PHP File Uploads<\/h3>\n\n\n\n
Uploaded files could contain malicious code and should be limited. Edit \/etc\/php\/8.0\/apache2\/php.ini<\/code> and add:<\/p>\n\n\n\n
file_uploads = On\nupload_max_filesize = 2M\nmax_file_uploads = 2<\/code><\/pre>\n\n\n\n
This restricts uploads to 2 files of 2MB each. Tweak for your specific needs.<\/p>\n\n\n\n
Disable PHP Execution in Uploads<\/h3>\n\n\n\n
To prevent execution of uploaded PHP files, disable it specifically for the upload directory:<\/p>\n\n\n\n
<Directory \/var\/www\/html\/moodledata\/filedir>\n   php_admin_flag engine off\n<\/Directory> <\/code><\/pre>\n\n\n\n
Add this to your Apache config at \/etc\/apache2\/sites-available\/000-default.conf<\/code> inside the VirtualHost tags.<\/p>\n\n\n\n
Install a Web Application Firewall (WAF)<\/h3>\n\n\n\n
A WAF provides deep monitoring and filtering of all web traffic. It can block SQL injection, XSS, CSRF and other attacks before they reach Moodle.<\/p>\n\n\n\n
The open source ModSecurity WAF integrates closely with Apache. Follow a guide to install it for robust threat protection.<\/p>\n\n\n\n
Use Security Plugins<\/h3>\n\n\n\n
Moodle provides plugins that enhance security in areas like authentication, permissions, filtering, and more. Consider enabling plugins like No Self Signups, ReCAPTCHA, Access Rule Levels, etc.<\/p>\n\n\n\n
Conclusion<\/h2>\n\n\n\n
You should now have a fully functioning Moodle environment installed on Ubuntu with a secure LAMP stack configured to lock down vulnerabilities. Some next steps are:<\/p>\n\n\n\n