Website@School Users' Guide
Prev		Next

Installation

1. Introduction
1.1 Conventions
1.1 1 General
1.1.2 Documentation conventions
1.2 Requirements
1.2.1 Technical requirements
1.2.2 User requirements
1.3 Preparations
1.3.1 Downloads
1.3.2 Installing on a server with root acces
1.3.3 Installing on a server without root access
1.3.4 Installing on a XS4ALL server
1.4 On secure passwords

2. The installation
2.1 Language
2.2 Installation type
2.3 License
2.4 Database
2.5 Website
2.6 User account
2.7 Compatibility
2.8 Confirmation
2.8.1 Crossroads
2.9 Finish
2.10 Download configuration file

3. Tips for a secure installation
3.1 Program files and configuration file
3.2 Data files
3.2.1 Outside the document root
3.2.2 Inside the document root

4. After the installation
4.1 Virus scanning
4.2 Session name
4.3 Proxy friendly URLs

5. Errors
5.1 Cancelled installation
5.2 Unable to write in data directory
5.3 Config.php write problems

6. Concluding remarks

1. Introduction

This chapter describes the installation of Website@School . Two installation modes are available, 'Standard' and 'Custom'. In the screen shots the 'Standard' installation is depicted. In the text both types are described.

1.1 Conventions

1.1.1 General features

Some general features of Website@School are not that easily found.

Mouseovers: Almost every image, icon, button, link or data field has a mouseover text. Please hover over these items to see a short description, and explanation or shortcut key combination for an item. This user friendly feature is aimed at the novice user of a CMS.
Shortcut keys: You do not need a mouse to work with Website@School. Items are accessible with shortcut keys that are mentioned in the mouseover. Your browsers manual will tell you which keys to press in conjunction with the shortcut keys.
Yellow status bar: The yellow bar will give status messages, for example:
Data folder (cannot be changed later on): filename not acceptable: 'grade 8'
Confirmation or error messages will be displayed in this yellow bar. If necessary these messages can be copied and past in e-mail or forum posts for support.
Pop up windows: Sometimes pop up windows are displayed together with the yellow status bar. They draw your attention and you have to turn them off to proceed. Read them, then click the [OK] button. The pop up messages are also displayed in the yellow status bar to cut and paste them.

1.1.2 Documentation conventions

Below are the text elements that have a special markup:

[Enter] or, for example [Alt-N]: To indicate that you can use the keyboard.
index.php: To indicate a file name.
Name: The bold underlined character of field titles identfy the keyboard shortcut that can be used to access or modify the item. Your browsers manual will tell you which keys to press in conjunction with the bold underlined character.
[D] or, for example [P]: In high visibility mode (for blind and visually impaired persons) the first one indicates the Trashcan (Delete). The second one indicates the Page preview icon.
Private area [ ] Mark ... etcetera: The [ ] in a text indicates a checkbox.
Add a page or, for example Area: A blue text (i.e. a clickable link) refers to the same text in a screenshot.
Add an area, or for example Page Manager: Bold text refers to an item that is visible in a screenshot.

1.2 Requirements

1.2.1 Technical requirements

Website@School requires a LAMP or WAMP compatible server. That is, the program can be installed on Linux and Windows servers that are equipped with the Apache webserver, the MySQL database and the PHP scripting language. Please note that the following minimal versions are required by Website@School:

Apache: version 2.0.53 or higher
MySQL: version 4.1.x or higher
PHP: version 4.3.10 or higher

XAMPP

Website@school also runs on computers equipped with XAMPP, version 1.7.4 or higher. XAMPP is a good solution when you want to run Website@School on your own computer.

1.2.2 User requirements

Website@School is not particularly difficult to use but it does require a willingness to read and follow the instructions. If you have a natural aversion to reading instructions, and your approach to new software is to click on every button you see until something resembling the desired effect occurs, then Website@School is probably not suitable for you. Courtesy OmegaT User Requirements.

You need some computer skills to install Website@School:

Basic computer skills like downloading files and unpacking them, creating directories and copying files.
You can work with an FTP (File Transfer Protocol) program to upload files to a server when you have no direct access to the server where Website@School will be installed. Filezilla is a good OSS/GPL FTP program. See http://filezilla-project.org/.
You can create a database, either on the command line or with a program like phpMyAdmin. See http://www.phpmyadmin.net/home_page/index.php.
Some working knowledge about file ownership and permissions.
NOTICE:
It is very important for security reasons to set these permissions correctly. You want a secure website at your school to protect the confidential information that will surely be stored in the data directory. Next to that you want to protect your Website@School installation and your server against intruders. Specially paragraph 3. Tips for a secure installation discusses this important subject.

When you are uncertain about your skills, it's better to ask help at a local Linux group. They are virtually everywhere and are willing to perform a small service for the school and (possibly) your kids. See http://en.wikipedia.org/wiki/Linux_User_Group

1.3 Preparations

Before you can begin with the actual installation of Website@School, a few things have to be taken care of. Depending on whether you have root access to the server or your server is located at an ISP (Internet Service Provider), you have to follow different routes.

Start with creating some place to download files if it not already exists.

Installing on a server with root access: For example, use the /tmp directory for the downloads.
On a server without root access: When the server is located at an ISP (Iternet Service Provider), you have to download and uncompress the files on your own computer.
In the home directory create a directory for the downloads, for example downloads.

Downloading the Website@School program is discussed in the next paragraph.

1.3.1 Downloads

Proceed as follows to download the necessary files:

Browse to our download location at http://download.websiteatschool.eu and download the latest versions of:
The Website@School program, e.g. the file websiteatschool-0.90.0.zip or websiteatschool-0.90.0.tar.gz[ * ].
The Website@School manual, e.g. the file websiteatschool-manuals-en-0.90.0.zip or websiteatschool-manuals-en-0.70.0.tar.gz[ * ].
(Optional) Download additional W@S language packs, e.g. the file websiteatschool-languages-es-0.10.0.zip or websiteatschool-languages-es-0.10.0.tar.gz[ * ] for the Spanish language files.

[ * ] The content of the .zip archives and the .tar.gz archives are the same; you only have to download one of the two.

When on a server with root access, proceed to the next paragraph. When the server where Website@School is to be installed is located at an ISP (Internet Service Provider), proceed with paragraph 1.3.3 Installing on a server without root acces

1.3.2 Installing on a server with root acces

Now that you have downloaded the necessary files, you can unpack them on the right location, the webserver Document Root, e.g. /home/httpd/htdocs or C:\Program Files\Apache Group\Apache\htdocs. Proceed as follows.

Navigate to the webserver Document Root.
Use your favorite tool to unpack the program. Assuming you have saved the downloads in the /tmp directory, use the following command to unpack a .zip file:
[root@exemplum htdocs]# unzip /tmp/websiteatschool-0.90.0.zip
When using tar, unpack with:
[root@exemplum htdocs]# tar xzvf /tmp/websiteatschool-0.90.0.tar.gz
NOTICE:
The file is unpacked in the current directory.
Do the same with the manual and the (optional) language file(s).

Afteer this operation the following files and directory are created in the webserver Document Root:

-rw-r--r-- 1 root root 2210 Feb 1 14:00 admin.php -rw-r--r-- 1 root root 7827 Feb 1 14:00 config-example.php -rw-r--r-- 1 root root 2204 Feb 1 14:00 cron.php -rw-r--r-- 1 root root 2653 Feb 1 14:00 file.php -rw-r--r-- 1 root root 2675 Feb 1 14:00 index.php drwxr-xr-x 1 root root 824 Feb 2 10:11 program

We refer to this directory as the CMS Root Folder. In this case, the CMS Root Folder is the same as the webserver Document Root.

NOTICE:
Even though it is strongly recommended to install Website@School in the webserver Document Root, it is perfectly possible to install the program in a subdirectory of the webserver Document Root. In that case the webserver Document Root and the CMS Root Folder are not the same, hence the special name.

The program directory contains the program files and directories. The manual and optional language packs were uncompressed there.

Create the CMS Data Folder. This is a directory that holds uploaded files like images, documents, etcetera. It is very important that this directory is located outside the Document Root Folder, i.e. is not directly accessible with a browser. Note that the webserver must have sufficient permissions to read, create and write files in the CMS Data Folder.
Examples of CMS Data Folders are: /home/httpd/wasdata or C:\Program Files\Apache Group\Apache\wasdata. The name wasdata is an example. You can use any name. Here is an example of minimal permissions and ownership on the CMS Data Folder:
drwx------ 2 www www 48 Feb 2 10:49 wasdata

Create a database. The installation program is not designed to create databases (for security reasons). Use a program like phpMyAdmin, see http://www.phpmyadmin.net, or the command line.

When you are familiar with the Linux command line, you know how to create a database. If not, try this example which we adapted from the ServerAtSchool documentation at http://http://serveratschool.net/doc/install/configuring.html#h7.

Below the login procedure is shown:

[root@exemplum root]#mysql -h localhost -u root -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 121 to server version: 4.0.23a Type 'help;' or '\h' for help. Type '\c' to clear the buffer. mysql>

You are logged in now and ready to create a new database, with appropriate permissions and a new user, especially for the website database that will be accessed via the Webite@School content management system (CMS). Again, the commands to type are shown emphasised in the illustration below. The password 'ohF9quei' is used as an example. You should use a password of your own choice.

mysql> create database www; Query OK, 1 row affected (0.00 sec) mysql> grant all on www.* to wasuser@localhost identified by 'ohF9quei'; Query OK, 0 rows affected (0.02 sec) myssql> _

At this point you have created a new database named www and a user named wasuser who has been given full access to this database (but only from the host 'localhost'), provided the user produces the correct password, 'ohF9quei'.

The MySQL database is now ready for use. You can close the connection to the database and end the mysql program:

mysql> exit Bye [root@exemplum root]# _

Examples of database names: www or example_www.

At this point no config.php file exists. It is created during the installation.
NOTICE:
After finishing the installation and uploading the config.php file, change its permissions to read for owner and group. Do not forget this! Paragraph 3. Tips for a secure installation discusses this important subject.

You are now almost ready to install Website@School. Please first read paragraph 1.4 On secure passwords, before proceeding to 2. The installation.

1.3.3 Installing on a server without root access

When your server is, for example, located at an ISP (Internet Service Provider) and you have no root access to the server, you have to upload the files and directories to the server from your computer.

We assume you have downloaded the files in the downloads directory as described in paragraph 1.3.1 Downloads, i.e. the downloads directory is in the users home directory.

Navigate to your home directory.
Create a directory, for example was, in which you will unpack the downloaded files.
Navigate to the was directory.
Use your favorite tool to unpack the program. Assuming you have the downloads in the downloads directory use your favorite tool or the command line to unzip:
[dirk@freinet was]$ unzip ../downloads/websiteatschool-0.90.0.zip
[dirk@freinet was]$ tar xvzf ../downloads/websiteatschool-0.90.0.tar.gz
NOTICE:
The file is unpacked in the current directory.
Do the same with the manual and the (optional) language file(s).

After this operation the following files and directory are created in the currrent directory:

[dirk@freinet was]$ ls -l total 25 -rw-r--r-- 1 dirk dirk 2204 Feb 3 15:04 admin.php -rw-r--r-- 1 dirk dirk 7821 Feb 3 15:04 config-example.php -rw-r--r-- 1 dirk dirk 2198 Feb 3 15:04 cron.php -rw-r--r-- 1 dirk dirk 2647 Feb 3 15:04 file.php -rw-r--r-- 1 dirk dirk 2669 Feb 3 15:04 index.php drwxr-xr-x 11 dirk dirk 824 Feb 9 01:46 program [dirk@freinet was]$

The program directory contains the program files and directories. The manual and optional language packs were unpacked there.

Login to the server with an an FTP (File Transfer Protocol) program like Filezilla http://filezilla-project.org/.
NOTICE:
Depending on the ISP the name of the Document Root, i.e. the directory to put the Website@School program files and directory in, differs from ISP to ISP.
With the FTP program, navigate to the Document Root directory that will become the CMS Root Folder. In this case, the Document Root is the same as the CMS Root Folder.
Upload all files and the directory from was to the CMS Root Folder on the server. Do not forget underlaying subdirectories in program
Create the Data Directory. This is the directory where the CMS Data Folder will be created by the Install Wizard. The CMS Data Folder will hold images, documents, etcetera. Read the notices!
NOTICE 1:
Create the Data Directory, if possible, outside the Document Root and outside the CMS Root Folder.
NOTICE 2:
If it is not possible to follow the NOTICE 1 above, the Data Directory must be created in the Document Root.
Give this Data Directory a difficult to guess name,'for example b27b7d81c9ea26q4885734564qda2e12. Do not use this example, but create a difficult to guess directory name.
In the CMS Root Folder, give all files, also those in the program directory and the directories under it, read permissions for owner, group and world.
Also in the CMS Root Folder, give all directories read and execute permissions for owner, group and world.
Give the Data Directory enough permissions (if only temporarily) to allow the Install Wizard to create the CMS Data Root.
NOTICE
Necessary permissions are: read, write and execute for owner, group and perhaps world, too. Once installation is complete, all write permissions of the Data Directory can be revoked again.
At this point no config.php file exists. It is created during the installation.
NOTICE:
After finishing the installation and uploading the config.php file, change its permissions to read for owner and group. Do not forget this! Paragrapfh 3. Tips for a secure installation discusses this important subject.
Create a database, or ask your ISP to provide you with one. The installation program is not designed to create databases (for security reasons).
Examples of database names: www or example_www.
To create a database, you can use a program like phpMyAdmin. phpMyAdmin is a free software tool written in PHP intended to handle the administration of MySQL over the World Wide Web. It can be downloaded at http://www.phpmyadmin.net.
NOTICE:
Using a web based program like phpMyAdmin is a security risk. Do not forget to (re)move phpMyAdmin to a place where the webserver has no accces to.

You are now almost ready to install Website@School. Please first read the next paragraph 1.4 On secure passwords, before proceeding to 2. The installation.

1.3.4 Installing on an XS4ALL server

XS4ALL is a Dutch ISP that offers all Dutch schools very low priced Internett access, server space and a database. Their installation procedure has, like other ISP's, its own anomalies. This type of installation is discussed in Appendix A: XS4ALL installation.

1.4 On secure passwords

Website@School does not accept simple passwords like helen or maria2. These simple passwords are easy to guess and using them endangers your complete system and the data. Passwords must have certain properties to make them difficult to guess. A Website@School password must:

have at least a minimum length of 8 (eight) characters,
have at least 1 (one) uppercase character (A-Z),
have at least 1 (one) lowercase character (a-z),
have at least 1 (one) digit (0-9),
preferably have special character like: at-sign '@', hash '#', dollar '$', percentage sign '%', caret '^', ampersand '&', asterisk '*', left parenthesis '(', right parenthesis ')', dash '-', underscore '_', plus '+', equals '=', left curly brace '{', right curly brace '}', opening bracket '[', closing bracket ']', semicolon ';', slash '/', dot '.' and question mark '?'.

Please bear this in mind when entering passwords during the installation. Nuff said, time to start!

(top)

2. The installation

Open your browser and start the Install Wizard by surfing to /program/install.php on your school website. That is, if your school website is at www.exemplum.eu, you should go to http://www.exemplum.eu/program/install.php. (Replace www.exemplum.eu with the name of your site).

2.1 Language

[ Language, drop down menu: list of languages expanded ]

install_language.png

The installation starts with the selection of the language in the dropdown menu. Please select a language and click [Next] to continue or [Cancel] to abort the installation.

2.2 Installation type

[ Installation type, dropdown menu: types, checkbox: high visibility ]

install_installation_type.png

Installation scenario
- Standard: A standard installation will be the right choice for most schools. The installer will take care of finding the right values. But, take care, and check what the installer presents in the 'Confirmation' dialogue. If necessary, you can use the [Previous] button to correct errors.
- Custom: A custom installation is necessary when you want multiple installations of Website@School in the same database. In the database dialogue 2.5 Database an extra field is added where a prefix for each installation can be added.
High visibility [ ]: Check the box to use a text-only user interface during installation.
This is a feature for visually impaired or blind persons. The installation can be performed with a braille terminal. High visibility is also availabe in Website@School management.

Click [Next] to continue, [Previous] to return to the previous dialogue or [Cancel] to abort the installation.

2.3 License

install_license_top.png

For the purpose of this manual, many text lines in the license are skipped in the pictures above and below. Please read the license agreement carefully before signing the agreement.

install_license_bottom.png

To be able to install the progrma, you have to accept the license agreement by typing 'I agree' (without quotes) in the box.

Click [Next] to continue, [Previous] to return to the previous dialogue or [Cancel] to abort the installation.

2.4 Database

[ Database, drop down menu: type, entry fields ]

install_database.png

Type: Select one of the available database types. At this moment the database used is MySQL. A future version may support PostgreSQL too.
Server: This is the database server address, usually localhost. Other examples: mysql.exemplum.eu or example.dbserver.provider.net:3306.
Username: A valid username/password-combination is required to connect to the database server. Please do not use the root account of the database server but a less privileged one, e.g. wasuser or example_wwwa.
Password: A valid username/password-combination is required to connect to the database server.
Database name: This is the name of the database to use. Note that this database should already exist; this installation program is not designed to create databases (for security reasons). Examples: www or example_www.
Prefix:
NOTICE:
This option is not available in the Standard installation, but only applies to the Custom installation.
All table names in the database start with this prefix. This allows for multiple installations in the same database. Note that the prefix must begin with a letter. Examples: was_ or cms2_.

Click [Next] to continue, [Previous] to return to the previous dialogue or [Cancel] to abort the installation.

2.5 Website

install_website_top.png
install_website_bottom.png

Website title: The name of your website. The name can be changed later on.
From: address: This e-mail address is used for outgoing mail, e.g. alerts and password reminders. If an email address is visible, it is taken from the Apache webserver. The address can be changed now or later.
Reply-To: address::
NOTICE:
This option is not available in the Standard installation, but only applies to the Custom installation.
This e-mail address is added to outgoing mail and can be used to specify a mailbox where replies are actually read (by you) and not discarded (by the webserver software).
Website Directory: This is the path to the CMS Root Folder, i.e the directory that holds index.php, config.php, etcetera, e.g. /home/httpd/htdocs or C:\Program Files\Apache Group\Apache\htdocs.
Website URL: This is the main URL that leads to the schools website i.e. the place where index.php can be visited. Examples are: http://www.exemplum.eu or https://exemplum.eu:443/schoolsite.
Program directory:
NOTICE:
This option is not available in the Standard installation, but only applies to the Custom installation.
The path to the CMS Program Folder. As default setting the path is not the same as the CMS Root Folder (usually the CMS Root Folder followed by /program). Examples /home/httpd/htodcs/program or C:\Program Files\Apache Group\Apache\htdocs\program
NOTICE:
Do not change this path, unless you know exactly what you are doing!
NOTICE:
The folder name program should not be changed.
Program URL:
NOTICE:
This option is not available in the Standard installation, but only applies to the Custom installation.
This is the URL that leads to the program directory (usually the website URL followed by /program). Examples are: http://www.exemplum.eu/program or https://exemplum.eu:443/schoolsite/program.
Data directory: The Data Directory is the place where the Install Wizard will create the CMS Data Folder. The CMS Data Folder will hold uploaded images, documents, et cetera. See also 1.3.2 Installing on a server with root acces and 1.3.3 Installing on a server without root access.
It is very important that this directory is located outside the webservers Document Root [1], i.e. is not directly accessible with a browser. Note that the webserver must have sufficient permissions to read, create and write files here. Examples the the CMS Data Folder are: /home/httpd/wasdata or C:\Program Files\Apache Group\Apache\wasdata.
[1] With many ISPs (Internet Service Providers) you have no access outside the Document Root.
Populate database [ ]: Check this box if you want to start with your new website using demonstration data. It's a good idea to check this option. The demo data are excellent for trying the numerous administrative possibilities of Website@School. The demo data can be erased later on if necessary.
Demonstration password: The same demonstration password will be assigned to all demonstration user accounts. Please choose a good password as described in paragraph 1.4 On secure passwords. You can leave this field blank if you did not check the Populate database box above.

Click [Next] to continue, [Previous] to return to the previous dialogue or [Cancel] to abort the installation.

2.6 User account

install_user_account.png

Full name: Please enter your own name or, if you prefer, another (functional) name, e.g. Wilhelmina Bladergroen or Master Web.
User name: Please enter the login name you want to use for this account. You need to type this name every time you want to login. Examples: wblade or webmaster.
NOTICE: A user name consists of maximum 16 characters: lowercase (a-z), digits (0-9), underscore (_)and starts with a letter.
Password: Please choose a good password as described in paragraph 1.4 On secure passwords. Do not share your password with others, but create additional accounts for your colleagues instead.
E-mail address: Please enter you e-mail address here. You need this address whenever you need to request a new password. Make sure that only you have access to this mailbox (do not use a shared mailbox). Examples: w.bladergroen@exemplum.eu or webmaster@exemplum.eu.

Click [Next] to continue, [Previous] to return to the previous dialogue or [Cancel] to abort the installation.

2.7 Compatibility

install_compatibility.png

Below is an overview of required and desired settings. You need to make sure that the requirements are satisfied before you continue.

NOTICE:
Required items have an '*' asterisk.

Website@School: Please check if you have the latest version. It could be necessary to upgrade after an installation.
Webserver: * You neead Apache version 2.0.53 or hihger.
Database server: * You need MySQL version 4.0.23a or higher.
PHP version: * You need PHP version 4.3.10 or higher.
Automatic session start: * The right value is 'NO'. If a wrong value is shown, you should edit the php.ini file.
PHP Safe Mode: The PHP safe mode is an attempt to solve the shared-server security problem. It is architecturally incorrect to try to solve this problem at the PHP level, but since the alternatives at the web server and OS levels aren't very realistic, many people, especially ISP's, use safe mode for now. This feature has been DEPRECATED as of PHP 5.3.0. Relying on this feature is highly discouraged. Source: http://php.net/manual/en/features.safe-mode.php.
NOTICE:
Not required but strongly advised. In php.ini set safe_mode = Off.
File uploads: It must be possible to upload files to the CMS Data Folder. If not correct, the CMS Data Folder may have wrong ownerschip and/or permissions.
NOTICE:
Take care! Do not set this folder world readable!
GD Support: GD is an open source program for the dynamic creation of thumbnails. GD creates PNG, JPEG and GIF images, among other formats. The thumbnails are used in the FCK editor.
Clamscan anti-virus: Clamscan is used to scan uploaded files for viruses. It is highly recommended to scan all uploaded materials from those home or school computers, used by everyone, for viruses.

Click [Next] to continue, [Previous] to return to the previous dialogue or [Cancel] to abort the installation.

2.8 Confirmation

install_confirmation_top.png
install_confirmation_bottom.png

You are about to install your new website. Carefully check the configuration settings. Please do as suggested and print this page for future reference.
Thereafter you can press [Next] to start the actual installation process or press [Previous] to correct errors, or [Cancel] to abort the installation.

The installation process may take a while.

2.8.1 Crossroads

When the installation process is finished, two possibilities exist

The configuration file config.php was automatically written to the CMS Root Folder. You see a picture as in 2.9 Finish. Proceed from there.
The configuration file config.php was not automatically written to the CMS Root Folder and it must be put there by hand. Please proceed with paragraph 2.10 Download configuration file.

2.9 Finish

install_finish.png

The installation is finished.
It's not a bad idea to check for updates or bug fixes. We assume your version is up to date. Proceed by selecting an item from the dropdown menu:

Jump to:

admin.php: The default option to login.
index.php: The location of the school website.
manual.php: The location of the manual.
http://websiteatschool.eu: Our location where you can find more about Website@School.

Or click [OK] to go to the default destination: the admin.php login dialogue.

[ Exemplum Primary School, login page. username 'name', password ******** ]

install_login.png

You can now continue reading the manual with the Logging in and out chapter. Or select one of the other options and click [OK] to go there.

2.10 Download configuration file

The installer may be unable to write the configuration file config.php in the CMS Root Folder because the directory is write protected. In that case, you have the option to download config.php. You can save it in the was directory on your computer and copy (upload) it with FTP to the CMS Root Folder. This feature is a security measure.

[ Finish, download configuration file, drop down menu: choises ]

install_finish_download.png

To download the file config.php, proceed as follows:

Click the Download config.php link.
A download window opens on your computer:

install_finish_download_save.png
Select the was directory on your computer (see also 1.3.3 Installing on a server without root access) to save the config.php file.
With an FTP program, upload the file to the CMS Root Folder.
Check the file permissions and ownership. Permissions 0400 and user wwww and group root are safe. For further details on the security of this important file that contains your database password, see 3. Tips for a secure installation

The installation is finished.
It's not a bad idea to check for updates or bug fixes. We assume your version is up to date. Proceed by selecting an item from the dropdown menu:

Jump to:

admin.php: The default option to login.
index.php: The location of the schools website.
manual.php: The location of the manual.
http://websiteatschool.eu: Our location where you can find more about Website@SChool.

Or click [OK] to go to the default destination: the admin.php login dialogue:

install_login.png

You can now continue reading the manual with the Logging in and out chapter. Or select one of the other options and click [OK] to go there.

(top)

3. Tips for a secure installation

NOTICE:
Securing an installation, thus protecting the schools website, the (sometimes) confidential data and the server itself can be complicated to perform. Mistakes are easily made. If you are unfamiliar with the intricacies in this paragraph, please ask help from a local Linux group. The operations should not be performed by someone who hasn't done it before.

This paragraph discusses the points to check for a secure installaton. However, it is impossible to describe all possibilities and their exceptions. Do not hesitate to ask help from a local Linux group or ask for support.

All program files of Website@School are installed in the so called CMS Root Folder. The CMS Root Folder is often the same as the webserver Document Root. However, it is also possible to use a subdirectory of the webserver Document Root instead.

Furthermore, for a good installation a separate Data Directory is necessary. After installation is complete, this Data Directory will contain the CMS Data Folder.

3.1 Program files and configuration file

After a successful installation, the CMS Root Folder, i.e. the webserver Document Root, or the self chosen subdirectory, should contain the following files and directory. Observe permissions and ownership:

-rw-r--r-- 1 root root 2210 Feb 1 14:00 admin.php -rw-r--r-- 1 root root 7827 Feb 1 14:00 config-example.php -r-------- 1 www root 754 Feb 1 11:10 config.php -rw-r--r-- 1 root root 2204 Feb 1 14:00 cron.php -rw-r--r-- 1 root root 2653 Feb 1 14:00 file.php -rw-r--r-- 1 root root 2675 Feb 1 14:00 index.php drwxr-xr-x 1 root root 824 Feb 2 10:11 program

The CMS Program Folder program/ contains dozens of files and subdirectories. Together these form the Website@School program.

Finally, there is the configuration file config.php. This file (which is created by the Install Wizard) must be placed in the same directory as the other files, i.e. in the CMS Root Folder.

It is sufficient for the webserver (Apache) to only have read permissions on all these program files and subdirectories. This also applies to the configuration file config.php.

Security wise it is best to make sure that the webserver (Apache) has no write permissions on these program files and (sub) directories. This also applies tot the configuration file config.php.

For additional security and protection of the data in config.php it makes sense to limit the permissions on that file even further.

On a Linux server it speaks for itself to set these read- and write permissions as follows:

- All files, with the exception of config.php, get permissions 0644 and are owned by user root and group root.
- Al directories get permissions 0755 and are owned by user root and group root.
- The file config.php gets permissions 0400 and becomes owned by user www and group root.

NOTICE 1:
It is also possible to give the files (except config.php) permissions 0444 and the directories permissions 0555, but this adds factually little when the files are owned by user root, because anyhow user root has all permissions, also write permissions, on any file.

NOTICE 2:
In this example user www is used as the account under which the webserver (Apache) is running. Depending on the specific system, this can also be the user apache or nobody. Please consult the documentation and/or configuration of the webserver.

NOTICE 3:
The file config.php is a case on its own. This file contains the database password. For that reason it is good to only and exclusively give the webserver (Apache) read permissions on this file and no other user or group.

NOTICE 4:
If it is not possible to make the files (except config.php) and directories owned by user root and group root, then it is also possible to choose another user and group, as long as it is not the webserver user and group for that purpose. Permissions 0644 or 0755 are usable.

3.2 Data files

For a fully functional Website@School, also storage space is needed, preferably outside the websrervers Document Root.
During the installation in step 2.5 Website you have entered a path, for example /home/httpd/wasdata.

For security reasons the installer creates a subdirectory inside this directory: This we call the CMS Data Folder. The full path of the CMS Data Folder is the Data Directory path followed by a difficult to guess directory name of 32 letters and digits, for example: /home/httpd/wasdata/b27b7d81c0ea26c4885784564bda2e11.

It is necessary that, during the installation, the webserver (Apache) has read-, write- and execute permissions in the Data Directory (for example wasdata), in order to create the CMS Data Root.
After finishing the installation the write permissions can be minimised, as long the read and search permissions for the webserver remain.

3.2.1 Outside the document root

Concerning security it is strongly advised that the CMS Data Folder is located outside the webserver Document Root.

Example 1:
On the Linux server /home/httpd/htdocs is the webserver Document Root. In that case a secure choice for the Data Directory is /home/httpd/wasdata. This results in:
- Data Directory: /home/httpd/wasdata
- CMS Data Folder: /home/httpd/wasdata/fa0aff7743cd61f2afb473ca528fd431

During the installation, the Data Directory must have permissions 0700 with user www and group root. After finishing the installation, it is sufficient to set the permissions of this directory to 0500 with user www and group root.

Example 2:
On a Linux server /var/www is the webserver Document Root. The Data Directory could be located in /var/wasdata. This results in:
- Data Directory: /var/wasdata
- CMS Data Folder: /var/wasdata/fa0aff7743cd61f2afb473ca528fd431

During the installation, this Data Directory should have sufficient file access permissions, e.g. by -- temporarily -- elevating permissionss to 0777, with user wblade and group users. After finishing the installation, it is sufficient to set the permissions of this directory to 0555 with user wblade and group users.

User wblade is Wilhelmina Bladergroen, the systems administrator of the Exemplum Primary School. For explanation on this user and the school see the ServerAtSchool documentation at http://serveratschool.net/doc/manual/overview.html#h2

NOTICE:
The permissions and ownership of the underlying directories created by the Installation Wizard, must remain as they are. Here is an example:

drwx------ 3 www www 240 Feb 6 13:53 fa0aff7743cd61f2afb473ca528fd431

3.2.2 Inside the document root

Concerning security it is strongly advised to have the CMS Data Folder located outside the Document Root. If, for some reason or another, this is not possible, then choose a difficult and long directory name to make it difficult for a third party to find this directory by 'guessing'. After all, all documents are in pinciple direcly accessible, provided the name of the document is known.

Example 1:
On a Linux server /home/httpd/htdocs is the webservers Document Root. If the Data Directory and hence the CMS Data Folder is to stay in there, then b27b7d81c9ea26q4885734564qda2e12 looks like a good, difficult to guess subdirectory name. This results in:
- Data Directory/home/httpd/htdocs/b27b7d81c9ea26q4885734564qda2e12
- CMS Data Folder: /home/httpd/htdocs/b27b7d81c9ea26q4885734564qda2e12/fa0aff7743cd61f2afb473ca528fd431

The permissions of the Data Directory during the installation are 0700 with user www and group root. After the installation permissions 0500 with user www and group root are enough.

Example 2:
On a Linux server /var/www is the webservers Document Root. If the Data Directory and hence the CMS Data Folder is to stay in there, then b27b7d81c9ea26q4885734564qda2e12 looks like a good, difficult to guess directory name. This results in:
- Data Directory: /var/www/b27b7d81c9ea26q4885734564qda2e12
- CMS Data Folder: /var/www/b27b7d81c9ea26q4885734564qda2e12/fa0aff7743cd61f2afb473ca528fd431

During the installation, the Data Directory has --temporarily-- permissions 0777 with user wblade and group users. After the installation it is sufficient to set back the permissions of this directory to 0555 with user wblade and group users.

User wblade is Wilhelmina Bladergroen, the systems administrator on the Exemplum Primary School. For explanation on this user and the school see the ServerAtSchool Documentation at http://serveratschool.net/doc/manual/overview.html#h2

NOTICE:
The permissions and ownership of the underlying directories created by the installation wizard, must remain as they are.

3.3 Further information

This manual is not a study book on server security. For safety contact your systems administrator or ISP (Internet Service Provider) for a possibly even tighter installation or contact the Website@School support at support@websiteatschool.eu.

NOTICE:
Before making use of your installation, please also read the next section to check some of the configuration items that affect security.

(top)

4. After the installation

When you have successfully completed the previous section, please also check the following items that either affect the security of your installation or prevent problems. All items are described in the Configuration Manager, paragraph 5. Site.

4.1 Virus scanning

On a school server with so many users able to upload files from anywhere, scanning for viruses is a must. In the procedure below we describe how to check if virus scanning is indeed functioning.

First check at [ ] Scan files for viruses on upload, the box is checked. Then perform the following test to verify the correct operation of the virus scanner by creating a special 'test virus'. There is a standard test, developed explicitly for testing antivirus programs. It was developed by the European Institute for Computer Anti-Virus Research (EICAR). You can easily create this test using any text editor. The test file consists of 68 plain ASCII characters as shown below. Note that the 3rd character is a capital 'O' and not the digit '0'.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Now store these 68 characters in a file. Do not name it EICAR.COM, as suggested by the Institute, because by default the file extension .com is a not allowed extension in Website@School. Maliciously we rename it to image.png, so it will be accepted and uploaded to your My Files location.
The virus should be detected and an error message must be generated like:

install_after_install_virus.png

If the virusscanner is properly installed and found during installation, but it is for some reason not working during the upload, a message like the following is displayed. Notice 'Error 2'.

Filename(1): Error 2 while scanning for viruses, file 'other_image.bmp'
Files added: 0, files ignored: 1 .

NOTICE:
Do not forget to keep the virusscanner on the server up to date!

More information on EICAR.COM can be found on the EICAR web site at http://www.eicar.org/anti_virus_test_file.htm.

Note that this EICAR.COM file in itself is a valid but harmless DOS program. When executed (in a DOS box), it simply displays the text 'EICAR-STANDARD-ANTIVIRUS-TEST-FILE!', nothing more.

This sub paragraph on testing with a virus is gracefully copied and slightly adapted from http://serveratschool.net/doc/, the ServerAtSchool Documentation, where the installation of a secure school server is discussed.

4.2 Session name

In every installation of Website@School the session name is the same. A bit of extra security can be added by changing the session name WASSESSION to something else. After changing, log out and in again.

4.3 Proxy friendly URLs

Easy to change after the installation, however when this change is done some time in the future, it might give you a lot of work. Please read about this item in the Configuration Manager, paragraph 3. Site

(top)

5. Errors

Below the most common errors during the installation procedure are discussed.

5.1 Cancelled installation

When the installation is cancelled, it is because the Website@School installer found an already existing config.php configuration file. This is a security feature that prevents overwriting an existing configuration file. Check if the file exists. If this is the case, either delete or rename it. You cannot accidently overwrite an existing config.php file while doing a new installation of Website@School, even when the file permissions would allow it.

Click [OK] to return to the language selection. It is possible to download the config.php file. See paragraph 2.10 Download configuratoin file.

5.2 Unable to write in Data Directory

When you have created the data directory with the wrong ownership (for example root.root), you can get an error message like:

Error: Data directory: directory can not be created: /home/httpd/htdocs/wasdata/6a69137e2689c8f91873e0634ca46bda.

You get the same type of errors when the file permissions are too low (for example 000 or 600). Here is an example of minimal permissions and ownership:

drwx------ 2 www www 48 Feb 3 16:49 wasdata

5.3 Config.php write problems

The installer can be unable to write [1] the configuration file config.php because the directory is write protected. In that case, you have the possibility to download config.php and save it on your computer. Then copy it to the location you choose to put the program in. This feature could be seen as a security measure.

[1] For example when Website@Schools CMS Root Folder has permissions like:

dr-x------ 3 www www 240 Oct 21 13:53 htdocs

It is impossible to write in the directory.

(top)

6. Concluding remarks

Your Website@School is ready for use. Please take the Guided Tour to have a quick introduction to some (but not all) features of Webiste@School.

(top)

Prev	Home	Next
Introduction		Logging in and out

Author: Dirk Schouten <schoutdi (at) knoware (dot)

Last updated: 2012-02-29

Contents

XAMPP