ICT:Wiki - Account protection - Revision history

Mngr: Mngr moved page ICT:Account protection to ICT:Wiki - Account protection without leaving a redirect

2026-05-14T14:38:32Z

Mngr moved page ICT:Account protection to ICT:Wiki - Account protection without leaving a redirect

← Older revision	Revision as of 14:38, 14 May 2026
(No difference)

Mngr at 18:40, 9 February 2026

2026-02-09T18:40:05Z

@@ Line 49: / Line 49: @@
 * '''Adding Entities:''' When creating a new Research Entity, ensure the associated Template and Form are placed in the permitted namespaces.
 * '''Testing Access:''' Always test new Dashboard sections with a non-admin "Fellow" account to ensure no "Permission Denied" errors occur during template transclusion.
 [[Category:ICT Documentation]]
 [[Category:Security Operations]]

Mngr at 18:33, 9 February 2026

2026-02-09T18:33:34Z

← Older revision		Revision as of 18:33, 9 February 2026
Line 35:		Line 35:
	$wgNamespacePermissionLockdown[NS_TEMPLATE]['read'] = ['user', 'sysop'];		$wgNamespacePermissionLockdown[NS_TEMPLATE]['read'] = ['user', 'sysop'];
	$wgNamespacePermissionLockdown[NS_FORM]['read'] = ['user', 'sysop'];		$wgNamespacePermissionLockdown[NS_FORM]['read'] = ['user', 'sysop'];
	$syntaxhighlight>		</syntaxhighlight>

	== 3. Page Forms & Cargo Interaction ==		== 3. Page Forms & Cargo Interaction ==

Mngr at 18:30, 9 February 2026

2026-02-09T18:30:50Z

← Older revision		Revision as of 18:30, 9 February 2026
Line 2:		Line 2:
	__TOC__		__TOC__
	== Philosophy ==		== Philosophy ==
	This wiki ~~operates on~~ a '''~~Whitelist-only~~''' ~~visibility model~~. By default~~, all~~ namespaces ~~(including Main~~, ~~Category~~, and ~~Help) are hidden from research fellows. Access~~ is granted ~~explicitly~~ to specific ~~project namespaces~~.		This wiki is a '''Private Research Platform'''. To simplify management, we avoid "blacklisting" individual default namespaces. Instead, we use a "White-room" approach: everything is forbidden by default, and access is granted only to the specific functional layers required for research.

	== 1. Global ~~Lockdown (LocalSettings.php)~~ ==		== 1. Global Restrictions ==
	~~To prevent researchers from browsing default namespaces (Main, User, etc~~.~~), we first revoke read access from~~ the standard ~~'user' group~~.		Applied in `LocalSettings.php` to ensure the wiki is invisible to the public and restricted for standard users.

	<syntaxhighlight lang="php">		<syntaxhighlight lang="php">
	# ~~1. Block everyone (including logged-in fellows)~~ from ~~reading~~ by default		# Full Privacy: Revoke read from all by default
	$wgGroupPermissions['*']['read'] = false;		$wgGroupPermissions['*']['read'] = false;
	$wgGroupPermissions['user']['read'] = false;		$wgGroupPermissions['user']['read'] = false;

	# ~~2. Grant Sysops total access to override the block~~		# Sysop Override: Ensure admins maintain full visibility
	$wgGroupPermissions['sysop']['read'] = true;		$wgGroupPermissions['sysop']['read'] = true;

			# Essential Whitelist: Required for login and site rendering
			$wgWhitelistRead = [
			"Special:UserLogin",
			"MediaWiki:Common.css",
			"MediaWiki:Common.js"
			];
	</syntaxhighlight>		</syntaxhighlight>

	== 2. ~~Defining the "~~Exceptions" ==		== 2. Research Environment Exceptions ==
	~~We use~~ [[Extension:Lockdown]] to ~~open~~ specific ~~"windows"~~ for the ~~research fellows. This is much cleaner than manually locking every default namespace~~.		Using [[Extension:Lockdown]], we grant the `user` group access to the specific namespaces required for the Dashboard, Cargo queries, and Page Forms.

	<syntaxhighlight lang="php">		<syntaxhighlight lang="php">
	# ~~Grant 'user' group access ONLY to these specific namespaces~~		# Research Namespaces
	$wgNamespacePermissionLockdown[NS_RESEARCH]['read'] = ['user', 'sysop'];		$wgNamespacePermissionLockdown[NS_RESEARCH]['read'] = ['user', 'sysop'];
	$wgNamespacePermissionLockdown[NS_DASHBOARD]['read'] = ['user', 'sysop'];		$wgNamespacePermissionLockdown[NS_DASHBOARD]['read'] = ['user', 'sysop'];

	# ~~Ensure Cargo~~ and ~~Page Forms namespaces are accessible if needed for queries~~		# Supporting Infrastructure (Required for Dashboard rendering)
	$wgNamespacePermissionLockdown[~~NS_CARGO_SPECIAL~~]['read'] = ['user', 'sysop'];		# Researchers need 'read' access to these so templates and forms function.
	</syntaxhighlight>		$wgNamespacePermissionLockdown[NS_TEMPLATE]['read'] = ['user', 'sysop'];
			$wgNamespacePermissionLockdown[NS_FORM]['read'] = ['user', 'sysop'];
			$syntaxhighlight>

	== 3. ~~Handling the Whitelist~~ ==		== 3. Page Forms & Cargo Interaction ==
	~~Because the wiki is private, certain technical pages must be "Whitelisted" so the browser can render~~ the ~~login screen and basic styles~~.		The Dashboard utilizes `Template:EntityRow` for layout and queries the Cargo database.
			* '''Note:''' If researchers can see the Dashboard but not the data results, ensure the Cargo-specific namespaces are also allowed.
	~~<syntaxhighlight lang="php">~~		* '''Editing:''' The `edit` permission is granted globally to the `user` group, but restricted by namespace via Lockdown.
	~~$wgWhitelistRead = [~~
	~~"Special~~:~~UserLogin"~~,
	~~"MediaWiki:Common~~.~~css",~~
	~~"MediaWiki~~:~~Common.js",~~
	~~"Main_Page" // Optional: if you want them~~ to ~~see~~ the ~~landing page before login~~
	];
	~~</syntaxhighlight>~~

	== 4. System ~~Account Security Reference~~ ==		== 4. Default System Accounts ==
	* '''MediaWiki default:''' Internal system ~~identity~~. No password, no login ~~capability~~. Safe.		* '''MediaWiki default:''' Internal system user. No password; no login allowed. Safe.
	* '''~~Project~~ Sysop:''' Full ~~authority. Bypasses namespace restrictions to manage the ICT infrastructure~~.		* '''Admin/Sysop:''' Full credentials required.

	== Successor Notes ==		== Successor Notes ==
	* '''~~The "Everything is Hidden" Trap~~:''' ~~If a researcher cannot see a Cargo map or~~ a ~~Page Form~~, ~~check if~~ the ~~namespace for that specific template or data table is included~~ in the ~~Lockdown exceptions~~.		* '''Adding Entities:''' When creating a new Research Entity, ensure the associated Template and Form are placed in the permitted namespaces.
	* '''Testing:''' ~~Use~~ a "Fellow" ~~test~~ account to ~~verify that namespaces like `Category:` or `File:` remain invisible~~.		* '''Testing Access:''' Always test new Dashboard sections with a non-admin "Fellow" account to ensure no "Permission Denied" errors occur during template transclusion.

	[[Category:ICT Documentation]]		[[Category:ICT Documentation]]
	[[Category:Security Operations]]		[[Category:Security Operations]]

Mngr at 18:26, 9 February 2026

2026-02-09T18:26:42Z

← Older revision		Revision as of 18:26, 9 February 2026
Line 1:		Line 1:
	{{DISPLAYTITLE:Access Control ~~& Account Security~~}}		{{DISPLAYTITLE:Access Control: The "Lockdown" Model}}
	__TOC__		__TOC__
	== ~~Infrastructure Overview~~ ==		== Philosophy ==
	This wiki ~~is configured as~~ a '''~~Private Research Platform~~'''. Access is ~~managed via a "Deny-by-Default" policy, using MediaWiki core permissions for global locks and the [[Extension:Lockdown]] for granular namespace security~~.		This wiki operates on a '''Whitelist-only''' visibility model. By default, all namespaces (including Main, Category, and Help) are hidden from research fellows. Access is granted explicitly to specific project namespaces.

	== 1. ~~System Account Security~~ ==		== 1. Global Lockdown (LocalSettings.php) ==
	* '''MediaWiki default~~:'''~~		To prevent researchers from browsing default namespaces (Main, User, etc.), we first revoke read access from the standard 'user' group.
	** Status: Internal System User.
	** Security: No password exists; interactive login is impossible.
	** Role: Attributes automated software edits.
	* '''Sysop Accounts:'''
	** Status: Human Administrators.
	** Security: Password protected. Managed via [[Special:ListUsers/sysop]].

	=~~= 2~~. ~~Global Hardening~~ (~~LocalSettings.php~~) ==		<syntaxhighlight lang="php">
	~~The following core settings enforce~~ the ~~private nature of~~ the ~~wiki~~:		# 1. Block everyone (including logged-in fellows) from reading by default
			$wgGroupPermissions['*']['read'] = false;
			$wgGroupPermissions['user']['read'] = false;

			# 2. Grant Sysops total access to override the block
			$wgGroupPermissions['sysop']['read'] = true;
			</syntaxhighlight>

			== 2. Defining the "Exceptions" ==
			We use [[Extension:Lockdown]] to open specific "windows" for the research fellows. This is much cleaner than manually locking every default namespace.

	<syntaxhighlight lang="php">		<syntaxhighlight lang="php">
	# ~~Disable public~~ access ~~and registration~~		# Grant 'user' group access ONLY to these specific namespaces
	$~~wgGroupPermissions~~['*']['~~read~~'] ~~= false~~;		$wgNamespacePermissionLockdown[NS_RESEARCH]['read'] = ['user', 'sysop'];
	$~~wgGroupPermissions~~['*']['~~edit~~'] ~~= false~~;		$wgNamespacePermissionLockdown[NS_DASHBOARD]['read'] = ['user', 'sysop'];
	$~~wgGroupPermissions~~['*']['~~createaccount~~'] = ~~false;~~
			# Ensure Cargo and Page Forms namespaces are accessible if needed for queries
			$wgNamespacePermissionLockdown[NS_CARGO_SPECIAL]['read'] = ['user', 'sysop'];
			</syntaxhighlight>

			== 3. Handling the Whitelist ==
			Because the wiki is private, certain technical pages must be "Whitelisted" so the browser can render the login screen and basic styles.

	~~# The Whitelist: Essential for the Login Screen~~		<syntaxhighlight lang="php">
	~~# Without these, the login page becomes inaccessible (Loop Error)~~
	$wgWhitelistRead = [		$wgWhitelistRead = [
	"Special:UserLogin",		"Special:UserLogin",
	"MediaWiki:Common.css",		"MediaWiki:Common.css",
	"MediaWiki:Common.js"		"MediaWiki:Common.js",
			"Main_Page" // Optional: if you want them to see the landing page before login
	];		];
	</syntaxhighlight>		</syntaxhighlight>

	== 3. ~~Namespace Lockdown Logic~~ ==		== 4. System Account Security Reference ==
	~~While `$wgGroupPermissions` locks the door, [[Extension:Lockdown]] manages the internal rooms.~~		* '''MediaWiki default:''' Internal system identity. No password, no login capability. Safe.
			* '''Project Sysop:''' Full authority. Bypasses namespace restrictions to manage the ICT infrastructure.
	* '''~~ICT: Namespace~~:''' ~~Restricted to the `sysop` group~~.
	* '''Research/Dashboard Namespaces:''' Access granted to `user` (fellows) and `sysop`.
	* '''Sysop ~~Rights~~:''' ~~As per [https://www~~.~~mediawiki.org Lockdown documentation], sysops retain visibility across all restricted namespaces unless explicitly revoked~~.

	== 4. Successor ~~Checklist~~ ==		== Successor Notes ==
	# '''~~Emergency Access~~:''' If ~~locked out~~, ~~set `$wgGroupPermissions['*']['read'] = true;` temporarily in LocalSettings.php.~~		* '''The "Everything is Hidden" Trap:''' If a researcher cannot see a Cargo map or a Page Form, check if the namespace for that specific template or data table is included in the Lockdown exceptions.
	~~# '''New Namespaces:''' Any new~~ namespace ~~created~~ for ~~research must be added to~~ the Lockdown ~~array to remain private~~.		* '''Testing:''' Use a "Fellow" test account to verify that namespaces like `Category:` or `File:` remain invisible.
	# '''~~Auditing~~:''' Use ~~[[Special:ListUsers]] monthly to ensure no~~ "~~shadow~~" ~~human accounts have been created~~.

	[[Category:ICT Documentation]]		[[Category:ICT Documentation]]
	[[Category:Security Operations]]		[[Category:Security Operations]]

Mngr at 18:23, 9 February 2026

2026-02-09T18:23:11Z

← Older revision		Revision as of 18:23, 9 February 2026
Line 1:		Line 1:
	{{DISPLAYTITLE:Account ~~Protections & System Users~~}}		{{DISPLAYTITLE:Access Control & Account Security}}
	__TOC__		__TOC__
	== Overview ==		== Infrastructure Overview ==
	This ~~document outlines~~ the security ~~profile of default system accounts and the hardening configurations applied to this MediaWiki instance (v1.45) to restrict access and visibility~~.		This wiki is configured as a '''Private Research Platform'''. Access is managed via a "Deny-by-Default" policy, using MediaWiki core permissions for global locks and the [[Extension:Lockdown]] for granular namespace security.

	== ~~Default~~ System ~~Accounts~~ ==		== 1. System Account Security ==
	~~Upon initialization,~~ MediaWiki ~~creates or reserves specific identities~~.		* '''MediaWiki default:'''
			** Status: Internal System User.
			** Security: No password exists; interactive login is impossible.
			** Role: Attributes automated software edits.
			* '''Sysop Accounts:'''
			** Status: Human Administrators.
			** Security: Password protected. Managed via [[Special:ListUsers/sysop]].

	==~~= MediaWiki default~~ ===		== 2. Global Hardening (LocalSettings.php) ==
	* '''Type:''' Virtual/System User.		The following core settings enforce the private nature of the wiki:
	* '''Password Protection:''' This account '''does not have a password''' and is blocked from web-based login.
	* '''Function:~~''' It acts as a placeholder for automated interface updates and system-generated edits.~~
	* '''Security Status:''' Safe; cannot be compromised via brute force.

	~~=== Initial Admin (Sysop) ===~~
	* '''Type:''' Human Administrator.
	* '''Security:''' Protected by a salted hash password.
	* '''Audit Path:''' Check rights via [[Special:UserRights]] or the [[Special:ListUsers/sysop\|Sysop List]].

	~~== Applied Hardening (LocalSettings.php) ==~~
	~~The following configurations are implemented in the server's configuration file to secure the environment.~~

	~~=== 1. Registration Lock ===~~
	~~Prevents the "Create Account" option from appearing to anonymous visitors.~~
	<syntaxhighlight lang="php">		<syntaxhighlight lang="php">
			# Disable public access and registration
			$wgGroupPermissions['*']['read'] = false;
			$wgGroupPermissions['*']['edit'] = false;
	$wgGroupPermissions['*']['createaccount'] = false;		$wgGroupPermissions['*']['createaccount'] = false;
	~~</syntaxhighlight>~~

	=~~== 2. Write Protection ===~~		# The Whitelist: Essential for the Login Screen
	~~Disables anonymous editing to ensure only identified users can modify content~~.		# Without these, the login page becomes inaccessible (Loop Error)
	~~<syntaxhighlight lang=~~"~~php~~">		$wgWhitelistRead = [
	~~$wgGroupPermissions['*'~~]~~['edit'] = false~~;		"Special:UserLogin",
			"MediaWiki:Common.css",
			"MediaWiki:Common.js"
			];
	</syntaxhighlight>		</syntaxhighlight>

	=== 3. ~~Private Wiki Configuration (Optional/Full Privacy) =~~==		== 3. Namespace Lockdown Logic ==
	~~To prevent any unauthorized viewing of~~ the ~~wiki content~~, ~~the following settings hide all pages from logged-out users, except for the login interface.~~		While `$wgGroupPermissions` locks the door, [[Extension:Lockdown]] manages the internal rooms.

	~~<syntaxhighlight lang="php">~~
	~~# Disable reading by anonymous users~~
	~~$wgGroupPermissions~~[~~'*'~~]~~['read'~~] ~~= false;~~

	~~# Whitelist essential pages~~ to ~~allow users~~ to ~~log in~~		* '''ICT: Namespace:''' Restricted to the `sysop` group.
	~~$wgWhitelistRead = array~~(		* '''Research/Dashboard Namespaces:''' Access granted to `user` (fellows) and `sysop`.
	~~"Special~~:~~UserLogin",~~		* '''Sysop Rights:''' As per [https://www.mediawiki.org Lockdown documentation], sysops retain visibility across all restricted namespaces unless explicitly revoked.
	~~"MediaWiki~~:~~Common~~.~~css"~~,
	~~"MediaWiki:Common~~.~~js"~~
	);
	~~</syntaxhighlight>~~

	== Successor ~~Maintenance Notes~~ ==		== 4. Successor Checklist ==
	# '''~~Audit~~:''' ~~Regularly verify the user list via~~ [[~~Special:ListUsers]~~].		# '''Emergency Access:''' If locked out, set `$wgGroupPermissions['*']['read'] = true;` temporarily in LocalSettings.php.
	# '''~~Updates~~:''' ~~If a~~ new ~~system user appears after an upgrade or extension install, consult~~ the ~~[https://www.mediawiki.org MediaWiki System User Manual]~~.		# '''New Namespaces:''' Any new namespace created for research must be added to the Lockdown array to remain private.
	# '''~~Configuration~~:''' ~~All changes above must be verified in an Incognito/Private browser window~~ to ensure ~~they are active~~.		# '''Auditing:''' Use [[Special:ListUsers]] monthly to ensure no "shadow" human accounts have been created.

	[[Category:ICT Documentation]]		[[Category:ICT Documentation]]
	[[Category:Security Operations]]		[[Category:Security Operations]]

Mngr at 18:18, 9 February 2026

2026-02-09T18:18:43Z

← Older revision		Revision as of 18:18, 9 February 2026
Line 2:		Line 2:
	__TOC__		__TOC__
	== Overview ==		== Overview ==
	This document outlines the security profile of default system accounts and the ~~hardened registration settings for~~ this MediaWiki instance (v1.45).		This document outlines the security profile of default system accounts and the hardening configurations applied to this MediaWiki instance (v1.45) to restrict access and visibility.

	== Default System Accounts ==		== Default System Accounts ==
Line 19:		Line 19:

	== Applied Hardening (LocalSettings.php) ==		== Applied Hardening (LocalSettings.php) ==
	~~To prevent unauthorized account creation and "shadow" users, the~~ following configurations are ~~active:~~		The following configurations are implemented in the server's configuration file to secure the environment.

	=== Registration Lock ===		=== 1. Registration Lock ===
	~~The following prevents~~ the "Create Account" option from appearing to anonymous visitors:		Prevents the "Create Account" option from appearing to anonymous visitors.
	<syntaxhighlight lang="php">		<syntaxhighlight lang="php">
	$wgGroupPermissions['*']['createaccount'] = false;		$wgGroupPermissions['*']['createaccount'] = false;
	</syntaxhighlight>		</syntaxhighlight>

	=== Write Protection ===		=== 2. Write Protection ===
	~~To ensure data integrity and prevent spam,~~ anonymous editing ~~is disabled:~~		Disables anonymous editing to ensure only identified users can modify content.
	<syntaxhighlight lang="php">		<syntaxhighlight lang="php">
	$wgGroupPermissions['*']['edit'] = false;		$wgGroupPermissions['*']['edit'] = false;
			</syntaxhighlight>

			=== 3. Private Wiki Configuration (Optional/Full Privacy) ===
			To prevent any unauthorized viewing of the wiki content, the following settings hide all pages from logged-out users, except for the login interface.

			<syntaxhighlight lang="php">
			# Disable reading by anonymous users
			$wgGroupPermissions['*']['read'] = false;

			# Whitelist essential pages to allow users to log in
			$wgWhitelistRead = array(
			"Special:UserLogin",
			"MediaWiki:Common.css",
			"MediaWiki:Common.js"
			);
	</syntaxhighlight>		</syntaxhighlight>

	== Successor Maintenance Notes ==		== Successor Maintenance Notes ==
	# ~~Always~~ verify the user list via [[Special:ListUsers]] ~~after performing software updates~~.		# '''Audit:''' Regularly verify the user list via [[Special:ListUsers]].
	# If a new system user appears after ~~installing~~ an extension, ~~verify its status on~~ the [https://www.mediawiki.org MediaWiki System User Manual].		# '''Updates:''' If a new system user appears after an upgrade or extension install, consult the [https://www.mediawiki.org MediaWiki System User Manual].
			# '''Configuration:''' All changes above must be verified in an Incognito/Private browser window to ensure they are active.

	[[Category:ICT Documentation]]		[[Category:ICT Documentation]]
	[[Category:Security Operations]]		[[Category:Security Operations]]

Mngr: Created page with "{{DISPLAYTITLE:Account Protections & System Users}} TOC == Overview == This document outlines the security profile of default system accounts and the hardened registration settings for this MediaWiki instance (v1.45). == Default System Accounts == Upon initialization, MediaWiki creates or reserves specific identities. === MediaWiki default === * '''Type:''' Virtual/System User. * '''Password Protection:''' This account '''does not have a password''' and is blocked..."

2026-02-09T18:12:38Z

Created page with "{{DISPLAYTITLE:Account Protections & System Users}} __TOC__ == Overview == This document outlines the security profile of default system accounts and the hardened registration settings for this MediaWiki instance (v1.45). == Default System Accounts == Upon initialization, MediaWiki creates or reserves specific identities. === MediaWiki default === * '''Type:''' Virtual/System User. * '''Password Protection:''' This account '''does not have a password''' and is blocked..."

New page

{{DISPLAYTITLE:Account Protections & System Users}}
__TOC__
== Overview ==
This document outlines the security profile of default system accounts and the hardened registration settings for this MediaWiki instance (v1.45).

== Default System Accounts ==
Upon initialization, MediaWiki creates or reserves specific identities.

=== MediaWiki default ===
* '''Type:''' Virtual/System User.
* '''Password Protection:''' This account '''does not have a password''' and is blocked from web-based login.
* '''Function:''' It acts as a placeholder for automated interface updates and system-generated edits.
* '''Security Status:''' Safe; cannot be compromised via brute force.

=== Initial Admin (Sysop) ===
* '''Type:''' Human Administrator.
* '''Security:''' Protected by a salted hash password.
* '''Audit Path:''' Check rights via [[Special:UserRights]] or the [[Special:ListUsers/sysop|Sysop List]].

== Applied Hardening (LocalSettings.php) ==
To prevent unauthorized account creation and "shadow" users, the following configurations are active:

=== Registration Lock ===
The following prevents the "Create Account" option from appearing to anonymous visitors:
<syntaxhighlight lang="php">
$wgGroupPermissions['*']['createaccount'] = false;
</syntaxhighlight>

=== Write Protection ===
To ensure data integrity and prevent spam, anonymous editing is disabled:
<syntaxhighlight lang="php">
$wgGroupPermissions['*']['edit'] = false;
</syntaxhighlight>

== Successor Maintenance Notes ==
# Always verify the user list via [[Special:ListUsers]] after performing software updates.
# If a new system user appears after installing an extension, verify its status on the [https://www.mediawiki.org MediaWiki System User Manual].

[[Category:ICT Documentation]]
[[Category:Security Operations]]