<p>We recommend you don't take security issues too lightly. Chamilo is security-audited at least once a year, but you're never too sure. This list is a work in progress. Feel free to recommend additional measures by sending us an e-mail at info@chamilo.org.</p>
<h2><b>Contents</b></h2>
<ol>
<li><ahref="#1.Disclosing-server-info">Disclosing server info</a></li>
<li><ahref="#2.Keeping-up-to-date">Keeping up to date</a></li>
<h2><aname="1.Disclosing-server-info"></a>Disclosing server info</h2>
<p>
It is considered a safer behaviour not to disclose server information from your Chamilo page. In order to avoid both web server and PHP information disclosure, you might want to take the following actions:
<ul>
<li>Locate the <i>ServerTokens</i> setting inside your Apache configuration and set it to "Prod"</li>
<li>Locate the <i>ServerSignature</i> setting inside your Apache configuration and set it to "Off"</li>
<li>Locate the <i>expose_php</i> setting inside your PHP configuration and set it to "Off"</li>
<li>Reload Apache</li>
</ul>
</p>
<h2><aname="4.Keeping-up-to-date"></a>4. Keeping up to date</h2>
<p>
Make sure you check <ahref="http://support.chamilo.org/projects/chamilo-18/wiki/Security_issues">our security issues page</a> from time to time.
Subscribe to our free security alerts mailing-list: <ahref="http://lists.chamilo.org/listinfo/security">http://lists.chamilo.org/listinfo/security</a> or that you follow our security Twitter feed: <ahref="http://twitter.com/chamilosecurity">http://twitter.com/chamilosecurity</a>.
