4

Until just a few weeks ago I always used to set up my home-servers one service at a time (e.g. httpd, ProFTPD, etc.). I have now begun using XAMPP instead and was wondering if there is any reason why I shouldn't be using it.

I have heard that using a server package such as XAMPP can present a security risk. How is this possible if the configuration files are still there for me to edit manually if I need to?

Are there any other potential problems that I should be aware of?

3
  • Could you clarify: Is this server hosting sites on the internet or is this internal only?
    – Chris_K
    Sep 12, 2009 at 3:36
  • The server is accessible from the internet and hosting a small site that is not exclusively accessed from within my home network. Sep 12, 2009 at 3:50
  • 1
    Key phrase being "if I need to". Would you know if you need to or not? Sep 12, 2009 at 6:22

2 Answers 2

8

The biggest problem is that out of the box its not locked down very tight.

From Wikipedia:

Officially, XAMPP's designers intended it for use only as a development tool, to allow website designers and programmers to test their work on their own computers without any access to the Internet. To make this as easy as possible, many important security features are disabled by default.

If you know what you are doing and take the time to properly secure it, it is only as insecure as the web apps and passwords you have set on your services.

If you don't know what you are doing, or you don't take the time to properly secure it, it has the potential to be a big security hole.

2

FTP isn't the greatest protocol to use for security reasons plain text passwords is one. Unless you update the software yourself you are stuck on their upgrade schedule which can lead to exploits and other security holes. The other packages they include just add to your problems if they aren't patched on a regular basis. Same could be said of anything so weigh your options and secure it the best you can.

1
  • 1
    I'm guessing you meant 'weigh' and not 'way' (last sentence). Sep 12, 2009 at 2:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .