X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=INSTALL.txt;h=a9d42495bcc70d35f4c9b23ebc0a0bdf3077226b;hb=e5c2c66487eceea38d7fbe792238991084718bd8;hp=574e90975b1e2ed1d6fc904502f150e545227248;hpb=aaf5a81365b4cbcb3d1b9537b5544aeb5de66f4b;p=friendica.git

diff --git a/INSTALL.txt b/INSTALL.txt
index 574e90975b..a9d42495bc 100644
--- a/INSTALL.txt
+++ b/INSTALL.txt
@@ -32,8 +32,7 @@ link if your cert is self-signed).
 	- Apache with mod-rewrite enabled and "Options All" so you can use a 
 local .htaccess file
 
-	- PHP 5.2+. The later the better. PHP 5.3 is required for communications 
-with the Diaspora network and improved security.
+	- PHP 5.4+.
 
 		- PHP *command line* access with register_argc_argv set to true in the 
 php.ini file [or see 'poormancron' in section 8]
@@ -42,7 +41,7 @@ php.ini file [or see 'poormancron' in section 8]
 
 		- some form of email server or email gateway such that PHP mail() works
 
-	- Mysql 5.x
+	- Mysql 5.5.3+ or an equivalant alternative for MySQL (MariaDB, Percona Server etc.)
 
 	- ability to schedule jobs with cron (Linux/Mac) or Scheduled Tasks
 (Windows) [Note: other options are presented in Section 8 of this document]
@@ -51,6 +50,10 @@ php.ini file [or see 'poormancron' in section 8]
 directory/path component in the URL) is preferred. This is REQUIRED if
 you wish to communicate with the Diaspora network.
 
+
+	- For alternative server configurations (such as Nginx server and MariaDB 
+	database engine), refer to the wiki at https://github.com/friendica/friendica/wiki
+
 2. Unpack the Friendica files into the root of your web server document area.
 
 	- If you copy the directory tree to your webserver, make sure
@@ -60,6 +63,8 @@ you wish to communicate with the Diaspora network.
 3. Create an empty database and note the access details (hostname, username, 
 password, database name).
 
+    - Friendica needs the permission to create and delete fields and tables in its own database.
+
 
 4. If you know in advance that it will be impossible for the web server to 
 write or create files in your web directory, create an empty file called 
@@ -130,8 +135,25 @@ $a->config['system']['addon'] = 'js_upload,poormancron';
 
 and save your changes.
 
+9. (Optional) Reverse-proxying and HTTPS
+
+Friendica looks for some well-known HTTP headers indicating a reverse-proxy
+terminating an HTTPS connection. While the standard from RFC 7239 specifies
+the use of the `Forwaded` header.
+
+    Forwarded: for=192.0.2.1; proto=https; by=192.0.2.2
+
+Friendica also supports a number on non-standard headers in common use.
+
+
+    X-Forwarded-Proto: https
+
+    Front-End-Https: on
+
+    X-Forwarded-Ssl: on
+
+It is however preferable to use the standard approach if configuring a new server.
 
- 
 #####################################################################
 
 		If things don't work...
@@ -222,3 +244,50 @@ Retry the installation. As soon as the database has been created,
 
 % chmod 755 .htconfig.php
 
+#####################################################################
+- Some configurations with "suhosin" security are configured without
+an ability to run external processes. Friendica requires this ability.
+Following are some notes provided by one of our members.
+#####################################################################
+
+On my server I use the php protection system Suhosin
+[http://www.hardened-php.net/suhosin/]. One of the things it does is to block
+certain functions like proc_open, as configured in /etc/php5/conf.d/suhosin.ini:
+
+ suhosin.executor.func.blacklist = proc_open, ...
+
+For those sites like Friendica that really need these functions they can be
+enabled, e.g. in /etc/apache2/sites-available/friendica:
+
+ <Directory /var/www/friendica/>
+  php_admin_value suhosin.executor.func.blacklist none
+  php_admin_value suhosin.executor.eval.blacklist none
+ </Directory>
+
+This enables every function for Friendica if accessed via browser, but not for
+the cronjob that is called via php command line. I attempted to enable it for
+cron by using something like
+
+ */10 * * * * cd /var/www/friendica/friendica/ && sudo -u www-data /usr/bin/php
+-d suhosin.executor.func.blacklist=none -d suhosin.executor.eval.blacklist=none
+-f include/poller.php
+
+This worked well for simple test cases, but the friendica-cron still failed with
+a fatal error:
+suhosin[22962]: ALERT - function within blacklist called: proc_open() (attacker
+'REMOTE_ADDR not set', file '/var/www/friendica/friendica/boot.php', line 1341)
+
+After a while I noticed, that include/poller.php calls further php script via
+proc_open. These scripts themselves also use proc_open and fail, because they
+are NOT called with -d suhosin.executor.func.blacklist=none.
+
+So the simple solution is to put the correct parameters into .htconfig.php:
+ // Location of PHP command line processor
+ $a->config['php_path'] = '/usr/bin/php -d suhosin.executor.func.blacklist=none
+-d suhosin.executor.eval.blacklist=none';
+
+
+This is obvious as soon as you notice that the friendica-cron uses proc_open to
+execute php-scripts that also use proc_open, but it took me quite some time to
+find that out. I hope this saves some time for other people using suhosin with
+function blacklists.