MediaWiki Debian Installation

My Experience Installing MediaWiki 1.31 on Debian Bullseye (Buster)

This page will be under construction for some while (started 2020-2-14).

These are no complete installation instructions, but a description of some of the challenges and the possible solutions to set up mediawiki with the following goals:

1. As secure as possible, inclusive forward security,
2. Short URLs and VisualEditor + Math extension.

My server is separate, i.e. not on my home workstation, and plugged to the router. It's a fanless small machine, consuming between 5 and 15 Watts according to the product description. (Not being paid for advertising, I can recommend it at any time: fitlet2. See also the description at Phoronix.)

I am neither following a logical nor chronological path, but rather choose the various issues from the end with the solutions found. As I have full access to all parts of my network, ssh access is possible. To easily download extensions to the target server from the mediawiki site, I access the target server with

homeuser@homemachine:~$ ssh -Y serveruser@targetserver

and then start firefox on the targetserver

serveruser@targetserver:~$ firefox&

Firewall

Between my homemachine or an outside visitor and the targetserver is the firewall, built into my router. So I have to allow port sharing of my target server. Debian's default for ssh is port 22. (For further serving http, https and parsoid and mathoid extensions I also allowed ports 80, 443, 8143 and 10043 each for IPv4 and IPv6 to be shared.)

Debian on targetserver

fitlet2 comes with LinuxMint preinstalled, but I prefer Debian. The choice of a desktop environment and an Internet server on the targetserver allow remote browsing via ssh. Debian recommends

sudo tasksel

and then select Debian desktop environment (plus the choice of desktop) and web server. This installs apache2 and whatever else it needs as the default Web Server.

sudo apt update 
sudo apt full-upgrade 
sudo apt install mediawiki

installs, as I recall, all that is needed to run mediawiki on localhost.

Short URLs

Short story: place two aliases into the apache2 conf-file that defines the mediawiki host and define the $wgArticlePath:

/etc/apache2/conf-enabled/mediawiki.conf:

Alias /mediawiki /var/lib/mediawiki
Alias /wiki /var/lib/mediawiki/index.php

/etc/mediawiki/Localhost.php:

$wgArticlePath = '/wiki/$1';

Longer story: to get this right one has to know or guess how apache2 loads its modules, if there is cumulation, overwriting, sequencing etc. and how Debian handles this. As I played too long with the configuration files, I can't tell anymore what the original state was. I suppose that /etc/mediawiki/mediawiki.conf was a link to /etc/apache2/conf-enabled/mediawiki.conf and that the above aliases could have been added there.

SSL Virtual Default Host

I used Let's Encrypt, respectively Certbot, to get a certifcate for my site and had certbot change my configuration files in /etc/apache2. Testing with testssl showed vulnerabilities, i.e. TLSv1 and TLSv1.1 as accepted protocols.

sudo apt install certbot testssl.sh

testssl www.example.com

certbot changed the default virtual host file:

serveruser@targetserver:/etc/apache2/sites-enabled$ sudo nano 000-default-le-ssl.conf

<IfModule mod_ssl.c>
<VirtualHost *:443>

        # The ServerName directive sets the request scheme, hostname and port that
        # the server uses to identify itself. This is used when creating
        # redirection URLs. In the context of virtual hosts, the ServerName
        # specifies what hostname must appear in the request's Host: header to
        # match this virtual host. For the default virtual host (this file) this
        # value is not decisive as it is used as a last resort host regardless.
        # However, you must set it for any further virtual host explicitly.
        ServerName www.example.com

        # ServerAlias does not work for me
        #ServerAlias example.com *.example.com

        Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

        ServerAdmin admin@localhost
        
        DocumentRoot /var/www/html

        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with "a2disconf".
        #Include conf-available/serve-cgi-bin.conf

        SSLCipherSuite HIGH:!aNULL

        SSLCertificateFile /etc/letsencrypt/live/www.example.com-0001/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/www.example.com-0001/privkey.pem
        Include /etc/letsencrypt/options-ssl-apache.conf

</VirtualHost>
</IfModule>

To be noted is the line: 'Include /etc/letsencrypt/options-ssl-apache.conf'. The protocols not to be offered are to be indicated there:

SSLEngine on

# Intermediate configuration, tweak to your needs
SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:...

SSLOptions +StrictRequire

testssl www.example.com now runs flawlessly, warning only about two or three cyphers that should not be offered.