Howto Install Joomla 3 on MS Windows 8

Content Management Systems (CMS) provides a simple framework to focus on developing a web site to deliver specific contents. Basic stuff like user authentication, layout and web standards will be handled by the CMS while more important stuffs like getting the message across and providing a specific service can be the main focus.

Yes, gain insights of experts and community around the world by using a CMS like Joomla! that practices use of open source software (OSS) license.

Installation was done based on notes from docs.joomla.org at https://docs.joomla.org/Use_Joomla!_on_your_own_computer

Following are my notes on installation of Joomla! 3.3.6 on Windows 8. Before going to step 1, ensure the web server has;

Apache 2.4
PHP 5.4 (min 5.3.10), enable following PHP modules

• Magic Quotes GPC Off
• Register Globals Off   
• Zlib Compression Support 
• XML Support   
• Database Support: (mysql, mysqli, pdo)  
• MB Language is Default 
• MB String Overload Off  
• INI Parser Support    
• JSON Support  
• configuration.php Writeable

MySQL 5.5

Step 1: Getting Joomla!

Download Joomla! from http://www.joomla.org/download.html and extract it to a folder, e.g. myjoomla.
Copy this to your web folder. e.g. C:\apache24htdocs

Step 2: Preparation

Create a MySQL database called myjoomla3. Login to MySQL client and type;

CREATE database myjoomla3;

 And logout.

Step 3: Installation

Open a web browser and enter URL Address. E.g. http://localhost/myjoomla and enter details. Complete the sections for "Configuration", "Database", "Overview".

Configuration

I choose to create the default Administrator username as "admin".



Database
Ensure the configuration for database created is entered correctly. Choose MYSQLi if you are prompted to do so.

Overview
Choose Install Sample Data: Default English (GB) Sample Data

Click "Install". When installation is completed, you will receive the confirmation message "Congratulations! Joomla! is now installed."

Open Windows Explorer and remove the installation folder in joomla named installation. E.g. C:\Apache24\htdocs\myjoomla\installation

Step 4: Post installation

Test the installation with a web browser as;

1.  front-end page  at http://localhost/myjoomla/
2.  site administration page  at http://localhost/myjoomla/administrator/

First access: Front-end on desktop

First access: Front-end on mobile

First access:Administration page

Step 5: Choosing a template

This is an extra step for looks. In a web browser open the Administration page, e.g. http://localhost/myjoomla/administrator

In the default Administration page, observer the left column and click "Template Manager". In the left menu choose "Styles". There are 4 styles available for you;

1. Beez3 (for Front-end)
2. Hathor (for Administration page)
3. isis (Default for Administration page)
4. protostar (Default for Front-end)

 Try to click on Hathor, notice the page has changed. Click Beez3, and in Front-end see the changes.


Done.

A CMS called Joomla

Joomla! is a widely used content management system using PHP and its frameworks. However due to its large user base, hackers have been attracted like bees to honey.

Example of pre Joomla! 1.5.6 security issue is the
Joomla "token" Password Change Vulnerability where the admin password could be reset easily. Users can then install the Joomla explorer component, and upload malicious scripts.

Following are some precautions on installation of Joomla!

1. Patch the OS and its other software
   
1. Open only needed ports (HTTP, HTTPS)
2. Patch the software
3. Configure the software in a secure manner
2. Verify that Joomla! is from the official site http://www.joomla.org
3. During installation - Do not use the default MySQL tables prefix as jos_
   
4. Change the default administrator name (default is admin)
5. Remove all files as instructed by Joomla! And other unneeded files or directories
6. Ensure files and directories have the proper permissions. Below are for Linux based systems.
   
1. PHP files: 644
2. Config files: 666
3. Other folders: 755
   
7. Password protect sensitive directories with .htaccess
8. Move the configuration.php file to outside of the web directory if possible. Make it non-writable.
9. Use a search engine friendly (SEF) URLs
   

1. The Google inurl: command can be used to search for a vulnerable exploit. Use Artio, SH404SEF or another SEF component to re-write your URLs. This will prevent hackers from finding the exploits.

10. Establish a security plan and ensure the relevant parties know about it.
11. Remove unused extensions and themes. Existing extensions and themes should have their version removed from the end user view.
    
12. Subscribe to Joomla! and the extensions/themes sites for continuous updates. Additional sites that can help with updates:
1. http://joomla-wiki.de/doku.php?id=howto_s:security:checklist
2. http://docs.joomla.org/Joomla_Administrators_Security_Checklist
   
13. Subscribe to security sites such as http://www.ictsecurity.gov.my/
14. Carryout routine backup of Joomla! Site and its database.

Using Apache Benchmarking tools
One good reason to use Apache web server is the availability of a benchmarking tool. There are some constrains that you should know in using this data. Read the documentations. Install Apache and execute as below:
ab -n7500 -c100 http://server.com

Where
-n option is the number of request for benchmark
-c is the number of concurrent page request

===========
Document Path: /
Document Length: 36649 bytes

Concurrency Level: 100
Time taken for tests: 183.819035 seconds
Complete requests: 500
Failed requests: 383
(Connect: 0, Length: 383, Exceptions: 0)
Write errors: 0
Total transferred: 6472586 bytes
HTML transferred: 6260026 bytes
Requests per second: 2.72 [#/sec] (mean)
Time per request: 36763.806 [ms] (mean)
Time per request: 367.638 [ms] (mean, across all concurrent requests)
Transfer rate: 34.38 [Kbytes/sec] received

Connection Times (ms)
min mean[+/-sd] median max
Connect: 0 1446 4324.4 0 21000
Processing: 47 23707 49002.2 1897 175812
Waiting: 47 21936 45081.7 1897 173650
Total: 47 25153 49793.2 2214 183816

Percentage of the requests served within a certain time (ms)
50% 2214
66% 6756
75% 10461
80% 27527
90% 132227
95% 151803
98% 175812
99% 181539
100% 183816 (longest request)
=== END ====

Other references:
For discussion on application security see https://nvd.nist.gov/cwe.cfm#NVD-CWE-DesignError.

My advice to those considering other CMS is this;
All CMS will have their weak points. However Joomla! have thus far been prompt with security notices and updates. Hackers tend to crawl the webs on Friday to Sundays, when systems are unattended. As the care taker of the Joomla! you need to be proactive, it goes the same for any other CMS. Finally, Joomla! is easy to use for end-users and provides lots of features for beautifications.