Answers.Body: <p>There is an advantage of having Civi on a separate server.  The software setup on the main website may not be compatible with Civi.  I ran into this problem, and regretted the move. The main website was Drupal 7 so should have been OK, but with hundreds of added modules - at least one of which caused Civi problems. Better to have Civi on a separate server, in my experience.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-01-20T19:15:26.820Z
Answers.Text: Conflicts in modules or extensions can happen, so that's not a concern specific to CiviCRM IMO - if you identify a conflict you can report the issue via [Drupal.org submit issue](https://www.drupal.org/node/add/project-issue) or [CiviCRM's JIRA](https://issues.civicrm.org) to help it get addressed. If the main site is overloaded with hundreds of modules, I see sense in start afresh for the CRM, but that advice doesn't necessarily apply generally.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-01-20T12:36:45.693Z
Answers.LastActivityDate: 2016-01-20T12:36:45.693Z
Answers.UserDisplayName: Andy Clark
Answers.Body: <p>Generally when evaluating security, you need to balance likelihood and severity of threats against the resources available to counter them. A human rights organization that was a client of mine had information on activists in their CiviCRM instance who could be imprisoned or killed by their governments, with sophisticated, well-resourced governments interested in getting that contact information: high threat, high consequences. In that kind of a context it might make sense to avoid exposing your CiviCRM system to the public web. Another client of ours, Nader for President 2008, also used an instance of CiviCRM hosted on a hardened server that was not exposed on the web, using custom software to migrate relevant contact information into CiviCRM.</p>
  
  <p>For the last several years, the supported and generally available releases of CiviCRM require a CMS to be installed on the same server to manage user accounts and permissions.</p>
  
  <p>In your case, I would recommend putting CiviCRM and Joomla! on the same VPS/server, and keeping your Joomla! software up to date with all security upgrades/patches. Follow the Joomla security best practices listed at <a href="https://docs.joomla.org/Security_Checklist">https://docs.joomla.org/Security_Checklist</a>. A more in-depth practical guide developed for Drupal but containing many generic sections can be found at <a href="http://openconcept.ca/drupal-security-best-practices-practical-guide">http://openconcept.ca/drupal-security-best-practices-practical-guide</a>. </p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-01-21T15:01:26.543Z
Answers.Text: thx for your answer. I think I will try to install CiviCRM on an separate server and then open the event sign up forms in an pop-up box. So or so I need now to connect two different Joomla websites to one CiviCRM database.
Answers.UserDisplayName: Arcurus
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-01-19T22:56:27.213Z
Answers.LastActivityDate: 2016-01-19T22:56:27.213Z
Answers.UserDisplayName: Joe Murray
Body: <p>I am new to CiviCRM and want to use it on a Joomla website.</p>
  
  <p>The question I have is how is the best way to make sure, that the CiviCRM user data is secure?</p>
  
  <p>I am thinking about installing CiviCRM in an second Joomla installation on an separate hosted account so that the main website and the CiviCRM data is completely separated and therefore the attack vector is as small as possible. Is this a too big overhead? How do others do that?
  Mainly I want to use CiviCRM for global member / participants management. </p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-01-19T22:56:02.917Z
Comments.Text: @Acurius: StackExchange's format is designed for a single question per post. Could you post your second and third questions separately: "Secondly I want that event participants are registered automatically in CiviCRM. For that I already tried out the events registration forms, which is functioning well. Third I want to have more people working in CiviCRM but if possible I don't want to give them administrator access in Joomla. Is this possible and if so how?"
Comments.UserDisplayName: Joe Murray
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-01-21T15:06:24.573Z
Comments.Text: yes i understand. Its just that as newcomer its good to describe what you want to do with CiviCRM to get best practices how to do. Because things are interconnected. I think in the old forum there was a place for newcomers, but now the forum seems to be deprecated...
Comments.UserDisplayName: Arcurus
Tags: <joomla><installation><security>
Title: Installing CiviCRM - best security practices
ThreadText: # Installing CiviCRM - best security practices
  
  (Asked by: username_0 on 2016-01-18)
  
  I am new to CiviCRM and want to use it on a Joomla website.
  
  The question I have is how is the best way to make sure, that the CiviCRM user data is secure?
  
  I am thinking about installing CiviCRM in an second Joomla installation on an separate hosted account so that the main website and the CiviCRM data is completely separated and therefore the attack vector is as small as possible. Is this a too big overhead? How do others do that?
  Mainly I want to use CiviCRM for global member / participants management.
  
  **Tags:** joomla, installation, security
  
  > **Comments:**
  > **username_1**: @Acurius: StackExchange's format is designed for a single question per post. Could you post your second and third questions separately: "Secondly I want that event participants are registered automatically in CiviCRM. For that I already tried out the events registration forms, which is functioning well. Third I want to have more people working in CiviCRM but if possible I don't want to give them administrator access in Joomla. Is this possible and if so how?"  
  > **username_0**: yes i understand. Its just that as newcomer its good to describe what you want to do with CiviCRM to get best practices how to do. Because things are interconnected. I think in the old forum there was a place for newcomers, but now the forum seems to be deprecated...  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2016-01-19. Score: 6 | Accepted answer
  
  Generally when evaluating security, you need to balance likelihood and severity of threats against the resources available to counter them. A human rights organization that was a client of mine had information on activists in their CiviCRM instance who could be imprisoned or killed by their governments, with sophisticated, well-resourced governments interested in getting that contact information: high threat, high consequences. In that kind of a context it might make sense to avoid exposing your CiviCRM system to the public web. Another client of ours, Nader for President 2008, also used an instance of CiviCRM hosted on a hardened server that was not exposed on the web, using custom software to migrate relevant contact information into CiviCRM.
  
  For the last several years, the supported and generally available releases of CiviCRM require a CMS to be installed on the same server to manage user accounts and permissions.
  
  In your case, I would recommend putting CiviCRM and Joomla! on the same VPS/server, and keeping your Joomla! software up to date with all security upgrades/patches. Follow the Joomla security best practices listed at <https://docs.joomla.org/Security_Checklist>. A more in-depth practical guide developed for Drupal but containing many generic sections can be found at <http://openconcept.ca/drupal-security-best-practices-practical-guide>.
  
  > **Comments:**
  > **username_0**: thx for your answer. I think I will try to install CiviCRM on an separate server and then open the event sign up forms in an pop-up box. So or so I need now to connect two different Joomla websites to one CiviCRM database.  
  
  ---
  
  ### Answer by username_2 on 2016-01-20. Score: 0
  
  There is an advantage of having Civi on a separate server. The software setup on the main website may not be compatible with Civi. I ran into this problem, and regretted the move. The main website was Drupal 7 so should have been OK, but with hundreds of added modules - at least one of which caused Civi problems. Better to have Civi on a separate server, in my experience.
  
  > **Comments:**
  > **username_3**: Conflicts in modules or extensions can happen, so that's not a concern specific to CiviCRM IMO - if you identify a conflict you can report the issue via [Drupal.org submit issue](https://www.drupal.org/node/add/project-issue) or [CiviCRM's JIRA](https://issues.civicrm.org) to help it get addressed. If the main site is overloaded with hundreds of modules, I see sense in start afresh for the CRM, but that advice doesn't necessarily apply generally.  
  
  ---
  
  