Skip to main content

Server Security Checklist

Use this after installing or updating server files.

phpVMS 7​

  • GET /api/dotacars/status returns mode: native_module.
  • Admin > dotACARS opens and saves settings.
  • phpVMS 7 settings are not stored in va_config.php; dotacars_config is the module configuration table.
  • Old public/acars/*.php files are removed.
  • modules/DotAcars is not browseable by URL.
  • No sessions, logs, cache, reports, .env, .ini, .sql, .bak, .zip, .tar or .gz files are in public.
  • Requests without a dotACARS session token are rejected.
  • Invalid coordinates and incomplete requests are rejected.
  • Finish submits PIREPs through phpVMS services and fires phpVMS events/listeners.

phpVMS 5​

  • GET /acars/bootstrap.php responds and /acars/status.php reports version 1.2.0.
  • GET /acars/sessions/, /acars/reports/, /acars/logs/ and /acars/cache/ are blocked.
  • va_config.php and _dotacars_common.php are blocked.
  • Directory listing is disabled.
  • cleanup_live.php and all obsolete/debug/test endpoints are absent.
  • Runtime data is outside the webroot, or the deny-all fallback was verified.
  • Invalid login attempts are rate limited.
  • Invalid sessions and invalid position data are rejected.
  • BID, position and PIREP requests cannot change the authenticated pilot.
  • PIREP logs are stored as plain text, not executable HTML.
  • No debug, diagnostic, test or backup files are public.

General​

  • HTTPS is enabled.
  • Only the required folder for the matching phpVMS version was uploaded.
  • Server logs do not contain passwords or full session tokens.
  • The desktop app is configured with the crew center base URL, not an endpoint URL.
  • For phpVMS 7, leave client-token enforcement disabled unless the VA has distributed the matching token to every desktop client.