Support

Hello,

Please see the image.

There is a warning displayed to you about the security implications of using the default backup output directory. The warning is displayed in the Akeeba Backup Control Panel page when you activate a backup profile that uses the default backup output directory, as well asevery time you try to take a backup from the backend of your site with said backup profile.

This warning has been in place since 2009 and links to the Default output directory in use page explaining the issue and its mitigation. The same information is also present in our documentation's Security Information chapter for two years longer. If you have not done so already, please click on the link above to understand the security implications of using the default backup output directory before reading on.

Unfortunately, our security advice has been effectively ignored by our users for as long as we have it in place. This creates a potentially hazardous situation for our users that needs to be mitigated.

Changing or removing the default backup output directory is not a viable option for practical reasons. We cannot expect new users to follow an additional and potentially confusing configuration step just to start using our software. Nor can we stand aside when more experienced users, complacent by their initial experience using our software, take no positive action to improve their site's security despite a warning urging them to do so.

In an effort to protect the security and privacy of our clients' sites we decided to transition from passive security advice to affirmative security action. To this end, we will make the backup archive filenames practically impossible to guess by automatically adding -[RANDOM] (dash followed by 16 random alphanumeric characters) to the backup archive filename in the following potentially hazardous configuration conditions:

1. You are using the default backup output directory; OR

2. You are using a backup output directory that is under your site's root and for which we cannot positively detect that it's inaccessible over the web.

The test for whether the backup output directory is accessible over the web takes place when you visit Akeeba Backup's Control Panel page and activate the backup profile in question from the dropdown list. First, Akeeba Backup will place a .htaccess, web.config, index.html and index.html file if they are not already present. For this reason it's IMPERATIVE that your backup output directory is NOT the parent folder of a web accessible location. The check will then try to write a randomly named file in your backup output directory and access it over the web. This may create an entry in your server's error log. If this happens do not worry; it's normal and it means that everything is working correctly.

You cannot disable this behavior in Akeeba Backup for the same reason you cannot disable seat belts in a car. It is a security feature, put in place to protect you.

If you want to avoid having the random characters appended to your backup archive's name you need to address the conditions above, i.e. follow our advice to create a dedicated backup output directory. A short version follows.

Ideally, this should be placed in a directory above your site's root. If this is not possible, please use a directory inside your site's root. A hard to guess name like "qebPw234wD_backups" is preferred to an easily guessable name like "backups". Do not place your backup output directory in a CMS system directory, such as Joomla's cache, tmp, media etc directories or WordPress' wp-content directory. After creating the backup output directory go to the Configuration page to change your backup output directory to it. This needs to be done once per backup profile. Remember to exclude your old backup output directory (default: administrator/components/com_akeeba/backup) from your backup to prevent backing up any existing backups which may still be in there.

When you next visit Akeeba Backup's Control Panel, Akeeba Backup will try to protect the backup output directory and check if your directory is accessible over the web, as explained above.

If the backup output directory is EITHER above the site's root (therefore by definition inaccessible over the web) OR positively identified as being inaccessible over the web THEN and only then Akeeba Backup will stop adding the -[RANDOM] suffix to the names of your backup archives.

Thank you for your understanding wile we make using Akeeba Backup safer for you.