31,003
edits
Security information: Difference between revisions
Jump to navigation
Jump to search
m
no edit summary
Tag: 2017 source edit |
mNo edit summary |
||
| Line 13: | Line 13: | ||
A vulnerability allowing a user to get the list of contacts (name, firstname and id in database) has been discovered. | A vulnerability allowing a user to get the list of contacts (name, firstname and id in database) has been discovered. | ||
Fix is available into {{Template:SafeVersion}}. | Fix is available into {{Template:SafeVersion}}and higher versions. | ||
Note: You can also download from GitHub the '''intermediate''' versions (not yet released maintenance package) for all branches/version (https://github.com/Dolibarr/dolibarr/) | Note: You can also download from GitHub the '''intermediate''' versions (not yet released maintenance package) for all branches/version (https://github.com/Dolibarr/dolibarr/) | ||
| Line 29: | Line 29: | ||
*Possibility to force HTTPS <sup>[*9]</sup>. | *Possibility to force HTTPS <sup>[*9]</sup>. | ||
< | <syntaxhighlight lang="PHP"> | ||
//conf/conf.php file | //conf/conf.php file | ||
//example of $dolibarr_main_force_https configuration | //example of $dolibarr_main_force_https configuration | ||
$dolibarr_main_force_https = '1';//to force https | $dolibarr_main_force_https = '1';//to force https | ||
</ | </syntaxhighlight> | ||
{| class="wikitable" style="width:100%;" | {| class="wikitable" style="width:100%;" | ||
| Line 77: | Line 77: | ||
Note that it is also recommended to protect your web server by disabled Apache option | Note that it is also recommended to protect your web server by disabled Apache option | ||
< | <syntaxhighlight lang="ini"> | ||
AcceptPathInfo Off | AcceptPathInfo Off | ||
</ | </syntaxhighlight> | ||
| Line 96: | Line 96: | ||
*No passwords in logs, even in technical logs <sup>[*7]</sup>. | *No passwords in logs, even in technical logs <sup>[*7]</sup>. | ||
*Internal logger to save permanently all Dolibarr events about user's administration and successful or failed logins or administration events (user or group or permission changes). | *Internal logger to save permanently all Dolibarr events about user's administration and successful or failed logins or administration events (user or group or permission changes). | ||
*Can output a log record into a log file (module Debug Log must be enabled with at least level 5-LOG_NOTICE on production server, higher on development server) after success or failed login attempt so you can add a fail2ban rule to lock brute force cracking. You can check record with syntax : | *Can output a log record into a log file (module Debug Log must be enabled with at least level 5-LOG_NOTICE on production server, higher on development server) after success or failed login attempt so you can add a fail2ban rule to lock brute force cracking. You can check record with syntax : | ||
"YYYY-MM-DD HH:MM:SS (ERROR|NOTICE|INFO|DEBUG) IP functions_dolibarr::check_user_password_.* Authentication KO" | "YYYY-MM-DD HH:MM:SS (ERROR|NOTICE|INFO|DEBUG) IP functions_dolibarr::check_user_password_.* Authentication KO" | ||
A list of fail2ban rules to add to your server is provided on chapter '''DOS and Brute force rate Mitigation''' later. | A list of fail2ban rules to add to your server is provided on chapter '''DOS and Brute force rate Mitigation''' later. | ||
| Line 126: | Line 127: | ||
The project provide examples of some fail2ban rules to block brute force attempts or abusive access on login page, password forgotten page and on any public pages. See https://github.com/Dolibarr/dolibarr/tree/develop/dev/setup/fail2ban | The project provide examples of some fail2ban rules to block brute force attempts or abusive access on login page, password forgotten page and on any public pages. See https://github.com/Dolibarr/dolibarr/tree/develop/dev/setup/fail2ban | ||
=[[File:art.png]] Report a security vulnerability = | =[[File:art.png]] Report a security vulnerability= | ||
*To report a vulnerability, see the file: https://github.com/Dolibarr/dolibarr/blob/develop/SECURITY.md | *To report a vulnerability, see the file: https://github.com/Dolibarr/dolibarr/blob/develop/SECURITY.md | ||
| Line 132: | Line 133: | ||
In most cases, security reports are processed in few days only. | In most cases, security reports are processed in few days only. | ||
---- | ---- | ||
<sup>(*X)</sup> This solution is part of protection used to solve vulnerabilities classified by the [http://www.owasp.org/index.php/Top_10_2007 OWASP Top Ten] at range number X. | <sup>(*X)</sup> This solution is part of protection used to solve vulnerabilities classified by the [http://www.owasp.org/index.php/Top_10_2007 OWASP Top Ten] at range number X. | ||