31,003
edits
Security information: Difference between revisions
Jump to navigation
Jump to search
m
no edit summary
mNo edit summary Tag: 2017 source edit |
mNo edit summary Tags: Visual edit Mobile edit Mobile web edit Advanced mobile edit |
||
| Line 18: | Line 18: | ||
To list or receive all official alerts about known security vulnerabilities (aggregation of official published CVE, Private Vulnerability Disclosure, project issues) on Dolibarr project you can: | To list or receive all official alerts about known security vulnerabilities (aggregation of official published CVE, Private Vulnerability Disclosure, project issues) on Dolibarr project you can: | ||
* If you want to also receive security alerts not yet known by the project team, and published in the international CVE database, you can subscribe to a CVE alert service. A good service for example https://opencve.io). | *look at the section "'''Security alerts'''" available on this page https://cti.dolibarr.org, | ||
*or subscribe to the RSS feed at https://cti.dolibarr.org/index-security.rss if you need to receive or read alert in real time on your smartphone (for example with the Android application [https://f-droid.org/packages/com.nononsenseapps.feeder/ Feeder]). | |||
*If you want to also receive security alerts not yet known by the project team, and published in the international CVE database, you can subscribe to a CVE alert service. A good service for example https://opencve.io). | |||
=[[File:art.png]] Security Features= | =[[File:art.png]] Security Features= | ||
Dolibarr implements several security features to match best practices rules related to security. | Dolibarr implements several security features to match best practices rules related to security. | ||
This is a list of main security features you can find : | This is a list of main security features you can find<span> </span>: | ||
| Line 102: | Line 103: | ||
*No passwords in logs, even in technical logs <sup>[*7]</sup>. | *No passwords in logs, even in technical logs <sup>[*7]</sup>. | ||
*Internal logger to save permanently all Dolibarr events about user's administration and successful or failed logins or administration events (like user or group or permission changes). | *Internal logger to save permanently all Dolibarr events about user's administration and successful or failed logins or administration events (like user or group or permission changes). | ||
*Can output a log record into a log file (module Debug Log must be enabled with at least level 5-LOG_NOTICE on production server, higher on development server) after success or failed login attempt so you can add a fail2ban rule to lock brute force cracking. You can check record with syntax : | *Can output a log record into a log file (module Debug Log must be enabled with at least level 5-LOG_NOTICE on production server, higher on development server) after success or failed login attempt so you can add a fail2ban rule to lock brute force cracking. You can check record with syntax<span> </span>: | ||
"YYYY-MM-DD HH:MM:SS (ERROR|NOTICE|INFO|DEBUG) IP functions_dolibarr::check_user_password_.* Authentication KO" | "YYYY-MM-DD HH:MM:SS (ERROR|NOTICE|INFO|DEBUG) IP functions_dolibarr::check_user_password_.* Authentication KO" | ||
| Line 130: | Line 131: | ||
'''DOS and Brute force rate Mitigation''' | '''DOS and Brute force rate Mitigation''' | ||
* Embedded AntiDOS features with quota on public action per IP. | *Embedded AntiDOS features with quota on public action per IP. | ||
* The project provide also examples of some fail2ban rules to block brute force attempts or abusive access on login page, password forgotten page and on any public pages. See https://github.com/Dolibarr/dolibarr/tree/develop/dev/setup/fail2ban | *The project provide also examples of some fail2ban rules to block brute force attempts or abusive access on login page, password forgotten page and on any public pages. See https://github.com/Dolibarr/dolibarr/tree/develop/dev/setup/fail2ban | ||