安全信息 - Revision history

Eldy: /* File:art.png 报告安全漏洞 */

2024-02-19T08:53:20Z

File:art.png 报告安全漏洞

← Older revision		Revision as of 08:53, 19 February 2024
Line 131:		Line 131:

	*要报告漏洞，请参阅文件： https://github.com/Dolibarr/dolibarr/blob/develop/SECURITY.md		*要报告漏洞，请参阅文件： https://github.com/Dolibarr/dolibarr/blob/develop/SECURITY.md
	*如果允许，您还可以在 https://github.com/Dolibarr/dolibarr/security 上使用 GitHub 的安全功能

	在大多数情况下，安全报告会在几天内被处理。		在大多数情况下，安全报告会在几天内被处理。

ShengGang at 02:17, 3 July 2023

2023-07-03T02:17:39Z

← Older revision		Revision as of 02:17, 3 July 2023
Line 8:		Line 8:
	<!-- END interlang links -->		<!-- END interlang links -->

	~~[[Category:Admin]]~~
	[[Category:Admin_cn]]		[[Category:Admin_cn]]
			[[Category:管理]]

	=[[File:securite.png]] 警报=		=[[File:securite.png]] 警报=

ShengGang: /* Report a security vulnerability */

2023-07-01T11:15:14Z

Report a security vulnerability

← Older revision		Revision as of 11:15, 1 July 2023
Line 128:		Line 128:
	该项目提供了一些 fail2ban 规则的示例，以阻止登录页面、忘记密码页面和任何公共页面上的暴力尝试或滥用访问。参见 https://github.com/Dolibarr/dolibarr/tree/develop/dev/setup/fail2ban		该项目提供了一些 fail2ban 规则的示例，以阻止登录页面、忘记密码页面和任何公共页面上的暴力尝试或滥用访问。参见 https://github.com/Dolibarr/dolibarr/tree/develop/dev/setup/fail2ban

	=[[File:art.png]] ~~Report a security vulnerability~~=		=[[File:art.png]] 报告安全漏洞=

	*~~To report a vulnerability, see the file:~~ https://github.com/Dolibarr/dolibarr/blob/develop/SECURITY.md		*要报告漏洞，请参阅文件： https://github.com/Dolibarr/dolibarr/blob/develop/SECURITY.md
	*~~If you are allowed, you can also use the security feature of GitHub on~~ https://github.com/Dolibarr/dolibarr/security		*如果允许，您还可以在 https://github.com/Dolibarr/dolibarr/security 上使用 GitHub 的安全功能

	~~In most cases, security reports are processed in few days only.~~		在大多数情况下，安全报告会在几天内被处理。


	----		----
	<sup>(*X)</sup> ~~This solution is part of protection used to solve vulnerabilities classified by the~~ [http://www.owasp.org/index.php/Top_10_2007 OWASP Top Ten] ~~at range number~~ X.		<sup>(*X)</sup> 此解决方案是用于解决 [http://www.owasp.org/index.php/Top_10_2007 OWASP Top Ten] 分类的漏洞（范围为 X 的）保护的一部分。

ShengGang at 10:45, 1 July 2023

2023-07-01T10:45:59Z

← Older revision		Revision as of 10:45, 1 July 2023
Line 9:		Line 9:

	[[Category:Admin]]		[[Category:Admin]]
	[[Category:~~Admin_en~~]]		[[Category:Admin_cn]]

	=[[File:securite.png]] 警报=		=[[File:securite.png]] 警报=

ShengGang: /* 安全特性 */

2023-07-01T04:25:22Z

安全特性

← Older revision		Revision as of 04:25, 1 July 2023
Line 69:		Line 69:
	'''黑客与骇客'''		'''黑客与骇客'''

	~~Works with~~ register_globals on ~~or off (off highly recommended)~~ <sup>[2]</sup>.		可使用 register_globals=on/off（强烈推荐使用off） <sup>[2]</sup> 。
	~~Works with~~ PHP safe_mode on or off (~~on recommended~~) <sup>[3]</sup>.		可使用 PHP safe_mode=on/off (推荐使用on) <sup>[3]</sup> 。
	~~Production mode to disable any technical information leakage like debug, error stacktrace, version informations (See~~ [[Configuration_file\|configuration file]]) <sup>[6]</sup>.		在生产模式下可禁用任何技术信息泄漏，如调试、错误堆栈跟踪、版本信息（请参阅 [[Configuration_file\|configuration file]]) <sup>[6]</sup> 。
	~~Protection against~~ SQL ~~injection. Protected by an Internal~~ WAF~~, and unit test to check database good practice for escapement.~~ <sup>[2]</sup>.		防止 SQL 注入。受内部 WAF 保护，并通过单元测试检查数据库擒纵机制的良好。 <sup>[2]</sup> 。
	~~Protection against~~ XSS ~~injection (Cross~~ Site ~~Scripting). Protected by an internal~~ WAF ~~and web page~~ headers. <sup>[1]</sup>.		防止 XSS 注入（Cross Site Scripting：跨站点脚本）。受内部 WAF 和网页 headers 保护。 <sup>[1]</sup> 。
	*~~Protection against SSRF.~~		*防止 SSRF。
	~~Protection against~~ CSRF (Cross Site Request ~~Forgery). Protected by an internal~~ WAF ~~and a~~ token ~~system.~~ <sup>[5]</sup>.		防止 CSRF(Cross Site Request Forgery：跨站点请求伪造）。受内部 WAF 和 token 系统保护。 <sup>[5]</sup> 。

	~~Note that it is also recommended to protect your web server by disabled~~ Apache ~~option~~		请注意，还建议通过禁用 Apache 选项来保护您的 Web 服务器
	<syntaxhighlight lang="ini">		<syntaxhighlight lang="ini">
	AcceptPathInfo Off		AcceptPathInfo Off
Line 85:		Line 85:
	'''页面与文件访问'''		'''页面与文件访问'''

	~~Pages and contents are protected by centralized entry code to check permissions (granted on groups or users for each functional module)~~ <sup>[4]</sup> <sup>[*10]</sup>.		页面和内容受集中式入口代码保护，以检查权限（授予组或用户的每个功能模块） <sup>[4]</sup> <sup>[*10]</sup> 。
	~~Files saved by~~ Dolibarr ~~are stored in a different~~ root ~~directory than web application (so they can't be downloaded without passing by the~~ Dolibarr ~~wrapper)~~ <sup>[3]</sup> <sup>[*10]</sup>~~. Note: You must check that you did not choose the "~~'''document'''~~" directory (for upload files) to be in same directory neither in a sub-directory than the "~~'''htdocs'''~~" directory. You web virtual host must point to the~~ htdocs ~~directory only (and this directoy can~~/~~should be in read only mode). So any uploaded file (stored into the~~ document ~~directory) can't be download without using the wrapper page.~~		Dolibarr 保存的文件存储在与 Web 应用不同的 root 目录中（因此，不通过 Dolibarr wrapper，就无法下载） <sup>[3]</sup> <sup>[*10]</sup> 。注意：您必须要核实 '''document''' 目录（用于上传文件）与 '''htdocs''' 目录没有位于同一目录中，也不在 '''htdocs''' 的子目录中。您的 Web 虚拟主机必须仅指向 htdocs 目录（并且此目录可以/应该处于只读模式）。因此，如果不使用 wrapper 页面，则无法下载任何上传的文件（存储在 document 目录中）。
	Dolibarr ~~directories content can't be accessed even if~~ Apache ~~option~~ Indexes ~~has been forgotten to on (should not)~~ <sup>[3]</sup>.		Dolibarr 目录内容无法访问，即使 Apache 的选项 Indexes 没有被设置为 on（不应该忘记设置） <sup>[3]</sup> 。


	'''登录保护'''		'''登录保护'''

	~~Delay anti brute force cracking on login page~~ <sup>[7]</sup>~~. Currently this delay is fixed (May be exponential with tries in a future version).~~		反暴力破解的登录页面延迟 <sup>[7]</sup> 。目前的延迟值是固定值（在未来版本中，尝试登录时可能会呈指数级增长）。
	~~Option for graphical code~~ (CAPTCHA) ~~against robots on login page~~ <sup>[7]</sup>.		登录页面上针对机器人的图形代码(CAPTCHA)选项 <sup>[7]</sup> 。
	~~Restrict access to backoffice for some~~ IP ~~only~~ <sup>[7]</sup>.		仅限制某些 IP 对后台的访问 <sup>[7]</sup> 。
	~~No passwords in logs, even in technical logs~~ <sup>[7]</sup>.		日志中不记录密码，即使在技术日志中也是如此 <sup>[7]</sup> 。
	*~~Internal~~ logger ~~to save permanently all Dolibarr events about user's administration and successful or failed logins or administration events (user or group or permission changes~~).		*内部记录器(logger)永久保存所有Dolibarr事件，包括有关用户管理以及成功登录、失败登录或管理事件（用户、组、权限的变更）。
	*~~Can output a log record into a log file (module Debug Log must be enabled with at least level~~ 5-~~LOG_NOTICE on production server, higher on development server) after success or failed login attempt so you can add a~~ fail2ban ~~rule to lock brute force cracking. You can check record with syntax~~ :		*可以在成功登录或失败登录尝试之后将日志记录输出到日志文件中（Debug Log模块必须被启用，在生产服务器上最低使用 5-LOG_NOTICE级别，在开发服务器上使用更高级别），以便您可以添加 fail2ban 规则来锁定暴力破解。您可以使用以下语法检查日志记录 :

	"YYYY-MM-DD HH:MM:SS (ERROR\|NOTICE\|INFO\|DEBUG) IP functions_dolibarr::check_user_password_.* Authentication KO"		"YYYY-MM-DD HH:MM:SS (ERROR\|NOTICE\|INFO\|DEBUG) IP functions_dolibarr::check_user_password_.* Authentication KO"
	~~A list of~~ fail2ban ~~rules to add to your server is provided on chapter~~ '''DOS and Brute force rate Mitigation''' ~~later.~~		要添加到服务器的 fail2ban 规则列表在后面的 '''DOS 和暴力破解率缓解(DOS and Brute force rate Mitigation)'''一章中提供。

	'''病毒'''		'''病毒'''

	~~Possibility to run an external anti-virus on every uploaded files~~ <sup>[3]</sup>.		可以对每个上传的文件运行外部防病毒软件 <sup>[3]</sup> 。


	'''安全信息中心'''		'''安全信息中心'''

	*~~From version~~ 14~~, you will find into menu~~ Home - Admin tools - Security~~, a security information center that report you all recommandations done and to do related to your installation.~~		*从版本 14 开始，您将在菜单主页 - 管理工具 - 安全(Home - Admin tools - Security) 中找到一个安全信息中心，其显示与当前安装相关的已完成和待完成的所有安全建议。


	'''用于安全性的 CTI'''		'''用于安全性的 CTI'''

	~~A continuous integration platform run Security unit tests and static code analysis on each modification of code.~~		持续集成平台对每次修改代码运行安全单元测试和静态代码分析。


	'''每个版本的footprint'''		'''每个版本的footprint'''

	~~Our release process bring each version with a~~ footprint ~~file (also available online) to validate all files of your local installation.~~		我们的发布流程为每个版本提供了一个 footprint 文件（也可在线获取），以验证本地安装的所有文件。

	~~Note: Dolibarr conforms to the~~ Best Practices ~~defined by the OpenSourceSSF~~: https://bestpractices.coreinfrastructure.org/projects/5521		注意：Dolibarr 符合 OpenSourceSSF 定义的 Best Practices(最佳实践) : https://bestpractices.coreinfrastructure.org/projects/5521


	'''DOS ~~and Brute force rate Mitigation~~'''		'''DOS 和暴力破解率缓解'''

	~~The project provide examples of some~~ fail2ban ~~rules to block brute force attempts or abusive access on login page, password forgotten page and on any public pages. See~~ https://github.com/Dolibarr/dolibarr/tree/develop/dev/setup/fail2ban		该项目提供了一些 fail2ban 规则的示例，以阻止登录页面、忘记密码页面和任何公共页面上的暴力尝试或滥用访问。参见 https://github.com/Dolibarr/dolibarr/tree/develop/dev/setup/fail2ban

	=[[File:art.png]] Report a security vulnerability=		=[[File:art.png]] Report a security vulnerability=

PolyglotBot: Updating interlang links (links to translated versions of this page in other languages) triggered by origin English page "Security_information" update.

2023-07-01T03:18:03Z

Updating interlang links (links to translated versions of this page in other languages) triggered by origin English page "Security_information" update.

← Older revision		Revision as of 03:18, 1 July 2023
Line 3:		Line 3:
	Links below are automatically managed by PolyglotBot		Links below are automatically managed by PolyglotBot
	You can edit links on the English source page : Security_information -->		You can edit links on the English source page : Security_information -->
	~~[[en:Security_information]]~~
	~~[[fr:Informations_sécurité]]~~
	~~[[es:Información_de_seguridad]]~~
	~~<!-- END interlang links -->~~

	~~<!-- BEGIN origin interlang links -->~~
	~~<!-- You can edit this section but do NOT remove these comments~~
	~~Links below will be automatically replicated on translated pages by PolyglotBot -->~~
	[[en:Security_information]]		[[en:Security_information]]
	[[fr:Informations_sécurité]]		[[fr:Informations_sécurité]]

ShengGang at 03:00, 1 July 2023

2023-07-01T03:00:03Z

← Older revision		Revision as of 03:00, 1 July 2023
Line 75:		Line 75:


	'''~~Hacks and cracks~~'''		'''黑客与骇客'''

	Works with register_globals on or off (off highly recommended) <sup>[2]</sup>.		Works with register_globals on or off (off highly recommended) <sup>[2]</sup>.
Line 91:		Line 91:


	'''~~Pages and files access~~'''		'''页面与文件访问'''

	Pages and contents are protected by centralized entry code to check permissions (granted on groups or users for each functional module) <sup>[4]</sup> <sup>[*10]</sup>.		Pages and contents are protected by centralized entry code to check permissions (granted on groups or users for each functional module) <sup>[4]</sup> <sup>[*10]</sup>.
Line 98:		Line 98:


	'''~~Login protection~~'''		'''登录保护'''

	Delay anti brute force cracking on login page <sup>[7]</sup>. Currently this delay is fixed (May be exponential with tries in a future version).		Delay anti brute force cracking on login page <sup>[7]</sup>. Currently this delay is fixed (May be exponential with tries in a future version).
Line 110:		Line 110:
	A list of fail2ban rules to add to your server is provided on chapter '''DOS and Brute force rate Mitigation''' later.		A list of fail2ban rules to add to your server is provided on chapter '''DOS and Brute force rate Mitigation''' later.

	'''~~Viruses~~'''		'''病毒'''

	Possibility to run an external anti-virus on every uploaded files <sup>[3]</sup>.		Possibility to run an external anti-virus on every uploaded files <sup>[3]</sup>.


	'''~~Security Information Center~~'''		'''安全信息中心'''

	*From version 14, you will find into menu Home - Admin tools - Security, a security information center that report you all recommandations done and to do related to your installation.		*From version 14, you will find into menu Home - Admin tools - Security, a security information center that report you all recommandations done and to do related to your installation.


	'''A CTI ~~for security~~'''		'''用于安全性的 CTI'''

	A continuous integration platform run Security unit tests and static code analysis on each modification of code.		A continuous integration platform run Security unit tests and static code analysis on each modification of code.


	'''~~A footprint for each version~~'''		'''每个版本的footprint'''

	Our release process bring each version with a footprint file (also available online) to validate all files of your local installation.		Our release process bring each version with a footprint file (also available online) to validate all files of your local installation.

ShengGang: 初始化

2023-07-01T02:48:16Z

初始化

← Older revision		Revision as of 02:48, 1 July 2023
Line 19:		Line 19:
	[[Category:Admin_en]]		[[Category:Admin_en]]

	=[[File:securite.png]] ~~Alerts~~=		=[[File:securite.png]] 警报=
	~~Last update~~: {{REVISIONYEAR}}-{{REVISIONMONTH}}-{{REVISIONDAY}}		最后更新: {{REVISIONYEAR}}-{{REVISIONMONTH}}-{{REVISIONDAY}}

	~~A vulnerability allowing a user to get the list of the contacts (retreiving the lastname, firstname and the id of contact in database) has been discovered.~~		发现了一个允许用户获取联系人列表（检索数据库中联系人的姓氏、名字和 ID）的漏洞。已经在 {{Template:SafeVersion}} 及更高版本中修复。
	~~Fix is available into~~ {{Template:SafeVersion}} ~~and higher versions.~~

	~~Note: You can also download from~~ GitHub ~~the '''intermediate''' versions (not yet released maintenance package) for all branches/version~~ (https://github.com/Dolibarr/dolibarr/)		注意：您还可以从 GitHub(https://github.com/Dolibarr/dolibarr/) 下载所有分支/版本的'''中间版本'''（尚未发布的维护包）

	=[[File:art.png]] ~~Security Features~~=		=[[File:art.png]] 安全特性=
	Dolibarr ~~implements several security features to match best practices rules related to security.~~		Dolibarr 实现了多种安全功能，以匹配与安全相关的最佳实践规则。

	~~This is a list of main security features you can find :~~		以下是您可以找到的主要安全功能列表：


	'''~~Encryption~~'''		'''加密'''

	~~Passwords or security keys data are encrypted in database~~ <sup>[7]</sup> <sup>[*8]</sup>.		数据库中保存的密码或安全密钥数据是加密之后的 <sup>[7]</sup> <sup>[*8]</sup>。
	~~The database technical password can be obfuscated into the~~ [[Configuration_file\|Dolibarr configuration file]] (conf.php) <sup>[8]</sup>.		数据库技术密码可以被伪装到 [[Configuration_file\|Dolibarr configuration file]] (conf.php) <sup>[8]</sup>文件中。
	~~Possibility to force~~ HTTPS <sup>[9]</sup>.		可以强制使用 HTTPS <sup>[9]</sup>。

	<syntaxhighlight lang="PHP">		<syntaxhighlight lang="PHP">
Line 53:		Line 52:
	0		0
	\| style="width:50%;" \|		\| style="width:50%;" \|
	~~No forced redirect~~		无强制重定向

	\|-		\|-
Line 59:		Line 58:
	1		1
	\| style="width:50%;" \|		\| style="width:50%;" \|
	~~Force redirect to https, until~~ SCRIPT_URI ~~start with~~ https ~~into response~~		强制重定向到 https，直到 response 中的 SCRIPT_URI 以 https 开头

	\|-		\|-
Line 65:		Line 64:
	2		2
	\| style="width:50%;" \|		\| style="width:50%;" \|
	~~Force redirect to https, until~~ SERVER[~~"HTTPS"~~] is 'on' ~~into response~~		强制重定向到 https，直到 response 中的 SERVER[“HTTPS”] = 'on'

	\|-		\|-
Line 71:		Line 70:
	https://mydomain		https://mydomain
	\| style="width:50%;" \|		\| style="width:50%;" \|
	~~Force redirect to the~~ https ~~domain name mydomain (recommended method)~~		强制重定向到 https 域名 mydomain（推荐方法）

	\|}		\|}

PolyglotBot: Adding interlang links (links to translated versions of this page in other languages) triggered by origin English page "Security_information" update.

2023-07-01T02:19:22Z

Adding interlang links (links to translated versions of this page in other languages) triggered by origin English page "Security_information" update.

← Older revision		Revision as of 02:19, 1 July 2023
Line 1:		Line 1:
			<!-- BEGIN interlang links -->
			<!-- Do NOT edit this section
			Links below are automatically managed by PolyglotBot
			You can edit links on the English source page : Security_information -->
			[[en:Security_information]]
			[[fr:Informations_sécurité]]
			[[es:Información_de_seguridad]]
			<!-- END interlang links -->

	<!-- BEGIN origin interlang links -->		<!-- BEGIN origin interlang links -->
	<!-- You can edit this section but do NOT remove these comments		<!-- You can edit this section but do NOT remove these comments

ShengGang: Created page with "