31,003
edits
Security information: Difference between revisions
m
no edit summary
mNo edit summary Tag: 2017 source edit |
mNo edit summary Tag: 2017 source edit |
||
| Line 88: | Line 88: | ||
*No passwords in logs, even in technical logs <sup>[*7]</sup>. | *No passwords in logs, even in technical logs <sup>[*7]</sup>. | ||
*Internal logger to save permanently all Dolibarr events about user's administration and successful or failed logins or administration events (user or group or permission changes). | *Internal logger to save permanently all Dolibarr events about user's administration and successful or failed logins or administration events (user or group or permission changes). | ||
*Can output a log record into a log file (module Debug Log must be enabled with at least level 5 - LOG_NOTICE) after success or failed login attempt so you can add a fail2ban rule to lock brute force cracking. You can check record with syntax : | *Can output a log record into a log file (module Debug Log must be enabled with at least level 5-LOG_NOTICE on production server, higher on development server) after success or failed login attempt so you can add a fail2ban rule to lock brute force cracking. You can check record with syntax : | ||
"YYYY-MM-DD HH:MM:SS (ERROR|NOTICE|INFO|DEBUG) IP functions_dolibarr::check_user_password_.* Authentication KO" | "YYYY-MM-DD HH:MM:SS (ERROR|NOTICE|INFO|DEBUG) IP functions_dolibarr::check_user_password_.* Authentication KO" | ||