31,003
edits
Security information: Difference between revisions
m
→File:art.png Security Features
mNo edit summary Tag: 2017 source edit |
Tag: 2017 source edit |
||
| Line 29: | Line 29: | ||
==Encryption== | |||
*Passwords or security keys data are encrypted in database <sup>[*7]</sup> <sup>[*8]</sup>. | *Passwords or security keys data are encrypted in database <sup>[*7]</sup> <sup>[*8]</sup>. | ||
| Line 72: | Line 72: | ||
==Features Anti Hacks and cracks== | |||
*Works with PHP register_globals on or off (off highly recommended) <sup>[*2]</sup>. | *Works with PHP register_globals on or off (off highly recommended) <sup>[*2]</sup>. | ||
| Line 81: | Line 81: | ||
*Protection against SSRF. All access to an URL uses the getURLContent() method into core/lib/geturl.lib.php that brings this protection. | *Protection against SSRF. All access to an URL uses the getURLContent() method into core/lib/geturl.lib.php that brings this protection. | ||
*Protection against CSRF (Cross Site Request Forgery). Protected by an internal WAF and a token system (with several level of renewal policies, by session or by page). <sup>[*5]</sup>. | *Protection against CSRF (Cross Site Request Forgery). Protected by an internal WAF and a token system (with several level of renewal policies, by session or by page). <sup>[*5]</sup>. | ||
*Application features for quotas (upload limits, file extensions, file sizes, etc.) | |||
Note that it is also recommended to protect your web server by disabling the Apache option | Note that it is also recommended to protect your web server by disabling the Apache option | ||
| Line 88: | Line 89: | ||
==Pages and files access== | |||
*Pages and contents are protected by centralized entry code to check permissions (granted on groups or users for each functional module) <sup>[*4]</sup> <sup>[*10]</sup>. | *Pages and contents are protected by centralized entry code to check permissions (granted on groups or users for each functional module) <sup>[*4]</sup> <sup>[*10]</sup>. | ||
| Line 95: | Line 96: | ||
==Login protection== | |||
*Delay anti brute force cracking on login page <sup>[*7]</sup>. Currently this delay is fixed (May be exponential with tries in a future version). | *Delay anti brute force cracking on login page <sup>[*7]</sup>. Currently this delay is fixed (May be exponential with tries in a future version). | ||
| Line 108: | Line 109: | ||
==Viruses== | |||
*Possibility to run an external anti-virus on every uploaded files <sup>[*3]</sup>. | *Possibility to run an external anti-virus on every uploaded files <sup>[*3]</sup>. | ||
==Security Information Center== | |||
*From version 14, you will find into menu Home - Admin tools - Security, a security information center that report you all recommandations done and to do related to your installation. | *From version 14, you will find into menu Home - Admin tools - Security, a security information center that report you all recommandations done and to do related to your installation. | ||
==A CTI for security== | |||
A continuous integration platform run Security unit tests and static code analysis on each modification of code. | A continuous integration platform run Security unit tests and static code analysis on each modification of code. | ||
==A footprint for each version== | |||
Our release process bring each version with a footprint file (also available online) to validate all files of your local installation and detect any change on any file with the integrated tool available in menu Home - Administration - Security. | Our release process bring each version with a footprint file (also available online) to validate all files of your local installation and detect any change on any file with the integrated tool available in menu Home - Administration - Security. | ||
==DOS and Brute force rate Mitigation== | |||
*Embedded AntiDOS features with quota on public action per IP. | *Embedded AntiDOS features with quota on public action per IP. | ||
| Line 135: | Line 136: | ||
==OpenSourceSSF== | |||
Dolibarr conforms to the Best Practices defined by the OpenSourceSSF: https://bestpractices.coreinfrastructure.org/projects/5521 | Dolibarr conforms to the Best Practices defined by the OpenSourceSSF: https://bestpractices.coreinfrastructure.org/projects/5521 | ||