安全信息: Difference between revisions

From Dolibarr ERP CRM Wiki
Jump to navigation Jump to search
VisualWikitext
m (Adding interlang links (links to translated versions of this page in other languages) triggered by origin English page "Security_information" update.)
(初始化)
Line 19: Line 19:
[[Category:Admin_en]]
[[Category:Admin_en]]


=[[File:securite.png]] Alerts=
=[[File:securite.png]] 警报=
Last update: {{REVISIONYEAR}}-{{REVISIONMONTH}}-{{REVISIONDAY}}
最后更新: {{REVISIONYEAR}}-{{REVISIONMONTH}}-{{REVISIONDAY}}


A vulnerability allowing a user to get the list of the contacts (retreiving the lastname, firstname and the id of contact in database) has been discovered.
发现了一个允许用户获取联系人列表（检索数据库中联系人的姓氏、名字和 ID）的漏洞。 已经在 {{Template:SafeVersion}} 及更高版本中修复。
Fix is available into {{Template:SafeVersion}} and higher versions.


Note: You can also download from GitHub the '''intermediate''' versions (not yet released maintenance package) for all branches/version (https://github.com/Dolibarr/dolibarr/)
注意：您还可以从 GitHub(https://github.com/Dolibarr/dolibarr/) 下载所有分支/版本的'''中间版本'''（尚未发布的维护包）


=[[File:art.png]] Security Features=
=[[File:art.png]] 安全特性=
Dolibarr implements several security features to match best practices rules related to security.
Dolibarr 实现了多种安全功能，以匹配与安全相关的最佳实践规则。
   
   
This is a list of main security features you can find :
以下是您可以找到的主要安全功能列表：




'''Encryption'''
'''加密'''


*Passwords or security keys data are encrypted in database <sup>[*7]</sup> <sup>[*8]</sup>.
*数据库中保存的密码或安全密钥数据是加密之后的 <sup>[*7]</sup> <sup>[*8]</sup>。
*The database technical password can be obfuscated into the [[Configuration_file|Dolibarr configuration file]] (conf.php) <sup>[*8]</sup>.
*数据库技术密码可以被伪装到 [[Configuration_file|Dolibarr configuration file]] (conf.php) <sup>[*8]</sup>文件中。
*Possibility to force HTTPS <sup>[*9]</sup>.
*可以强制使用 HTTPS <sup>[*9]</sup>。


<syntaxhighlight lang="PHP">
<syntaxhighlight lang="PHP">
Line 53: Line 52:
0
0
| style="width:50%;" |
| style="width:50%;" |
No forced redirect
无强制重定向


|-
|-
Line 59: Line 58:
1
1
| style="width:50%;" |
| style="width:50%;" |
Force redirect to https, until SCRIPT_URI start with https into response
强制重定向到 https，直到 response 中的 SCRIPT_URI 以 https 开头


|-
|-
Line 65: Line 64:
2
2
| style="width:50%;" |
| style="width:50%;" |
Force redirect to https, until SERVER["HTTPS"] is 'on' into response
强制重定向到 https，直到 response 中的 SERVER[“HTTPS”] = 'on'


|-
|-
Line 71: Line 70:
https://mydomain
https://mydomain
| style="width:50%;" |
| style="width:50%;" |
Force redirect to the https domain name mydomain (recommended method)
强制重定向到 https 域名 mydomain（推荐方法）


|}
|}

Revision as of 02:48, 1 July 2023


Securite.png 警报

最后更新: 2023-07-1

发现了一个允许用户获取联系人列表（检索数据库中联系人的姓氏、名字和 ID）的漏洞。 已经在 18.0.1 及更高版本中修复。

注意：您还可以从 GitHub(https://github.com/Dolibarr/dolibarr/) 下载所有分支/版本的中间版本（尚未发布的维护包）

Art.png 安全特性

Dolibarr 实现了多种安全功能，以匹配与安全相关的最佳实践规则。

以下是您可以找到的主要安全功能列表：


加密

  • 数据库中保存的密码或安全密钥数据是加密之后的 [*7] [*8]。
  • 数据库技术密码可以被伪装到 Dolibarr configuration file (conf.php) [*8]文件中。
  • 可以强制使用 HTTPS [*9]。
//conf/conf.php file
//example of $dolibarr_main_force_https  configuration
$dolibarr_main_force_https = '1';//to force https
Values Description

0

无强制重定向

1

强制重定向到 https，直到 response 中的 SCRIPT_URI 以 https 开头

2

强制重定向到 https，直到 response 中的 SERVER[“HTTPS”] = 'on'

https://mydomain

强制重定向到 https 域名 mydomain（推荐方法）


Hacks and cracks

  • Works with register_globals on or off (off highly recommended) [*2].
  • Works with PHP safe_mode on or off (on recommended) [*3].
  • Production mode to disable any technical information leakage like debug, error stacktrace, version informations (See configuration file) [*6].
  • Protection against SQL injection. Protected by an Internal WAF, and unit test to check database good practice for escapement. [*2].
  • Protection against XSS injection (Cross Site Scripting). Protected by an internal WAF and web page headers. [*1].
  • Protection against SSRF.
  • Protection against CSRF (Cross Site Request Forgery). Protected by an internal WAF and a token system. [*5].

Note that it is also recommended to protect your web server by disabled Apache option 

AcceptPathInfo Off


Pages and files access

  • Pages and contents are protected by centralized entry code to check permissions (granted on groups or users for each functional module) [*4] [*10].
  • Files saved by Dolibarr are stored in a different root directory than web application (so they can't be downloaded without passing by the Dolibarr wrapper) [*3] [*10]. Note: You must check that you did not choose the "document" directory (for upload files) to be in same directory neither in a sub-directory than the "htdocs" directory. You web virtual host must point to the htdocs directory only (and this directoy can/should be in read only mode). So any uploaded file (stored into the document directory) can't be download without using the wrapper page.
  • Dolibarr directories content can't be accessed even if Apache option Indexes has been forgotten to on (should not) [*3].


Login protection

  • Delay anti brute force cracking on login page [*7]. Currently this delay is fixed (May be exponential with tries in a future version).
  • Option for graphical code (CAPTCHA) against robots on login page [*7].
  • Restrict access to backoffice for some IP only [*7].
  • No passwords in logs, even in technical logs [*7].
  • Internal logger to save permanently all Dolibarr events about user's administration and successful or failed logins or administration events (user or group or permission changes).
  • Can output a log record into a log file (module Debug Log must be enabled with at least level 5-LOG_NOTICE on production server, higher on development server) after success or failed login attempt so you can add a fail2ban rule to lock brute force cracking. You can check record with syntax :
"YYYY-MM-DD HH:MM:SS (ERROR|NOTICE|INFO|DEBUG)    IP functions_dolibarr::check_user_password_.* Authentication KO"

A list of fail2ban rules to add to your server is provided on chapter DOS and Brute force rate Mitigation later.

Viruses

  • Possibility to run an external anti-virus on every uploaded files [*3].


Security Information Center

  • From version 14, you will find into menu Home - Admin tools - Security, a security information center that report you all recommandations done and to do related to your installation.


A CTI for security

A continuous integration platform run Security unit tests and static code analysis on each modification of code.


A footprint for each version

Our release process bring each version with a footprint file (also available online) to validate all files of your local installation.

Note: Dolibarr conforms to the Best Practices defined by the OpenSourceSSF: https://bestpractices.coreinfrastructure.org/projects/5521


DOS and Brute force rate Mitigation

The project provide examples of some fail2ban rules to block brute force attempts or abusive access on login page, password forgotten page and on any public pages. See https://github.com/Dolibarr/dolibarr/tree/develop/dev/setup/fail2ban

Art.png Report a security vulnerability

In most cases, security reports are processed in few days only.


(*X) This solution is part of protection used to solve vulnerabilities classified by the OWASP Top Ten at range number X.

Retrieved from "https://wiki.dolibarr.org/index.php?title=安全信息&oldid=56951"