{"id":996,"date":"2015-03-24T07:34:26","date_gmt":"2015-03-24T07:34:26","guid":{"rendered":"http:\/\/invisiblezero.net\/?p=996"},"modified":"2024-07-22T09:30:08","modified_gmt":"2024-07-22T09:30:08","slug":"magento-secure-your-webshop","status":"publish","type":"post","link":"http:\/\/ndthanh.com\/magento-secure-your-webshop\/","title":{"rendered":"Magento – Secure your webshop"},"content":{"rendered":"
Recently , i have been working on security aspects of Magento and Server (centos,ubuntu ..) to help my clients secure their webshops, so i have prepared a security plan . perhaps you can find useful information here .<\/div>\n

<\/p>\n

Part 1. Integrity Check<\/b><\/div>\n
– Core code check : check to make sure core files are similar to default Magento installation core files .
\n– Lib directory check : Lib directory contains Varien libraries, Zend Framework and other 3rd party stuffs<\/div>\n
– Git log check :\u00a0if you are using git, then reviewing git log regularly is a good idea.<\/div>\n
– Public accessible directories : Check for big files in \/media and \/var , check file type to make sure they’re not fake (imagemagick to check images, ffmpeg to check video files, qpdf to check pdf files , etc..) . Hackers often extract content to these directories so they can download easy later , that’s why we do this type of checking. i have a script for this type of work and i will post it in another post soon \ud83d\ude42<\/div>\n
<\/div>\n
Part 2. Magento Tunning<\/b><\/div>\n
A – Tighten up security<\/div>\n
– Change admin login path : \/index.php\/admin is a well known path, Hackers always try this first to find login path, this should be changed into something else.
\n– Lower Admin session life time : With this changes, you can reduce risk from cookie thief by XSS or someone use your computer to login backend.
\n– Use Long & complex admin user\/password : This one is solution for password brute force attack
\n– Enable captcha : you can enable it from backend . So bot or script won’t work anymore.
\n– Install Admin Logger extension (this is a feature from Magento EE). http:\/\/www.magpleasure.com\/admin-logger.html<\/a>
\n– Check for Security Patch weekly : Magento often release patches to fix security vulnerabilities , it’s good to have your code up-to-date.<\/div>\n
– Setup 2-factor authentication , there are extensions for this from Magento marketplace.<\/div>\n
–\u00a0Use HTTPS\/SSL for all login pages.<\/div>\n
–\u00a0Disable Magento Connect Manager tool : this utility is not really necessary and it is another way to get in your website.<\/div>\n
–\u00a0Stop using untrusted Magento Extensions<\/div>\n
<\/div>\n
B – Prepare for disaster<\/div>\n
– Use Magento extensions that allow export orders\/customers\/products\/categories and encrypt them for recovery purposes.
\n– Design a better \u2018Store undergoing scheduled maintenance\u2019 page to use it when we\u2019re going to do disaster recovery. Stop using Magento default maintenance page.
\n– re-design error reporting page : remove trace of Magento error reporting file and turn make it match your webshop design.<\/div>\n
<\/div>\n
Part 3.\u00a0<\/b>Server Tunning<\/b><\/div>\n
A – Data Base
\n<\/span>– Grant minimum access previledges to database users : do not use root credentials for your database.
\n– Use different user\/password for different databases : with this setup, other website will be safe if one of your websites is compromised.
\n– setup firewall to limit only internal access. disable public access : database should only be accessible from your server, never open it to public.B – Apache & PHP
\n<\/span>– Use production mode for error reporting : with this setup , you won’t see error throwing on your live environment. There are a lot of website that leave error reporting for live site, so once error happen, people will see error and path to your website on server.
\n– Use correct file permission , it should be 644 or 664 for source files : do not use 777 permission for your files unless it’s cache or temporary files
\n– Limit file upload : file upload will be exploit a lot, so you will need to validate file upload carefully.
\n– Limit access to development environments : if you have dev site or staging site, remember to set .htpasswd for them, so web scraper like google , bing or your customer won’t see content on your development sites.<\/div>\n
<\/div>\n
B1 – Increase security via .htacess file\u00a0<\/span>
\n– turn off server signature
\n– disable directory listing
\n– force index.php as directory index
\n– deny access to protected server files and folders : htaccess, htpasswd, errordocs, logs ..etc..
\n– add request methods filter to prevent these request types : HEAD, TRACE, DELETE, TRACK, DEBUG
\n– only allow internal file request from internal server\/website
\n– deny browser access to php.ini, xml files, config files and readme files<\/div>\n
<\/div>\n
B2 – Nginx<\/span><\/div>\n
– make sure you have the same security or better as described above. there are some tools online that support conversion between Apache config and Nginx config.<\/div>\n
<\/div>\n
C – Server & Scripts
\n<\/span>– Use VPN to connect to main server\u00a0 (limit ip address to VPN server only) : this is a strong approach to secure your server, it gives you complete control to users who are allowed to work with your server.
\n– Daily database backup
\n– Daily media backup (incremental backup)
\n– Daily check for website integrity.
\n– Setup Antivirus software : it’s important for Windows server. if you’re using Linux, you can use ClamAV which is also good for scanning bad files and scripts on your server.
\n– If FTP is required, use SFTP for file transfer
\n– Update server software, kernels regularly<\/div>\n
<\/div>\n
Part 4. Coding principle – this one is for developers
\n<\/b>– Never trust user input, always check, validate and escape if you\u2019re working on feature that contain input fields\/upload fields.
\n– Test code properly to make sure it won\u2019t display error log on front-end . the error log
\n– notify\/update to latest version of MagentoPart 5. Admin Tips<\/b>
\n– never use admin username\/password for anything else
\n– don\u2019t save password on computer or notes
\n– use Private\/company email address for admin instead of gmail\/hotmail\/etc..<\/p>\n

– request for PCI compliance tests<\/p>\n

i hope this article will help you to enhance your website security. Please post your comment if you have any question<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Recently , i have been working on security aspects of Magento and Server (centos,ubuntu ..) to help my clients secure their webshops, so i have prepared a security plan . perhaps you can find useful information here . Part 1. Integrity Check – Core code check : check to make sure core files are similar…<\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":1479,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[57,67,44,66],"tags":[],"aioseo_notices":[],"views":12,"_links":{"self":[{"href":"http:\/\/ndthanh.com\/wp-json\/wp\/v2\/posts\/996"}],"collection":[{"href":"http:\/\/ndthanh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/ndthanh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/ndthanh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/ndthanh.com\/wp-json\/wp\/v2\/comments?post=996"}],"version-history":[{"count":2,"href":"http:\/\/ndthanh.com\/wp-json\/wp\/v2\/posts\/996\/revisions"}],"predecessor-version":[{"id":1301,"href":"http:\/\/ndthanh.com\/wp-json\/wp\/v2\/posts\/996\/revisions\/1301"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/ndthanh.com\/wp-json\/wp\/v2\/media\/1479"}],"wp:attachment":[{"href":"http:\/\/ndthanh.com\/wp-json\/wp\/v2\/media?parent=996"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/ndthanh.com\/wp-json\/wp\/v2\/categories?post=996"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/ndthanh.com\/wp-json\/wp\/v2\/tags?post=996"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}