Advanced Security Features
To configure logging:
By default, all available modules are logged. To configure which modules are logged, navigate to
System > Configuration, click the Admin tab in the left column, and select the Events Logging section. Locate the module you wish to edit and select Yes to enable it or No to disable it.
Additionally, you can control how long the log entries are stored and how often they are archived.
To edit these settings, click on the System tab in the left column and select the Event Log Archiving section.
Save Log, days - Determines how long the log entries are stored in the database before being removed. If there are many administrators working on the site, you can change this value from the default (60 days) to a lower value to avoid filling the capacity of the database.
Log Archiving Frequency - Determines how often old events are saved to the archive.
Possible values are Daily, Weekly or Monthly.
Note: For log cleaning to work, the Magento cron job has to be set up. More information is available here: http://www.magentocommerce.com/wiki/how_to/ how_to_setup_a_cron_job
Logs Report
To view the actual log of admin actions, navigate to System > Admin Actions Log > Report. This page is in a grid format, enabling you to sort and filter by values such as timestamp, IP address, user name, and module. If applicable, the Item_id column will display the ID of an affected item, such as customer ID, order ID, or product ID. The log report can be exported to CSV or XML using the
Export to drop-down menu and Export button.
Logs Archive
To access the log archive files, navigate to System > Admin Logging > Archive. This page lists the
CSV log files stored in
var/admin_logs
. By default, the file name will contain the current date in the format (iso) yyyyMMddHH.csv. File names are hyperlinked to download the appropriate file.
38.4 Setting Administrator Password Security Levels
There is a set of options controlling administrator password security. The following settings are available by navigating to System > Configuration, clicking the Admin tab in the left column, and selecting the Security section:
Maximum Login Failures to Lockout Account - Determines the number of consecutive failed login attempts that will cause that account to become locked. If you do not want to enable the lockout feature, leave this field blank.
Lockout Time (minutes) – Determines the duration, in minutes, for which the account will be locked after the failed logins.
363
Advanced Security Features
Password Lifetime (days) - Determines the duration, in days, until Magento will request an administrator to change their password. If you do not want to enable the password lifetime feature, leave this field blank.
Password Change - Determines if the administrator is required to change their password after the password expires (option Forced), or if the password change is optional and a notification message is displayed (option Recommended).
Note: During an account lockout, other administrators can unlock the account by navigating to System > Permissions > Locked Users.
364
Advanced Design and Content Management
39 Advanced Design and Content Management
This chapter introduces some of Enterprise Edition’s functionality to support working with your design and content. The biggest enhancement over our Community Edition functionality is the ability to create content staging websites that allow you to stage and preview content and design changes in your production environment without making those changes live. Some of primary uses of content staging include data entry, preparing seasonal layout and data changes, and building new CMS content.
Chapter Quick Reference
The table below lists some of the most common tasks using EE’s design and content staging enhancements and where to go in the Admin Panel to perform them. The sections that follow provide step-by-step instructions on each.
TASK
To configure content staging
To create a staging website
To merge content from a staging website to a live site
To roll back a content merge
ADMIN MENU
System > Configuration > General tab
System > Content Staging > Staging Websites
System > Content Staging > Staging Websites
To change the favicon
System > Content Staging > Backups
System > Configuration > Design
39.1 Content Staging
In order to effectively use content staging, it is necessary to understand a little bit about how it works in Magento. Content staging websites are created as hidden or beta websites that can be accessed via a special, password-protected URL. They can have the same domain as the live store or on a separate domain, but they run on the same Magento installation and database as your live site.
In the Admin Panel, staging websites are accessed and used in the same way as normal websites.
You create, edit, and delete content and products in exactly the same way. Setting the Configuration
Scope as you work determines which site you’re working on—a staging site or a live site.
When your changes are done and approved you can merge the staging website with the live website and do not have to re-enter data or configuration changes. During merging, all the content assigned to the staging website will become assigned to the live website, and all attributes on the staging website/store view level will be copied to the matching live website/store view. All mapping and content selection details can be controlled by the administrator, so only the content and content types you want will be merged. Additionally, during merging, a rollback (backup) can be created.
365
