CHAPTER 78: Security. Magento 2.1
विज्ञापन
विज्ञापन
CHAPTER 78:
Security
In this section of the guide, you will learn security best practices, how to manage Admin sessions and credentials, implement CAPTCHA, and manage website restrictions.
l
l
l
l
l
Browser Capabilities Detection
l
Stop by the Security Center and sign up for the Security Alert Registry to receive the latest information on potential vulnerabilities and best practices.
Security Center
Magento Community Edition 2.1 User Guide 1049
Security Best Practices CHAPTER 78: Security
Security Best Practices
All eCommerce sites are attractive targets to hackers because of the personal and payment information that is required to complete a sale. Even if the system does not directly process credit card transactions, a compromised site might reroute customers to a false page, or alter an order before it is transmitted to the payment processor.
A compromised site can have long-term consequences for both customers and merchants.
Customers might suffer financial loss and identify theft, while merchants can face damage to their reputations, loss of merchandise, higher processing fees, revoked privileges with financial institutions, and the threat of lawsuits.
This guide outlines a multifaceted approach to improve the security of your Magento installation. Although there is no single way to eliminate all security risks, there are many things that you can do to make your site a less attractive target. It is crucial for hosting providers, system integrators, and merchants to work together to establish and maintain a secure environment, implement methods for early detection, and determine a plan of action in the event of a breach.
Start Right
Work with reliable hosting providers and solution integrators. When evaluating their qualifications, ask about their approach to security. Verify that they have a secure software development life cycle in accord with industry standards such as The Open Web Application
Security Project ( OWASP ), and that they test their code for security issues.
If you are starting a new site, consider launching the entire site over HTTPs. Taking the lead on this issue, Google now uses HTTPs as a ranking factor.
For an existing installation, plan to upgrade the entire site to run over to a securely encrypted,
HTTPs channel. Although you will need to create redirects from HTTP to HTTPs, the effort will future-proof your site. We recommend that you plan to make this change sooner, rather than later.
1050 Magento Community Edition 2.1 User Guide
CHAPTER 78: Security Security Best Practices
Protect the Environment
Protecting the environment is the most critical aspect of ensuring the security of your store.
Keep all software on the server up to date, and apply security patches as recommended. This applies not only to Magento, but to any other software that is installed on the server, including database software and other websites that use the same server. Any system is only as secure as the weakest link.
Server Environment
Make sure that the server operating system is secure. Work with your hosting provider to ensure that there is no unnecessary software running on the server.
Use only secure communications protocol (SSH/SFTP/HTTPS) to manage files, and disable FTP.
Magento includes .htaccess files to protect system files when using the Apache web server. If you use a different web server such as Nginx, make sure that all system files and directories are protected. For an sample Nginx configuration, see: magentonginx.conf
on GitHub.
Use strong and unique passwords, and change them periodically.
Keep the system up to date, and immediately install patches when new security issues are discovered.
Closely monitor any issues that are reported for software components used by your
Magento installation, including the operating system, MySQL database, PHP, Redis (if used), Apache or Nginx, Memcached, Solr, and any other components in your specific configuration.
Limit access to cron.php file to only required users. For example, restrict access by IP address. If possible, block access completely and execute the command using the system cron scheduler.
Advanced Techniques
Automate the deployment process, if possible, and use private keys for data transfer.
Limit access to the Magento Admin by updating the whitelist with the IP address of each computer that is authorized to use the Admin and Magento Connect downloader. For examples of how to whitelist IP addresses, see: Secure Your Magento Admin .
Do not install extensions directly on a production server.
To disable the Magento Connect downloader on the production site, either remove or block access to the /downloader directory. You can also use the same whitelisting methods.
Magento Community Edition 2.1 User Guide 1051
Security Best Practices CHAPTER 78: Security
Advanced Techniques (cont.)
Use two-factor authorization for Admin logins. There are several extensions available that provide additional security by requiring an additional passcode that is generated on your phone, or a token from a special device.
Review your server for “development leftovers.” Make sure there are no accessible log files, publicly visible .git directories, tunnels to execute SQL, database dumps, phpinfo files,or any other unprotected files that are not required, and that might be used in an attack.
Limit outgoing connections to only those that are required, such as for a payment integration.
Use a Web Application Firewall to analyze traffic and discover suspicious patterns, such as credit card information being sent to an attacker.
Server Applications
Make sure that all applications running on the server are secure.
Avoid running other software on the same server as Magento, especially if it is accessible from the Internet. Vulnerabilities in blog applications such as Wordpress can expose private information from Magento. Install such software on a separate server or virtual machine.
Keep all software up to date, and apply patches as recommended.
Admin Desktop Environment
Make sure that the computer that is used to access the Magento Admin is secure.
Keep your antivirus software up to date, and use a malware scanner. Do not install any unknown programs, or click suspicious links.
Use a strong password to log in to the computer, and change it periodically. Use a password manager such as LasstPass , 1Password , or Dashlane to create and manage secure, unique passwords.
Do not save FTP passwords in FTP programs, because they are often harvested by malware and used to infect servers.
1052 Magento Community Edition 2.1 User Guide
CHAPTER 78: Security Security Best Practices
Protect Magento
Your effort to protect your Magento installation starts with the initial setup, and continues with the security-related configuration settings, password management, and ongoing maintenance.
Your Magento Installation
Use the latest version of Magento to ensure that your installation includes the most recent security enhancements.
If for any reason you cannot upgrade to the latest version, make sure to install all security patches as recommended by Magento. Although Magento issues security patches to fix major issues, new product releases include additional improvements to help secure the site.
Use a unique, custom Admin URL instead of the default “admin” or the often-used
“backend,” Although it will not directly protect your site from a determined attacker, it can reduce exposure to scripts that try to break into every Magento site. (Never leave your valuables in plain sight.)
Check with your hosting provider before implementing a custom Admin URL. Some hosting providers require a standard URL to meet firewall protection rules.
Block access to any development, staging, or testing systems. Use IP whitelisting and
.htaccess password protection. When compromised, such systems can produce a data leak or be used to attack the production system.
Use the correct file permissions. Core Magento and directory files should be set to ready only, including app/etc/local.xml files.
Use a strong password for the Magento Admin. To learn more, see: Creating a strong password .
Take advantage of Magento’s security-related configuration settings for Admin Security ,
Password Options , and CAPTCHA .
Don’t be Taken for a Ride
Install extensions only from trusted sources. Never use paid extensions that are published on torrent or other sites. If possible, review extensions for security issues before installing them.
Do not click suspicious links, or open suspicious email.
Do not disclose the password to your server or to the Magento Admin, unless you are required to do so.
Magento Community Edition 2.1 User Guide 1053
Security Best Practices CHAPTER 78: Security
Be Prepared!
Develop a disaster recovery/business continuity plan. Even a basic plan will help you get back on track in the event of a problem.
Ensure that your server and database are automatically backed up to external location. A typical setup requires daily incremental backups, with a full backup on a weekly basis.
Make sure to test the backup regularly to verify that it can be restored.
For a large site, simple text file dumps of the database take an unacceptable amount of time to restore. Work with your hosting provider to deploy a professional database backup solution.
Monitor for Signs of Attack
If your system is not immediately patched after a major security breach, there is a high probability that your site is already compromised. Complete a security review periodically to check for signs of attack, and also when contacted by customers with security-related concerns.
Security Review
Check periodically for unauthorized Admin users.
(Magento Enterprise only) Check the Admin Actions Log for suspicious activity.
Use automated log review tools such as Apache Scalp .
Work with your hosting provider to review server logs for suspicious activity, and to implement an Intrusion Detection System (IDS) on your network.
Use a file and data integrity checking tool such as TripWire to receive notification of any potential malware installation.
Monitor all system logins (FTP, SSH) for unexpected activity, uploads, or commands.
1054 Magento Community Edition 2.1 User Guide
CHAPTER 78: Security Security Best Practices
Follow Your Disaster Recovery Plan
In the event of a compromise, work with your internal IT security team if available, or hosting provider, and system integrator to determine the scope of the attack. Taking into consideration the type of compromise and the size of the store. Then, adjust the following recommendations to your business needs.
1.
Block access to the site, so the attacker cannot remove evidence or steal more information.
2.
Backup the current site, which will include evidence of the installed malware or compromised files.
3.
Try to determine the scope of the attack. Was credit card information accessed? What information was stolen? How much time has elapsed since the compromise? Was the information encrypted? Typically you can expect the following types of attack:
Defacing of Site
Botnetting
Direct Attack on Server
Silent Card Capture
Site access is compromised, but often the payments information is not. User accounts might be compromised.
Your site becomes part of a botnet that sends spam email.
Although data is probably not compromised, your server is blacklisted by spam filters which prevents email that you send to customers from being delivered.
Data is compromised, backdoors and malware are installed, and the site no longer works. Payment information—provided that it is not stored on the server— is probably safe.
In this most disastrous attack, intruders install hidden malware or card capture software, or possibly modify the checkout process to collect and send out credit card data. Such attacks can go unnoticed for extended periods of time, and result in major compromise of customer accounts and financial information.
4.
Try to find the attack vector to determine how the site was compromised, and when. Review server log files and file changes. Note that sometimes there are multiple different attacks on the same system.
5.
If possible, wipe and reinstall everything. In case of virtual hosting, create a new instance.
Malware might be hidden in an unsuspected location, just waiting to restore itself. Remove all unnecessary files. Then, reinstall all required files from a known, clean source such as files from your own version control system, or the original distribution files from magento.com.
6.
Apply all the latest security patches necessary.
7.
Reset all credentials, including the database, file access, payment and shipping integrations, web services, and Admin login.
Magento Community Edition 2.1 User Guide 1055
Security Best Practices CHAPTER 78: Security
8.
If payment information was compromised, it might be necessary to inform your payment processor.
9.
Inform your customers about the attack and the type of information affected. If payment information was compromised, they should look for unauthorized transactions. If personal information, including email addresses was compromised, they might be targeted with phishing attacks or spam.
Acknowledgments
Parts of this article were inspired by real-world solutions that were shared by community members. The resulting article incorporates content from the community, with input from our team.
l
Bryan (BJ) Hoffpauir for sharing his insight on the Magento forum, and for contributing recommendations in the Attack Response Plan section of this article. See the original post by beejhuff for more information.
l
Anna Völkl (@rescueann), Magento developer at LimeSoda.
l
Robert Mangiafico (@robfico) CTO at LexiConn.
l
@dracony_gimp for his security presentation, Being Hacked is Not Fun .
l
Willem de Groot for providing a sample Nginx configuration .
1056 Magento Community Edition 2.1 User Guide
CHAPTER 78: Security Configuring Admin Security
Configuring Admin Security
Magento recommends that you take a multifaceted approach to protect the security of your store. You can begin by using a
that is not easy to ascertain, rather than the obvious “Admin” or “Backend.” .As a best practice , use only strong Admin passwords that include a combination of letters, numbers, and symbols. For increased security, consider implementing two-factor authentication that generates a token on a separate device. To learn more, see the selection of security-related extensions on Magento Marketplace .
The Admin security configuration gives you the ability to add a secret key to URLs, require passwords to be case sensitive, and to limit the length of Admin sessions, the lifetime of passwords, and the number of login attempts that can be made before the Admin user account is
locked . For increased security, you can configure the length of keyboard inactivity before the
current session expires, and require the user name and password to be case-sensitive. For additional security, the Admin login can be configured to require a
Magento Community Edition 2.1 User Guide
Security
1057
Configuring Admin Security CHAPTER 78: Security
To configure Admin security:
1.
On the Admin sidebar, tap Stores. Then under Settings, choose Configuration.
2.
In the panel on the left under Advanced, choose Admin.
3.
Expand the Security section. Then, do the following:
a.
To prevent Admin users from logging in from the same account on different devices, set
Admin Account Sharing
to "No."
b.
To determine the method that is used to manage password reset requests, set Password
Reset Protection Type
to one of the following:
By IP and Email
By IP
By Email
The password can be reset online after a response is received from the notification is sent to the email address associated with the Admin account.
The password can be reset online without additional confirmation.
The password can be reset only by responding by email to the notification that is sent to the email address associated with the Admin account.
The password can be reset only by the store administrator.
None
c.
In the Recovery Link Expiration Period (hours) field, enter the number of hours a password recovery link remains valid.
d.
To determine the maximum number of password requests that can be submitted per hour, enter the Max Number of Password Reset Requests.
e.
In the Min Time Between Password Reset Requests field, enter the minimum number of minutes that must pass between password reset requests.
f.
To append a secret key to the Admin URL as a precaution against exploits, set Add Secret
Key to URLs
to “Yes.” This setting is enabled by default.
g.
To require that the use of upper- and lowercase characters in any login credentials entered match what is stored in the system, set Login is Case Sensitive to “Yes.”
h.
To determine the length of an Admin session before it times out, enter the duration of the session in seconds, in the Admin Session Lifetime (seconds) field. The value must be 60 seconds or greater.
i.
In the Maximum Login Failures to Lockout Account field, enter the number of times a user can try to log in to the Admin before the account is locked. By default, six attempts are allowed . Leave the field empty for unlimited login attempts.
j.
In the Lockout Time (minutes) field, enter the number of minutes that an Admin account is locked when the maximum number of attempts is met.
1058 Magento Community Edition 2.1 User Guide
CHAPTER 78: Security Configuring Admin Security
k.
To limit the lifetime of Admin passwords, enter the number of days a password is valid in the Password Lifetime (days) field. /For an unlimited lifetime, leave the field blank.
l.
Set Password Change to one of the following:
Forced
Recommended
Requires that Admin users change their passwords after the account is set up.
Recommends that Admin users change their passwords after account is set up.
4.
When complete, tap
Save Config
.
Magento Community Edition 2.1 User Guide 1059
CAPTCHA CHAPTER 78: Security
CAPTCHA
A CAPTCHA is a visual device that ensures that a human being, rather than a computer, is interacting with the site. CAPTCHA is an acronym for “Completely Automated Public Turing test to tell Computers and Humans Apart,” and can be used for both Admin and customer account logins.
You can reload the CAPTCHA as many times as is necessary by clicking the Reload icon in the upper-right corner of the image. The CAPTCHA is fully configurable and can be set appear every time, or only after a number of failed login attempts.
Customer Login with CAPTCHA
1060 Magento Community Edition 2.1 User Guide
CHAPTER 78: Security CAPTCHA
Admin CAPTCHA
For an extra level of security, you can add a CAPTCHA to the Admin Sign In and Forgot
Password page. Administrator users can reload the displayed CAPTCHA by clicking the Reload icon in the upper-right corner of the image. The number of reloads is unlimited.
Admin Sign In with CAPTCHA
To configure an Admin CAPTCHA:
1.
On the Admin sidebar, tap Stores. Then under Settings, choose Configuration.
2.
In the panel on the left, under Advanced, choose Admin.
3.
In the upper-right corner, set Store View to “Default.”
4.
Expand the CAPTCHA section, and do the following:
Magento Community Edition 2.1 User Guide 1061
CAPTCHA CHAPTER 78: Security
1062
Admin CAPTCHA Configuration
a.
Set Enable CAPTCHA in Admin to “Yes.”
b.
Enter the name of the Font to be used for the CAPTCHA symbols. Default font:
LinLibertine
To add your own font, the font file must reside in the same directory as your Magento instance, and be declared in the config.xml file of the Captcha module at: app/code/Magento/Captcha/etc
c.
Select the Forms where the CAPTCHA is to be used: l
Admin Login l
Admin Forgot Password
Magento Community Edition 2.1 User Guide
CHAPTER 78: Security CAPTCHA
d.
Set Displaying Mode to one of the following:
Always
After number of attempts to login
CAPTCHA is always required to log in the Admin.
When selected displays the Number of Unsuccessful
Attempts to Login field. Enter the number of login attempts allowed. A value of 0 (zero) is similar to setting Displaying
Mode to Always. This option does not cover the Forgot
Password form. If CAPTCHA is enabled and set to be appear on this form, then it is always included on the form.
e.
Enter the Number of Unsuccessful Attempts to Login before the CAPTCHA appears. If set to zero, the CAPTCHA is always used.
f.
In the CAPTCHA Timeout (minutes) field, enter the number of minutes before the
CAPTCHA expires. When the CAPTCHA expires, the user must reload the page.
g.
Enter the Number of Symbols used in the CAPTCHA, up to eight. For a variable number of symbols that changes with each CAPTCHA, enter a range, such as 5-8.
h.
In the Symbols Used in CAPTCHA field, specify the symbols that can be used in the
CAPTCHA. Only letters (a-z and A-Z) and numbers (0-9) are allowed. The default set of characters does not include similar symbols such as I or 1. For best results, use symbols that users can readily identify.
i.
To require that users enter the characters exactly as shown set Case Sensitive to “Yes.”
5.
When complete, tap
Save Config…
.
Magento Community Edition 2.1 User Guide 1063
CAPTCHA CHAPTER 78: Security
Customer CAPTCHA
Customers can be required to enter a CAPTCHA each time they log in to their accounts, or after several unsuccessful attempts to log in. CAPTCHA can be used for the following forms in the storefront: l
Create User l
Login l
Forgot Password l
Checkout as Guest l
Register During Checkout l
Contact Us
1064
Customer CAPTCHA Configuration
Magento Community Edition 2.1 User Guide
CHAPTER 78: Security CAPTCHA
To configure a Storefront CAPTCHA:
1.
On the Admin sidebar, tap Stores. Then under Settings, choose Configuration.
2.
In the panel on the left, under Customers, choose Customer Configuration.
3.
Expand the CAPTCHA section, and do the following:
a.
Set Enable CAPTCHA on Frontend to “Yes.”
b.
Enter the name of the Font to be used for the CAPTCHA symbols.
To add your own font, the font file must reside in the same directory as your Magento instance, and be declared in the config.xml file of the CAPTCHA module.
c.
Choose one of the following Forms where CAPTCHA is to be used.
l
Create User l
Login l
Forgot Password l
Checkout as Guest l
Register during Checkout
d.
Set Displaying Mode to one of the following:
Always CAPTCHA is always required to access the selected form(s).
After number of attempts to login
Enter the number of login attempts before the CAPTCHA appears. A value of 0 (zero) is similar to “Always.” When selected, the number of unsuccessful login attempts appears.
This option does not apply to the Forgot Password form, which always display the CAPTCHA, if enabled,
e.
Enter the Number of Unsuccessful Attempts to Login before the CAPTCHA appears. If set to zero, the CAPTCHA is always used.
f.
In the CAPTCHA Timeout (minutes) field, enter the number of minutes before the
CAPTCHA expires. When the CAPTCHA expires, the user must reload the page to generate a new CAPTCHA.
g.
Enter the Number of Symbols in the CAPTCHA, up to eight. For a variable number of symbols that change with each CAPTCHA, enter a range such as 5-8.
h.
In the Symbols Used in CAPTCHA field, specify the symbols that can be used in the
CAPTCHA. Only letters (a-z and A-Z) and numbers (0-9) are allowed. The default set of characters does not include similar symbols such as I or 1. For best results, use symbols that users can readily identify.
i.
To require that the user enter the upper-and lowercase characters exactly as shown set
Case Sensitive
to “Yes.”
4.
When complete, tap
Save Config
.
Magento Community Edition 2.1 User Guide 1065
Encryption Key CHAPTER 78: Security
Encryption Key
The encryption key is used to protect passwords and other sensitive data. During the
Magento setup , you have the option to generate an encryption key, or use an another.
Encryption Key
To change the encryption key:
1.
On the Admin sidebar, tap System. Then under Other Settings, choose Manage Encryption
Key
.
2.
Set Auto-generate Key to “Yes.”
3.
Tap
Change Encryption Key
.
1066 Magento Community Edition 2.1 User Guide
CHAPTER 78: Security Session Validation
Session Validation
Magento Community 2.1 allows you to validate session variables as a protective measure against possible session fixation attacks, or attempts to poison or hijack user sessions. The
Session Validation Settings determine how session variables are validated during each store visit, and if the session ID is included in the URL of the store.
Session Validation Settings
The validation checks to see that visitors are who they say they are by comparing the value in the validation variables against the session data that is already stored in $_SESSION data for the user. Validation fails if the information is not transmitted as expected, and the corresponding variable is empty. Depending on the session validation settings, if a session variable fails the validation process, the client session immediately terminates.
Enabling all of the validation variables can help prevent attacks, but might also impact the performance of the server. By default, all session variable validation is disabled. We recommend that you experiment with the settings to find the best combination for your Magento installation. Activating all of the validation variables might prove to be unduly restrictive, and prevent access to customers who have Internet connections that pass through a proxy server, or that originate from behind a firewall. To learn more about session variables and their use, see the system administration documentation for your Linux system.
Magento Community Edition 2.1 User Guide 1067
Session Validation CHAPTER 78: Security
To configure the Session Validation Settings:
1.
On the Admin sidebar, tap Stores. Then under Settings, choose Configuration.
2.
In the panel on the left under General, choose Web.
3.
Expand the Session Validation Settings section. Then, do the following:
a.
To verify that the IP address of a request matches what is stored in the $_SESSION variable, set Validate REMOTE_ADDR to “Yes.”
b.
To verify that the proxy address of an incoming request matches what is stored in the $_
SESSION variable, set Validate HTTP_VIA to “Yes.”
c.
To verify that the forwarded-for address of a request matches what is stored in the $_
SESSION variable, set Validate HTTP_X_FORWARDED_FOR to “Yes.”
d.
To verify that the browser or device that is used to access the store during a session matches what is stored in the $_SESSION variable, set Validate HTTP_USER_AGENT to
“Yes.”
e.
If you want a user to stay logged in while switching between stores, set Use SID on
Frontend
to “Yes.”
If including SID with analytics, you must configure your analytics software to filter the SID from URLs, so the page visit counts are correct.
4.
When complete, tap
Save Config
.
1068 Magento Community Edition 2.1 User Guide
CHAPTER 78: Security Browser Capabilities Detection
Browser Capabilities Detection
As is true of most websites and applications on the Internet, Magento requires that the visitor’s browser allow both cookies and JavaScript for full operations. However, occasionally a user’s browser is set to the highest privacy setting that prevents both cookies and JavaScript. Your store can be configured to test the capabilities of each visitor’s browser, and to display a notice if the settings need to be changed.
l
If the browser’s privacy settings disallow cookies, you can configure the system to automatically redirect them to the
page, which explains how to make the recommended settings with most browsers.
l
If the browser’s privacy settings disallow JavaScript, you can configure the system to display the following message above the header of every page:
To configure browser capabilities detection:
1.
On the Admin sidebar, tap Stores. Then under Settings, choose Configuration.
2.
In the panel on the left under General, choose Web.
3.
Expand the Browser Capabilities Detection section, and do the following:
a.
To display instructions that explain how to configure the browser to allow cookies, set
Redirect to CMS-page if Cookies are Disabled
to “Yes.”
b.
To display a banner above the header when JavaScript is disabled in the user’s browser, set
Show Notice if JavaScript is Disabled
to “Yes.”
Browser Capabilities Detection
4.
When complete, tap
Save Config
.
Magento Community Edition 2.1 User Guide 1069
Action Log CHAPTER 78: Security
Action Log
The Action Log tracks the activities of administrators who work in your store. For most events, the available information includes the action, the name of the user who performed it, whether it was a success or failure, and the ID of the object on which the action was performed.
Additionally the IP and date are always logged.
1070
Admin Actions Logging
To configure the Action Log:
1.
On the Admin sidebar, tap Stores. Then under Settings, choose Configuration.
2.
In the panel on the left under Advanced, choose Admin.
3.
Expand the Admin Actions Logging section, and do the following: l
To enable admin logging, mark the checkbox.
l
To disable admin logging, clear the checkbox.
4.
When complete, tap
Save Config
.
Magento Community Edition 2.1 User Guide
डाउनलोड
सार्वजनिक लिंक अपडेट किया गया
आपकी चैट का सार्वजनिक लिंक अपडेट कर दिया गया है. You may view and manage your chat links after registration here.
दस्तावेज़ सार्वजनिक लिंक
विज्ञापन
