Drupal Paranoia
-
Upload
inna-tuyeva -
Category
Technology
-
view
686 -
download
0
Transcript of Drupal Paranoia
Drupal : VPS
.
, . - , . , .
, , , .
, .
(, )
( , , )
( .)
VPS. , shared-, shared- . - shared- . , .
>>>> , ? , , . , , . , . shared-, , CPU, , - , . .
:
(ftp, ssh, ...)
: (ssh, ftp)
:
.
. - DOS.
, shell- , .
, , .
. , , - ., ?
, . , , . , . . , . . ? , . , , , .
Drupal:
update status
PHP
1
paranoia PHP
1
paranoia
, update status . drupal.org . PHP , , , . PHP , . . , , , . #1, - . , . paranoia .
Drupal + HTTPS
:http://example.com/* -
http://example.com/admin*
https://example.com only!
? :custom_url_rewrite_inbound(
&$result, $path, $path_language)
$_SERVER['HTTP_X_SSL_CONNECT']
$_SERVER['HTTP_X_FORWARDED_HOST']
$_SERVER['HTTP_HOST'] .
. , HTTPS . , https. , .
[SKIPED ] . , .
:
: captcha
Spam
URL Spam
Mollom
Akismet
., - . , , . - .
. Spam. . .: Mollom drupal.ru . . Mollom , .
:
- drupal.ru !
100
,
. . , , , ; , . , , , . , . drupal.ru: - !
Apache mod_security
mod_security GET POST
(-) SQL injections
XSS
HTTP-
Apache Nginx. mod_security, . . . GET POST . SQL, -, . HTTP-. . , . .
PHP
mod_php Apache
open_base_dir
FastCGI Apache NGINX
Suhosin PHP
PHP Apache . : . PHP FastCGI, : .Suhosin , . PHP, PHP. PHP, PHP. Suhosin 2007 , PHP Linux FreeBSD.
FTP (use SFTP)
VPS/: ( root)
files tmp , Drupal
: index.html
ftp, . , ftp- , , Reported attack site, -.
secure-shell DrupalDo.
POSIX ACL : , user:group:other rwx
ACL
acltools: getfacl/setfacl
access control lists (ACL). ACL . ACL, . setfacl getfacl.
hook_user()
Fail2ban DOS SSH FTP
Drupal:failregex = \|user\|\|.*\|Login attempt failed (.+)\.$
IP
. , , / .
, . , . ...
, hook_user().
fail2ban...
: IP
?
, . , mysql ssh . Mysql tcp- ssh , . , . . , , mysql. , , .
loopback-
AES, Blowfish, DES...
Linux:
. . : . . , . - . : . , . . , , .
(, , PHP)
(Zabbix, ZenOSS)CPU
,
Linux, *BSD, Windows
. .
, Zabbix, [ ].
zabbix , , zabbix .
:
/:http://fail2ban.org
http://modsecurity.org
http://suhosin.org
http://zabbix.com
:www.drupal.ru/node/31163 - fail2ban + Drupal
http://tr.im/x5cQ -
, . , - , , ?
.
TODO: ACL.
OpenOffice
Futurama
?
.
Creative Commons SA .
Cryptographic options ---> DES and Triple DES EDE cipher algorithms Blowfish cipher algorithm AES cipher algorithms (i586)
$ cryptsetup -c aes -y create mycrypt /dev/vg/storage$ mkfs.ext4 /dev/mapper/mycrypt$ mount /dev/mapper/mycrypt /var/lib/mysql/secured$ losetup -e aes /dev/loop0 /mnt/secured