Keeping your Drupal site secure 2013

Keeping your Drupal site secure 2013

• 1.
  Keeping your Drupal SiteSecure Stéphane Corlosquet [email protected] Training at BADCamp October, 2013
• 2.
  General tips ● Use HTTPS,SSH, SFTP ● Strong password policy ● Server – LAMP stack ● Require SSH keys ● Roles and permissions ● Keep your site settings secure – – – Permissions Text formats PHP filter
• 3.
  Drupal 7 ● Stronger passwordhashing / salt ● Login flood control – ● Protected cron – ● prevents brute-force credential guessing prevents Denial of Service attacks Update manager – Update module from the web UI
• 4.
  Modules enhancing security ● Securelogin ● Password policy ● Paranoia ● Hacked! ● Permissions Lock
• 5.
  Drupal specific hosting ● Canyour hosting provider help you improve your security process? ● ● ● Insight (part of Acquia Cloud hosting) Pantheon (self-service security updates) Tuned for Drupal security (and performance) ● Code, DB, uploaded files, config ● Managed security updates: – Remote administration (Acquia)
• 6.
  Security process ● Ongoing maintenance ● Cost ● Managedhosting ● Drupal.org packaging infrastructure
• 7.
  Security process ● Drupal SecurityTeam ● Keep Drupal code secure in core and contrib ● Educate the community on security best practices – – – – ● Developers Site builders Site administrators and users Decision makers Security Advisory for every security release
• 8.
  Security process
• 9.
  Developers & sitemaintainers ● Follow Drupal APIs and best practices ● Take & verify backups ● Sanitize backups for sharing
• 10.
  Cross Site Scripting
• 11.
  Drupal 8 ● Twig astemplating language – – ● WYSIWYG in core – – ● Automatically sanitizes strings on output No PHP in templates Streamlined filter mechanism (server and client side) No more full HTML as last resort Local image input filter – Only allow images from same site
• 12.
  Book on Securityin Drupal
• 13.
  References ● DGD7 chapter 6 ● http://drupal.org/security ● http://www.drupalscout.com/ ● http://groups.drupal.org/best-practices-drupal-security
• 14.
  Thanks! ● Stéphane Corlosquet: – – – [email protected] @scorlosquet http://openspring.net/