1

Got a very security conscious client.

I've searched stack exchange and only found partial solutions to certain security issues.

I've also searched dev docs and again found one or two suggestions in different areas.

Therefore I felt it was worth asking the question to get a collection of answers under a single question.

Does anyone have practical suggestions on making magento 2 (more) secure front and back? Either extensions or configuration. Or perhaps even just some common sense rules to follow. Like disabling something that's enabled by default.

  • What have you implemented yet? – paranoid kid Jun 9 at 14:46
  • Look at implementing security headers in magento, you can add it via admin panel, enable captcha on forms, get in touch with hosting and have a look at mod_security and check if var folder is visible through browser. – paranoid kid Jun 9 at 14:56
  • Standard folder exclusions via nginx – Dominic Xigen Jun 9 at 16:40
  • 1
    @ahmadtalat nice. I think it's worth adding honeypot as a potential answer – Dominic Xigen Jun 10 at 11:28
2

This is not a definitive list, but more a list of some things to consider. I'll go into more details on some of the suggestions below. I am probably missing some stuff and some may be enabled by default (recaptcha?).

Overview

  1. Magento Security Scan Tool
  2. Audit ALL custom/third party modules

  3. Using restrictive filesystem permissions

  4. IP Restrictions on SSH/SFTP
  5. IP restrict the admin panel (Can be done on code level or server config)

  6. Setup a WAF (Web application firewall)

  7. Recaptcha

  8. Custom Admin Panel URL

  9. Setting up admin user accounts

    • Use unique secure passwords
    • Restrict permissions as much as you can
    • Setup 2FA
  10. File Modification Reports


1. Magento Security Scan

https://magento.com/blog/magento-news/introducing-new-magento-security-scan-tool

2. Audit ALL custom/third party modules

Even if it is from a reputable/large company, the main concerns are XSS and SQLi exploits

3-5

Pretty self-explanatory, just tries to restrict attack origins to yours/clients office and home ips. You can potentially make some of the files/directories immutable with chattr, which would prevent all users from modifying them without first removing the immutable flag which you need root access to do.

6. Setup a WAF

Can usually prevent XSS/SQLI exploits and block malicious connections. For example, PRODSECBUG-223 the SQLi issue a few months ago was patched on Sucuri's WAF shortly after being announced. https://blog.sucuri.net/2019/03/sql-injection-in-magento-core.html

7. Recaptcha

Pretty self-explanatory, an additional method to try and prevent brute force attacks

8. Custom Admin Panel URL

Again, another method to try and prevent people from brute forcing / abusing leaked credentials.

9. Setting up admin user accounts

Using unique secure passwords on admin accounts is pretty important. Or at very least use a password with a low leak count https://haveibeenpwned.com/Passwords

Restrict the Admin users as much as you can, so in the case that their account gets compromised the whole backend does not.

  • Does the order processing staff really need access to the CMS pages/blocks where they could place malicious JS?

  • Does the content management staff really need access to the payment/shipping method config options?

In the case admin credentials are leaked/harvested, 2FA can prevent access to the system.

To setup 2FA, you need to install an additional module. I would recommend using the MageSpecialist module as this has been endorsed by the Magento Community Engineering program.

For installation/setup instructions refer to the official docs here. https://docs.magento.com/m2/ce/user_guide/magento/extension-install-two-factor-authentication.html

10. File Modification Reports

Setting up a report that runs daily/weekly that shows what files have changed, excluding things like var/cache etc can be an effective way to spot early signs of your system being compromised

  • unfortunately your list does not give real protection. i can still upload and open files. – MagenX Jun 9 at 16:51
  • Is 2FA built in? Or is that extension? – Dominic Xigen Jun 9 at 17:46
  • @MagenX you have suggestions? Or you mean unix file permissions? – Dominic Xigen Jun 9 at 17:49
  • @DominicXigen It's an additional module that you need to install, I have added some more information about it into the answer. – Sam Jun 9 at 18:04
2

HoneyPot for magento 2, test it on dev first please

https://github.com/arcmedia/mage2-customer-honeypot

1

I've been discussing under a separate question.

The magento API is on and enabled by default. There is an option to lock some functionality down so that it does not allow anonymous acess.

So check that setting.

Otherwise may need to consider locking API down by IP. Although checkout needs access.

https://devdocs.magento.com/guides/v2.3/rest/anonymous-api-security.html

https://magento.stackexchange.com/a/277989/70343

0

I've come across the MageSpecialist security suite.

https://github.com/magespecialist/m2-MSP_Security_Suite

Part of it is related to Magento 2 somehow. I can't figure out exactly but it is under the Magento repos. So I guess that's some form of official endorsement.

https://github.com/magento/magespecialist_ReCaptcha

Anyway, worth a mention. I've got lots to go back to client with.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.