2

Is it ideal to IP protect the Magento cron.php? instead of folder protecting it (as referred in the http://devdocs.magento.com/guides/v2.0/config-guide/secy/secy-cron.html) because we want to harden the Magento security as best possible way.

FYI: I'm using Magento 1.9.2.2v

3

The docs you linked are for Magento 2.

It is ideal to not allow any access to cron.php via HTTP, as it is the default since Magento 1.9.2.2, and execute it only via CLI and system crontab.

If for some reason you cannot to that, an IP whitelist is a valid alternative.

2

The SUPEE-6788 and Magento 1.9.2.2 both updated .htaccess to control access to cron.php by both default denying access and giving a recommendation on how to set up password access.

###########################################
## Deny access to cron.php

<Files cron.php>

############################################
## uncomment next lines to enable cron access with base HTTP authorization
## http://httpd.apache.org/docs/2.2/howto/auth.html
##
## Warning: .htpasswd file should be placed somewhere not accessible from the web.
## This is so that folks cannot download the password file.
## For example, if your documents are served out of /usr/local/apache/htdocs
## you might want to put the password file(s) in /usr/local/apache/.

    #AuthName "Cron auth"
    #AuthUserFile ../.htpasswd
    #AuthType basic
    #Require valid-user

############################################

    Order allow,deny
    Deny from all

</Files>

Additionally, you can add an ip address whitelist as follows (example by CIDR or single address):

###########################################
## Deny access to cron.php

<Files cron.php>

############################################
## uncomment next lines to enable cron access with base HTTP authorization
## http://httpd.apache.org/docs/2.2/howto/auth.html
##
## Warning: .htpasswd file should be placed somewhere not accessible from the web.
## This is so that folks cannot download the password file.
## For example, if your documents are served out of /usr/local/apache/htdocs
## you might want to put the password file(s) in /usr/local/apache/.

    #AuthName "Cron auth"
    #AuthUserFile ../.htpasswd
    #AuthType basic
    #Require valid-user

############################################

    Order allow,deny
    Allow from 10.0.0.0/8
    Allow from 10.2.0.15
    Deny from all

</Files>

For non-apache servers you will have to duplicate the rules in your server of choice.

1

Is it ideal to IP protect the Magento cron.php?

No. You shouldn't ever be executing cron.php directly, whether by CLI or HTTP.

The change Magento made in 6788 is as much a bug fix as it is a security fix. The security hole it plugged had the byproduct of forcing those who incorrectly set up their cron to properly re-implement it.

You should only ever execute cron.sh, so that you have job control, control over what environment the cron is run within and for security.

Under no circumstance should cron.php ever be accessed directly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.