Difference between revisions of "Further Security Steps"

From WHMCS Documentation

(No longer want to recommend htaccess protection)
 
(36 intermediate revisions by 9 users not shown)
Line 1: Line 1:
−
WHMCS has many features built-in to help keep your data safe, but here are several simple extra steps you can take to secure your WHMCS installation even further.
+
WHMCS includes many features to help keep your data safe, but you can take recommended additional steps to secure your WHMCS installation further.
  
−
==Change your WHMCS Admin Folder Name==
+
== Recommended Steps ==
  
−
With many web based softwares, users know they can try visiting various common directory names to find admin control panels.  So customising the location of your WHMCS admin area is one of many steps you can take in order to make the lives of malicious users looking for login forms that little bit more difficult.  WHMCS needs to know what you call your admin directory however if you choose to rename it, so if you would like to do this, please refer to [[Customising the Admin Directory]]
+
We recommend:
  
−
==Move the attachments, downloads & templates_c folders==
+
# Securing the writeable directories by [https://help.whmcs.com/m/installation/l/1650299-securing-writeable-directories moving them to a non-public location].
 +
# Securing the <tt>configuration.php</tt> file by [https://help.whmcs.com/m/installation/l/1650301-securing-the-configuration-file adjusting its permissions].
 +
# Securing the <tt>crons</tt> directory by [https://help.whmcs.com/m/installation/l/1650302-moving-the-crons-directory moving it to a non-public location].
 +
# Protecting your Admin Area by [https://help.whmcs.com/m/installation/l/1650303-restricting-access-by-ip-address restricting access to a specific set of IP addresses] and [https://help.whmcs.com/m/installation/l/1650304-renaming-the-whmcs-admin-directory renaming the admin directory].
 +
# Disabling any unneeded [[System_Environment_Guide#Database_Privileges|database privileges]].
 +
# Protecting sensitive data by [https://help.whmcs.com/m/installation/l/1650306-enabling-ssl enabling SSL].
 +
# If you are not using Apache, ensure against [[Nginx Directory Access Restriction|serving requests directly from the vendor directory]]. <div class="docs-alert-info">The <tt>.htaccess</tt> file within the <tt>vendor</tt> directory will suffice to protect against this for servers running on Apache.</div>
 +
# Defending against clickjacking by [https://owasp.org/www-community/attacks/Clickjacking always sending the proper Content Security Policy (CSP) frame-ancestors directive response headers].
 +
# Performing general server hardening measures (for example, [https://docs.cpanel.net/knowledge-base/security/security-best-practices/ cPanel's] or [https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration OWASP's] best practices).
  
−
The three directories "attachments", "downloads" and "templates_c" within the WHMCS root directory need to be writeable by WHMCS.  They are used to store ticket attachments, file downloads and compiled versions of templates for improved performance respectively.
+
== Additional Questions ==
  
−
<div class="docs-alert-warning">We recommend moving all writeable directories to a non-public location above your web root to prevent web based access.</div>
+
If you have additional questions or concerns regarding server security, contact your hosting provider or system administrator. They can review the server, assess the installed software and configuration, and provide tailored recommendations and assistance.
−
 
 
−
When you move the directories, you must provide WHMCS with the new paths to them.  You do this by adding (or updating if they already exist) the following lines in the ''configuration.php'' file within the root WHMCS directory.
 
−
 
 
−
<source lang="php">
 
−
$templates_compiledir = "/home/username/templates_c/";
 
−
$attachments_dir = "/home/username/attachments/";
 
−
$downloads_dir = "/home/username/downloads/";
 
−
</source>
 
−
 
 
−
In the above example, "username" is the cPanel username and so the 3 folders are located in the home directory, above public_html.
 
−
 
 
−
<div class="docs-alert-info">Note that if you are running suPHP or phpSuExec chmod 755 should be sufficient permissions to make the directories writeable as this is the highest permission available for both folders and files when running in that condition.</div>
 
−
 
 
−
==Move the crons folder==
 
−
 
 
−
{{:Custom Crons Directory}}
 
−
 
 
−
==Restrict Access by IP==
 
−
 
 
−
For added security, if your staff use fixed IP addresses, you can add even more protection to your admin area by restricting access to a specific set of IPs. This is done by creating a file with the name .htaccess within your WHMCS admin directory, with the following content:
 
−
 
 
−
<source lang="php">
 
−
order deny,allow
 
−
allow from 12.34.5.67
 
−
allow from 98.76.54.32
 
−
deny from all
 
−
</source>
 
−
 
 
−
You can specify as many different '''allow from''' lines as you require.  Or you can even allow entire IP subnet's by specifying just the first part of an IP, for example: "12.34.".  This is called Htaccess IP Restriction.
 
−
 
 
−
==Restrict Database Privileges==
 
−
For day to day use, only the following database privileges are required. All others may be disabled.
 
−
 
 
−
*DELETE
 
−
*INSERT
 
−
*SELECT
 
−
*UPDATE
 
−
 
 
−
Please note that installation, upgrading, activating, and deactivating modules require the following additional privileges.
 
−
 
 
−
*ALTER
 
−
*CREATE
 
−
*DROP
 
−
*INDEX
 
−
 
 
−
[[Installation|<< Back to Installation Overview]]
 

Latest revision as of 20:04, 14 February 2023

WHMCS includes many features to help keep your data safe, but you can take recommended additional steps to secure your WHMCS installation further.

Recommended Steps

We recommend:

  1. Securing the writeable directories by moving them to a non-public location.
  2. Securing the configuration.php file by adjusting its permissions.
  3. Securing the crons directory by moving it to a non-public location.
  4. Protecting your Admin Area by restricting access to a specific set of IP addresses and renaming the admin directory.
  5. Disabling any unneeded database privileges.
  6. Protecting sensitive data by enabling SSL.
  7. If you are not using Apache, ensure against serving requests directly from the vendor directory.
    The .htaccess file within the vendor directory will suffice to protect against this for servers running on Apache.
  8. Defending against clickjacking by always sending the proper Content Security Policy (CSP) frame-ancestors directive response headers.
  9. Performing general server hardening measures (for example, cPanel's or OWASP's best practices).

Additional Questions

If you have additional questions or concerns regarding server security, contact your hosting provider or system administrator. They can review the server, assess the installed software and configuration, and provide tailored recommendations and assistance.

Retrieved from "http://3.17.75.209/index.php?title=Further_Security_Steps&oldid=33915"