Security
Implementing Foregenix
Table of ContentsEnable Foregenix[vc_row type="in_container" full_screen_row_position="middle" column_margin="default" column_direction="default" column_direction_tablet="default" column_direction_phone="default" scene_position="center" text_color="dark" text_align="left" row_border_radius="none" row_border_radius_applies="bg" overlay_strength="0.3" gradient_direction="left_to_right" shape_divider_position="bottom" bg_image_animation="none"][vc_column column_padding="no-extra-padding" column_padding_tablet="inherit" column_padding_phone="inherit" column_padding_position="all" background_color_opacity="1" background_hover_color_opacity="1" column_shadow="none" column_border_radius="none" column_link_target="_self" gradient_direction="left_to_right" overlay_strength="0.3" width="1/1" tablet_width_inherit="default" tablet_text_alignment="default" phone_text_alignment="default" column_border_width="none" column_border_style="solid" bg_image_animation="none"][vc_column_text]Sonassi have partnered with Foregenix, a Cyber security, Digital forensics & PCI Compliance company. You can take advantage of … Continue reading
Vulnerability scanner
Table of ContentsReport priorities HTML/JSON/Email report Email HTML JSON Text based/Log report Format Excludes/ignores Entire document root Specific fileMageStack has a built in vulnerability scanner, which performs a number of roles Detects common PHP exploits Detects Magento 3rd party module exploits Identifies potentially compromised files Identifies abnormal files Checks if all available Magento patches have … Continue reading
Limit/block bad bots
Table of ContentsRe-qualify bad bots Limiting crawl bots Crawl delay Server-side Blocking bad bots Bot detection Enable bot detection on an entire VHost Enable bot detection on specific URLsMageStack has native functionality to prioritise certain "good" bots (Google, Bing, Yahoo, Pingdom) and to reduce priority of "bad" third party bots (Majestic SEO, Rogerbot etc.), this … Continue reading
Limit/block customer registration
Sometimes, your site may fall victim to country specific attacks or SPAM bots. Discretely preventing access to customer registration on your server for a specific country is very straightforward, with a simple edit to your domain's ___general/example.com.conf file. Eg. To block the country with country code aa set $bad_request "0"; if ($request_uri ~* ^/customer/account/(create(post)?|index|login)) { … Continue reading
Installing SSL Certificates
Table of ContentsPurchasing InstallingPurchasing If you require an SSL certificate, read this article. Installing If you have purchased an SSL certificate from Sonassi, we will take care of the installation on your behalf, from certificate signing to final installation and testing. If you are supplying your own certificate, we require the following in x509 non-passphrase … Continue reading
Reset File Permissions
Table of ContentsBasic permissions Advanced permissions Enable advanced permissions Disable advanced permissions Using hooks Examples Basic: Reset permissions for example.com Advanced: Reset permissions for all domains-groups/vhosts Using a post-completion script for WordPress UploadsMageStack provides extremely consistent file permissions across all services (SSH/FTP/Web) when used correctly. However, misuse/abuse of the root user or incorrectly manually set … Continue reading
Securing your Magento Store
Magento is a secure application out-of-the-box, but it should be supplemented by further measures to ensure it is as secure as possible. Below is a series of steps on securing/hardening your Magento store. Do not use the root account or distribute root credentials to developers Register with a security scan service (eg. Comodo HackerGuardian, McAfee … Continue reading
Firewall access rules
Table of ContentsWhitelisting Port forwardingMageStack has an exhaustive 3-tier firewall policy that provides superb security and protection for your stack and store. However, in some cases, it may be necessary to bypass some of these security measures for trusted hosts. There are two ways that hosts can be trusted to allow traffic to flow. These … Continue reading
Analysing DOS blocks by country
It can unfortunately be a common occurrence that certain countries are a source of DOS attacks or aggressive crawl bots. It is also possible that these countries do not form part of your target demographic, and as such, it isn't actually necessary that your website needs to be available there. Using the DOS filter logs, … Continue reading
Block by Country Code
Sometimes, your site may fall victim to country specific attacks or crawl bots. Blocking access to your server for a specific country is very straightforward, with a simple edit to your domain's ___general/example.com.conf file Eg. To block the country with country code aa if ($geoip_country_code ~* (aa)) { return 403; } You can use Perl … Continue reading