관리-도구
편집 파일: important_site_security_recommendations.html
<!DOCTYPE html> <html> <!-- /** * @copyright Copyright 2003-2020 Zen Cart Development Team * @license https://www.zen-cart.com/license/2_0.txt GNU Public License v2.0 * @version $Id: Scott C Wilson 2020 Apr 19 Modified in v1.5.7 $ */ //--> <head> <title>Zen Cart® Site Security Recommendations</title> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <meta http-equiv="Content-Type" content="text/html"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="keywords" content=""> <meta name="description" content=""> <meta name="authors" content="The Zen Cart® Team"> <meta name="generator" content="shopping cart program by Zen Cart®, https://www.zen-cart.com"> <meta name="robots" content="noindex, nofollow"> <link rel="stylesheet" href="./zen.css"> </head> <body> <div class="container"> <section id="pageHeader"> <div class="row"> <div class="col-md-6 col-sm-12"> <a href="./index.html"> <img src="../includes/templates/template_default/images/logo.gif" alt="Zen Cart®" title="Zen Cart®" width="192" height="68" border="0" /> </a> </div> <div class="col-md-6 hidden-xs hidden-sm text-right"> <a class="btn btn-primary add-shadow" href="./index.html"> Documentation Home </a> </div> </div> </section> <!-- End pageHeader //--> <section id="zenTeamMessage"> <h1>Welcome to Zen Cart®</h1> <div class="alert add-shadow"> <em>Dear Zen Cart® User</em>, <p> Zen Cart® is made available to you for your use, addition, changes, modification, etc. without charge, under Version 2 of the GNU General Public License. </p> <p> While we do not charge for this software, donations are greatly appreciated, each time you install a new version, to help cover the expenses of maintenance, upgrades, updates, the free support forum and the continued development of this software for your online E-Commerce store. </p> <p> Donations can be made on the <a href="https://www.zen-cart.com/donate" target="_blank">Zen Cart® Team Page</a> </p> <p> We appreciate your support. <br> <em>The Zen Cart® Team</em> </p> </div> </section> <!-- End zenTeamMessage //--> <section id="generalSiteSecurity"> <h1>Zen Cart® Site Security</h1> <div> <h2>Leveraging Resources on the Zen Cart® Website</h2> <p> The Zen Cart® Team, along with Zen Cart® Users and Contributors, regularly update security recommendations on the Zen Cart® Website. </p> <p> You may wish to also consult recommendations posted on the <a href="https://docs.zen-cart.com/user/security/security_recommendations/">Zen Cart® Website</a>. </p> </div> <div> <h2>SSL Protection</h2> <p> A Secure Sockets Layer (SSL) connection is the standard security technology for establishing a secure and encrypted connection between a web server and a browser. This requires a SSL certificate from your web hosting provider or a third party certificate provider. </p> <p> The preferred would be to have a dedicated SSL certificate but there may be additional expense involved in obtaining this. As a bare minimum, you should use a shared SSL certificate provided by your web hosting provider. </p> </div> <div> <h2>Accessing your Site Files Securely</h2> <p> Instead of using regular FTP to access your server files, it is advisable to use an FTP program that allows Secure FTP (SFTP or FTPS). This method will encrypt the information you transmit and receive. This is important especially when you are downloading database backups or configuration files which contain usernames and passwords, etc. </p> <p> If your web hosting provider does not support Secure FTP, you may wish to consider a web hosting provider that takes security seriously. </p> </div> <div class="back-to-top"> ^^ <a href="#pageHeader">Back to Top</a> ^^ </div> </section> <!-- End generalSiteSecurity //--> <section id="securingStore"> <div> <h1>Securing your Zen Cart® Store</h1> <div id="removeExtraFolders"> <h2>Remove Extra Folders from your Server after Install</h2> <div> <p> It is important that after you have installed your Zen Cart® Store and are satisfied that it is working properly, including test transactions to test <em>ALL</em> the payment and shipping modules you are using. </p> <ul> Remove the following folders and all the files inside them, to minimize security risks: <li>/docs</li> <li>/extras</li> <li>/zc_install</li> <li>/install.txt</li> </ul> <p> It is safe to keep these files on your <em>Local PC</em>, since they can be used as references/documentation, or used to aid in troubleshooting as diagnostic tools, or for upgrading/installing again in the future. However, those folders and files should <em>NOT</em> be on a live webserver. </p> <ul> If you have no intentions of supporting downloadable products or music-media products, you can <em>optionally</em> also remove these folders: <li>/download</li> <li>/media</li> <li>/pub</li> </ul> <p> You will need to go to <em>Admin->Configuration->Attribute Settings->Enable Downloads</em>, and set it to <em>False</em> to turn off the warning message about the missing download folder. </p> <p> If you choose to add downloadable products to your site or music-products, you will want to re-upload these appropriate folders (and their contents) to your server again, and assign appropriate permissions. </p> </div> </div> <!-- End removeExtraFolders //--> <div id="emailTransportMethod"> <h2>Use "SMTPAUTH" or "SMTP" as your Email Transport Method Instead of the Generic "PHP" Setting</h2> <div> <p> Go to <em>Admin->Configuration->Email Options</em>, and change your Email Transport Protocol to <em>SMTPAUTH</em>, and then fill in the SMTP Credentials in the other settings lower on that same screen. </p> <p> This will not only help prevent outgoing emails from ending up in spam folders, but will also prevent the disclosure of your admin foldername when sending emails from your admin screens. </p> </div> </div> <!-- End emailTransportMethod //--> <div id="setConfigurePHPFiles"> <h2>Set Configure.php Files as "Read Only"</h2> <div> <p> It is important that you set permissions on the two configure.php files as Read Only. Typically this means setting them to <em>"644"</em>, or in some cases <em>"444"</em>. </p> <ul> The configure.php files are located in: <li>/<em><YourStoreFolderName></em>/includes/configure.php</li> <li>/<em><YourStoreFolderName></em>/<em><RenamedAdminFolderName></em>/includes/configure.php</li> </ul> <p> Quite often, setting permissions on a file to read only via FTP will not work. Even if the permission looks like it was set to read only, it really may not have been. </p> <p> Verify the correct setting by accessing the store to see if there is a warning message on the top of the screen: "<span class='errorDetails'>Warning: I am able to write to the configuration file:...</span>". In such cases, you will need to use the "<em>File Manager</em>" supplied by your web hosting provider. </p> <p> If you are using a Windows server, simply set the file as <em>"Read Only for Everyone"</em> and especially the <em>IUSR_xxxxx (Internet Guest Account)</em> user if running IIS, or the <em>"System Account"</em> or <em>"Apache User"</em> if running Apache. </p> </div> </div> <!-- End setConfigurePHPFiles //--> <div id="unusedAdminAccounts"> <h2>Delete Unused Admin Accounts</h2> <div> <p> In your ADMIN AREA, open the <em>"Admin Access"</em> menu and choose <em>"Admin Users"</em>. </p> <p> Delete any unused admin accounts. Especially the <em>"Demo"</em> account, if it exists. </p> </div> </div> <!-- End unusedAdminAccounts //--> <div id="adminPasswordSecurity"> <h2>Maintain Admin Password Security</h2> <div> <p> It is wise to use complicated passwords so that a would-be hacker cannot easily guess them. </p> <p> You can change your admin password in <em>Admin->Admin Access->Admin Users</em>, and click on the <em>"Reset Password"</em> button. </p> <p> We recommend that you use passwords that are at least 8 characters long. Making them alpha-numeric (including letters, numbers, upper-and-lower-case, etc) helps. </p> <p> If you are going to use normal words, it is a good idea to join two words that do not normally go together. </p> </div> </div> <!-- End adminPasswordSecurity //--> <div id="adminAccessProtection"> <h2>Admin Access Protection</h2> <div> <ul> Exercise caution while working in your admin area: <li> Use only one browser tab to access your ADMIN AREA </li> <li> Do not visit other sites when you have an active admin session, even if it is in another browser tab </li> <li> Always log out of your ADMIN AREA when not using it </li> </ul> </div> </div> <!-- End adminAccessProtection //--> <div id="protectDefinePages"> <h2>Protect "define pages" in "html_includes"</h2> <div> <ul> Protect <em>define pages</em> (Admin->Tools->Define Pages Editor) after editing: <li> Download a copy to your Local PC using your FTP software. <ol class="noteList noStyle"> <li class="no-left-margin"> They are located in the <em>/includes/languages/english/html_includes/</em> folder and subfolders. </li> </ol> </li> <li>Make them <em>CHMOD 644</em> or <em>444</em> (ie: <em>"Read Only"</em>). <ol class="noteList"> <li> <em>/includes/languages/english/html_includes</em> – and all files/folders underneath </li> <li> With some web hosting providers, you must use at least <em>CHMOD 645</em> or <em>CHMOD 555</em> for pages to display </li> </ol> </li> </ul> <ul> If you make them <em>"Read Only"</em>, then a would-be hacker cannot edit them if they gain access to your system, unless they can get permissions to change the <em>"Read Only"</em> status, which is more complicated. <li> <span class="errorDetails"> Once you set them <em>"Read Only"</em>, you will need to go and set them back to <em>"Read/Write"</em> before making additional changes using the define-pages editor, or uploading replacements via FTP, and then set back as <em>"Read Only"</em> again when done. </span> </li> </ul> </div> </div> <!-- End protectDefinePages //--> <div id="useHtaccessFiles"> <h2>Use ".htaccess" Files to Protect against Snooping</h2> <div> <p> Several folders, contain are <em>".htaccess"</em> files to prevent users from being able to browse through the files on your site unless they know exact filenames. Some also prevent access to "any" .PHP scripts, since it is expected that all PHP files in those folders will be accessed by other PHP files, and not by a browser directly. </p> <p> If you delete these files, you run the risk of leaving yourself open to people snooping around. </p> <ul> There are also some blank <em>index.html</em> files in several folders. <li> These files are there to protect you in case your FTP software would not upload <em>".htaccess"</em> files, or your server would not accept them. </li> <li> These only prevent directory browsing, and do not stop execution of .PHP files. </li> <li> This is a good "alternative", although using <em>.htaccess</em> files in all of these folders is the better choice for servers that accept these. </li> </ul> <p> In order for the .htaccess settings supplied with Zen Cart® to work, your web hosting provider must include either <em>"All"</em> or all of these: <em>"Limit Options Indexes"</em> parameters to the <em>"AllowOverride"</em> configuration in the server <em>apache/conf/httpd.conf</em> file. </p> <p> If your web hosting provider does not allow setting the <em>"OPTIONS"</em> directive, you will need to leave that line out or put a <em>"#"</em> in front of it. </p> <p> If your web hosting provider does not allow you to create/use your own <em>.htaccess</em> files, they may provide an interface in your hosting control panel where you can set the desired <em>.htaccess</em> settings. Work with your web hosting provider to configure these settings if this is the method they require. </p> <p> Your web hosting provider may use web serving software, such as <em>Nginx</em>, which do not use <em>.htaccess</em> files. </p> <p> In the case of <em>Nginx</em>, directives equivalent to the <em>.htaccess</em> rules are provided after installation of Zen Cart® to serve as a start point. These can be found in the "/<em><YourStoreFolderName></em>/zc_install/nginx_conf/" folder. </p> <p> It is best to work with your web hosting provider to select and implement the best method for your specific server. </p> <p> <span class="errorDetails">You need to choose, and use, the appropriate method for your server.</span> We cannot tell you what to use for your specific server, but we offer these guidelines as a starting point. </p> </div> </div> <!-- End useHtaccessFiles //--> <div id="protectFolders"> <h2>Protect your "images" and other Folders</h2> <div> <p> During initial installation, you are advised to set your images folder to <em>"Read/Write"</em>, so that you can use the Admin interface to upload product/category images without having to use FTP for each one. Similar recommendations are made to other files for various reasons. </p> <p> However, leaving the images (or any other) folder in read/write mode means that hackers might be able to put malicious files in this (or other) folder(s) and thus create access points from which to attempt nasty exploits. </p> <ul> Hence, once your site is built and your images have been created/loaded, you should increase the permission setting from <em>"Read/Write"</em> to <em>"Read Only"</em>. <li> On Linux/Unix hosts, permission setting recommendations for basic security are: <ol class="noteList"> <li> Folders and Directories: <em>CHMOD 755</em> </li> <li> Files: <em>CHMOD 644</em> </li> </ol> </li> <li> On Windows hosts, setting files as <em>"Read Only"</em> is usually sufficient. <ul class="noStyle"> <li class="small-string"> Double check that the <em>Internet Guest Account</em> has limited (<em>"Read Only"</em>) access. </li> </ul> </li> </ul> <p> The folders for which installation suggests <em>"Read/Write"</em> access for setup areoutlined below. </p> <p> If your site supports .htaccess protection, then you should use it for these folders. (The <em>".htaccess"</em> files included with v1.3.9 and newer should already cover the basics.) </p> <ul> <li> <em>/cache</em> <ol class="noteList"> <li> This is used to cache database information. </li> <li> The BEST security protection for this is to move it to a folder "above" the webroot (public_html or htdocs or www) area, so that it is not accessible via a browser. </li> <li> This requires changes to DIR_FS_SQL_CACHE setting in both configure.php files as well as the setting in the ADMIN AREA for the <em>Admin->Configuration->Sessions->Session</em> Directory. </li> </ol> </li> <li> <em>/images</em> <ul class="noStyle"> <li class="small-string"> This is discussed earlier in this article. </li> </ul> </li> <li> <em>/includes/languages/english/html_includes</em> <ul class="noStyle"> <li class="small-string"> This is discussed earlier in this article. </li> </ul> </li> <li> <em>/logs</em> <ol class="noteList"> <li> This is used to cache database information. </li> <li> The BEST security protection for this is to move it to a folder "above" the webroot (public_html or htdocs or www) area, so that it is not accessible via a browser. </li> <li> This requires changes to DIR_FS_SQL_CACHE setting in both configure.php files as well as the setting in the ADMIN AREA for the <em>Admin->Configuration->Sessions->Session</em> Directory. </li> </ol> </li> <li> <em>/media</em> <ol class="noteList"> <li> This is only suggested <em>"Read/Write"</em> for the sake of being able to upload music product media files via the admin. </li> <li> Could be done by FTP as an alternative. </li> </ol> </li> <li> <em>/pub</em> <ol class="noteList"> <li> This is used on Linux/Unix hosts to have downloadable products made available to customers via a secure delivery method which does not disclose the 'real' location of files/data on your server. </li> <li> This is to prevent the sharing of links by your customers that enable unauthorised downloads from your site. </li> </ol> </li> <li> <em>/admin/backups</em> <ol class="noteList"> <li> Optional. </li> <li> This is used by the backup module to store database backups. </li> </ol> </li> <li> <em>/admin/images/graphs</em> <ol class="noteList"> <li> This is used by <em>Admin->Tools->Banner Manager</em> for updating and displaying bar graphs related to banner usage. </li> <li> If not writable, this feature is ignored. </li> </ol> </li> </ul> </div> </div> <!-- End protectFolders //--> <div id="removePrintURL"> <h2>Remove Print URLs from Browser Headers</h2> <div> <ul> Stop your browser from printing a URL (which discloses your ADMIN folder name) on invoices: <li> On Internet Explorer: <ol class="noteList"> <li> Click on <em>"File"</em> then <em>"Page Setup"</em>. </li> <li> At page setup, remove this two character combination: "&u" from the header and/or footer text box. </li> </ol> </li> <li> On Firefox: <ol class="noteList"> <li> Click on <em>"File"</em> then <em>"Page Setup"</em>. </li> <li> In the <em>"Page Setup"</em> window, click on the <em>"Margins & Header/Footer"</em> tab. </li> <li> In the <em>"Header & Footer"</em> section, set all of the drop downs to <em>--blank--</em>. </li> <li> Remove all references to <em>"Title"</em> and <em>"URL"</em> if they appear. </li> </ol> </li> </ul> </div> </div> <!-- End removePrintURL //--> <div id="thingsToCheckRegularly"> <h2>Things to Check Regularly</h2> <div> <p> Be sure you have done all the steps listed in this document </p> <ul> Keep good backups of your website files and database (frequently) <li> Backup the database over a secure connection (ie: if you are using phpMyAdmin to backup, then make sure you are using HTTPS addresses in your URLs). </li> <li> Backup the website files over a secure connection (If you are copying files via FTP, be sure to use <a href="http://en.wikipedia.org/wiki/FTPS" target="_blank">Secure FTP</a>). </li> <li> Store the backed up database and website files into an encrypted file. <ol class="noteList"> <li> You should <em>NOT</em> keep your backups on your server. If you do however, encrypt them securely. </li> <li> Ask your web hosting provider for advice. </li> </ol> </li> </ul> <ul> Check your server errorlog regularly for odd or suspicious activity (Your hosting control panel should give you access to the Apache error_log) <li> Look for links that lead to pages outside your site </li> <li> Look for links where <em>"http"</em> appears after <em>"index.php"</em> </li> </ul> <p> Check your website files regularly to be sure nothing has been added or altered </p> <p> Ask your web hosting provider what they have done to be sure the server you are on is safe and secure so that outsiders cannot do any harm, and so that other websites on your server cannot be used to get to your site and cause any harm (in case they have security holes in them) </p> <p> If your business warrants, or you still want additional assurance (if running ther scripts outside of Zen Cart®), hire a security consultant to audit your site regularly. </p> <p> Check your Zen Cart <em>/cache/</em> folder for leftover files that do not belong there. </p> <p> Check your Zen Cart <em>/logs/</em> folder for <em>"myDebug-XXXXX.log"</em> files to see whether any errors are happening which need to be fixed. Delete the log files after you have addressed the errors. </p> </div> </div> <!-- End thingsToCheckRegularly //--> <div class="back-to-top"> ^^ <a href="#pageHeader">Back to Top</a> ^^ </div> </div> </section> <!-- End securingStore //--> <section id="helpSupport"> <div> <h1>Help and Support</h1> <p> For additional help and support, visit the <a href="https://www.zen-cart.com/tutorials" target="_blank">Zen Cart® FAQ</a> and the <a href="https://www.zen-cart.com/forum.php" target="_blank">Zen Cart® Support Forum</a>. </p> </div> </section> <!-- End helpSupport //--> <section id="footerBlock"> <div class="appInfo"> <p> Zen Cart® is derived from: Copyright 2003 osCommerce <br><br> This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; <br> without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE <br> and is redistributable under Version 2 of the GNU General Public License. </p> <p> <img src="osi-certified-120x100.png" alt="O S I Certified"> <br> This software is OSI Certified Open Source Software. <br> OSI Certified is a certification mark of the Open Source Initiative. </p> <p class="zenData"> Copyright 2003 - 2019 Zen Ventures, LLC <br><br> Zen Cart® <br> <a href="https://www.zen-cart.com" target="_blank">www.zen-cart.com</a> </p> </div> </section> <!-- End footerBlock //--> </div> </body> </html>