16

Hopefully a new release will be made for the API Key extension soon. Here are detailed instructions for creating one manually without needing to get access to your database through phpMyAdmin, mysql on the command line or some similar MySQL database administration tool. Usually it is a good idea to create a special separate contact for each service that ...


9

With situations like that I simply just disable the group. The ACL still works, but users don't have access to add anyone to the group. If you need to add someone else to the group, just enable, add and disable again. Heather.


8

Disabling security notifications hides the notice from your users, but it won't hide your sites from attackers. Turning off the warning supports a scenario where those sites are at risk longer. Here's how we handle it for our hosting clients - Create a recurring item in your calendar for the CiviCRM security release dates, first and third Wednesday each ...


8

Whether or not https is used would be dependent on the CMS, but this is certainly recommended. Other than making sure the Access AJAX Api permission is set up for a particular CMS user, you will also need to pass a user api key that is assigned to the CiviCRM contact record associated with that CMS user. Details at: http://wiki.civicrm.org/confluence/...


8

The REST API requires that you specify the site key and an API key. Details can be found here.


8

CiviCRM does not do anything special to either keep your data secure or insecure. It stores data in a MySQL database like lots of other applications. The security is more in the way you configure your database server and the way CiviCRM (which is a web application and not a desktop application) can be accessed from outside. A little more information in ...


7

How hard this will be depends on how determined the service abuser is to adapt to the defenses you introduce, and how easy a target your site is compared to other sites available to the attacker. If you are seeing a significant level of abuse, this indicates that your site is one of the lower hanging fruit. Here are a couple of options I've seen have good ...


6

There is a security notification civicrm group that you can subscribe to on civicrm.org https://civicrm.org/advisory/subscribe Security updates and notifications have not been tied as yet. Definitely this would be a good addition to the project


6

I've posted an advisory now: CIVI-SA-2015-008: Access bypass in CiviCRM 4.6.7 CiviCRM 4.6.7 introduced an access bypass issue which applied a limited number of sites. The issue affected only certain configurations, where the site used ACLs to limit access, and applied to users whose permissions included “access CiviCRM” and “view my contact” but not “...


6

Generally when evaluating security, you need to balance likelihood and severity of threats against the resources available to counter them. A human rights organization that was a client of mine had information on activists in their CiviCRM instance who could be imprisoned or killed by their governments, with sophisticated, well-resourced governments ...


6

It is but isn't specific to civicrm - the problem in that scenario is allowing anonymous signup without either administrator approval or email verification. Set at least the setting in drupal user settings that sends an email to the email on file and then the owner would have to click a link to verify it.


6

First of all, I should say that this is a job for someone who is reasonably technically minded and comfortable with using the command line. If this doesn't sound like you, then I would suggest that you look for help with this - perhaps from the person that installed CiviCRM in the first place. You can find detailed instructions in the Administrator Guide. ...


6

Besides keeping things up to date as you mentioned, a number of security principles can be helpful from steps needed for PCI Compliance. There are a couple of questions here about that topic: CiviCRM & PCI Compliance How hard is it to obtain PCI compliance? Here is another helpful question/answer about security and Civi, but with reference to Joomla (...


6

CiviCRM is a web-based tool and has no desktop component. It is thus as secure the server which hosts it, be that a local one or a remote one. There are occasionally security flaws found in the software, just like any other package. The CiviCRM team then fixes those and releases new versions. You can find more information about CiviCRM security here: ...


5

This is a result of someone going in CiviCRM and deleting the Home location type, either through Administer > Customize Data and Screens > Dropdown Options > Location Types or clicking the wrench next to the dropdown of location types on some other form. It's obviously not a good idea to do that if you have a lot of email addresses, phone numbers, and ...


5

Change all cron jobs and scripts that use the site key for authentication Reenter any passwords, specifically payment processors and mail/sms passwords All prior checksums sent in the last 7 days (if that value has not been changed), will no longer work A grep for SITE_KEY in the code base will uncover a few more things :)


5

Pantheon does not support .htaccess files nor custom location directives, which are the common approaches to protecting those files from access on Apache / Nginx. However, moving your CiviCRM file directories from sites/default/files/civicrm to sites/default/private/civicrm should resolve this, because Pantheon protects that location out of the box. See ...


5

You can (and should) resolve this by removing that dompdf.php file from your system. It sounds like the previous version codebase was not removed during your most recent upgrade. CIVI-SA-2015-001 was a security release which removed dompdf.php from the CiviCRM installation, as it permitted attackers to read arbitrary files from your webserver. This permits ...


5

we have a slightly different approach for an enhanced security architecture using a proxy-server plus vpn. If you are interested, please sind more information plus code on GitHub, there was also a session on last year's CiviCon. Let me know if you have any questions regarding CiviProxy. Kind Regards Fabian


4

Please follow the steps in the link one by one Link: https://wiki.civicrm.org/confluence/display/CRMDOC/Upgrading+CiviCRM+for+Drupal+7#UpgradingCiviCRMforDrupal7-1.DownloadthemostrecentCiviCRMPackage I guess this helps !!!


4

It can be time consuming and thus expensive to do security upgrades, especially on a site that has custom code. Monitoring requires some setup and sometimes an ability to respond quickly when something goes wrong. Some providers bundle these services with hosting. Others provide them without the hosting. I would compare the full cost of migration + hosting ...


3

Note that in 4.6 the in-app notifications have already been improved to display security updates as different from normal updates, and seperate display preferences for both.


3

Note that a lot of work has happened on CRM-13823 that would facilitate this, primarily a rewrite of the System.check API. That work will land in 4.7 - it's not merged in core, but can be found here. If you want the functionality you're describing now, and you run Nagios/Icinga, consider installing CiviMonitor.


3

There is a useful little CiviCoop extension called group-protect to mark a group as protected. You can use this to protect your ACL groups and assign a permission to those who should edit them.


3

You should be able to use the functions in: CRM/Utils/Crypt.php to do symmetric encryption/decryption of the fields. Password related fields in the CiviCRM db are encrypted. As Lesley mentions, there are two aspects to this problem. Encrypting data, and restricting access to the data to a certain class of users


3

Your proposed solution in your nginx config looks about right; here's a tested & working example: location ~* ^/sites/(.*)/files/civicrm/(ConfigAndLog|templates_c|upload|custom) { deny all; } Here are some things you could check. Have you reloaded nginx since making the config change? Pick a file in files/civicrm/custom/ and try to access it in a ...


3

Whilst this may not be a good idea if you don't have infrastructure to keep on top of upgrades & security issues, the setting can be found in: Administer > System Settings > Misc. the notifications are set in the dababase in the civicrm_setting table (along with lots of other useful little settings :)) From the "name" column, we can ascertain that: ...


3

Use the Net tab within Firebug while loading the page. It'll display all the page components that get loaded. Something in your page (whether you put it there or not) is attempting to load something (an image, a script, who knows) from that domain.


3

I'm guessing the advisory will be posted any moment, but you should be able to go to 4.6.12 instead of jumping to 4.7. I believe the 4.6.x branch is now a LTS branch so you don't need to go to 4.7 immediately. Update: The advisories have been updated (shortly after I posted) and also an email has been sent to the security list (subscribe here): This is a ...


3

The key operative word is ofcourse 'reasonably' :-) I do not have in-depth knowledge of server security or configuration but I tend to explain that the most secure setup is the one where your public facing website and CiviCRM are on separate servers. The first should be in the WWW, the second in a VPN. Ideally the two communicate via CiviProxy so you can ...


Only top voted, non community-wiki answers of a minimum length are eligible