Explain Security in Layman's Terms

HI

used modx for a few client sites now. but have one that is being fussy and wants to know why he should use modx. so just looking for some detailed documentation about the security that modx implements to protect both the manager and web users. so i can let him know why he should use it.

note he is currently using a htaccess secured site so if possible to reference the flaws in that compared to modx would be nice.

thanks

What I tell my clients:
If you install modx and dont have any security warnings from modx about register_globals or your config file permission then your are "normal" safe. You always
need to subscribe/check --> your host and CMS’s RSS-feeds about security updates!

To be more safe your data has to be encrypted (SSL) and you can secure/lock the server with firewalls and make use of SSH (puTTY client instead of normal ftp)
and have IP-addresses assigned to each users.

For running a web store, encryption is prefered, but for a normal information site you are fine. Good tip is changing passwords often and have them
case sensitives with some letters uppercase and some lowercase together with number combinations.

The last incident report for modx security only targeted thoose not having register_globals set off.

I am not a security expert but limiting yourself to using .htpasswd over some other form of authentication vs. having a web platform that saves you time, effort and therefore money in the use of your website doesn’t make sense.
WHat kind of information is being collected/stored that security is a big risk? Are the servers shared or private? Who has access to the server? Who has access to the data? Is the webserver itself secure. Just because you use a folder password won’t prevent naughty folks to hack into it via some method.

Security is a compromise between protecting the information that needs protecting and usefulness.

On defending modx: These same folks will tell you they don’t shop on the internet but give their credit card to some underpaid gas-jockey in a strange town.

I think smashingred summed things up nicely. Security isn’t a one part problem it’s a lot of little things that hopefully add up to a secure solution.

I know I have had sites defaced on shared servers due to clients with weak passwords, out of date scripts, or just risky settings such as register_globals.

I guess technically every solution can be breached and as such if the information is that important it shouldn’t be online or on an internet enabled computer. As far as modx goes none of my modx sites have been defaced to date, but if anything that just means my current measure of protection are working for now...

Like windows or any other operating system as long as you take the right preventative measures your site will be fine. So keep it updated, ensure you have good passwords, ensure you don’t assign more permission than needed to accomplish any job, and make sure that your host is keeping your server as safe as they can (configuration wise... the DCs are next best thing to fort knox)

AMDbuilder

All that having been said, Apache’s .htaccess password protection is very strong. It’s also fundamentally different from the way that MODx implements access restriction, in that MODx uses PHP scripts to determine a user’s access to MODx web pages only whereas .htaccess-based passwords are handled by the web server itself and can grant or restrict access to any and all files or scripts.

For most purposes, I trust MODx’s security model and use it to serve appropriate content to different users. But if (for example) I had a directory full of PDF files with privileged information in them (say legal documents whose disclosure could put witnesses at risk or proprietary business secrets), then I would definitely use .htaccess to protect those. MODx wouldn’t limit access to downloadable files (PDF, JPG, DOC, etc.) if someone knew their URL, whereas .htaccess could (and could also force the use of SSL encryption for users with permission to access these files). You could have a MODx page that gives out the .htaccess login info to web users who have logged in if you wanted to combine the two methods.

We have one site that requires people to login in order to view some PDF technical documents, and we do this using MODx’s web user system (users not logged in get a login form and no links; logged-in users get links to the PDF files). But we do this because these files aren’t really all that top secret, since people could share the URLs to download them and others could then bypass this system. If we really cared about keeping access to these files strictly limited to certain users, .htaccess would be the only way I’d want to do it.

So if what you want to protect is content generated by MODx or in your database, then the MODx security system is probably the best choice, especially given that it’s an integrated part of the system. But if you want to protect other files (and you want to protect them well, not just keep their URLs under wraps), then consider using .htaccess. You can use both systems in combination in all sorts of creative ways as well, so it’s not a matter of choosing one or the other.

You could probably come up with other ways to secure files without using .htaccess (e.g., store them in a directory outside of your public web root and use a script to serve them to authenticated users), but usually it’s not necessary to reinvent that particular wheel.

Nothing that you put on the web is 100% secure, of course. If someone is able to gain access to your server then they will be able to bypass .htaccess protection as well as MODx’s web user system. And if the server is not in your control then the server admins, law enforcement agencies, and who knows who else may also snoop through your stuff.

@ZAP if you want added security for files download check http://modxcms.com/FileDownloadPE-2088.html
I use it on my site and it’s work awesome.

Quote from: sinbad at Dec 09, 2008, 12:38 AM

@ZAP if you want added security for files download check http://modxcms.com/FileDownloadPE-2088.html
I use it on my site and it’s work awesome.

It is indeed a very nice snippet, but the security that it adds is just obscuring the file’s URL (which is good enough for most of the uses that I personally would have, but wouldn’t cut it for the more sensitive examples that I made up above).

defiantly, wasn’t planing to argue what you said, just a heads up in case you weren’t aware of this snippet; back on topic IMHO extra sensitive info shouldn’t be accessible online in first place.

Quote from: sinbad at Dec 09, 2008, 10:57 AM

IMHO extra sensitive info shouldn’t be accessible online in first place.

I totally agree with that, but often the trade-off between absolute security and being able to access and collaborate on materials like this blurs the line (especially if the security issues aren’t understood).