Q's on implementing a sitewide security plugin

Hi modx folks --

modx newb here. Just switched over to PHP programming after 11 years of classic asp coding with a custom cms and modules. Also, just starting out with modx, love the design, cleanness and extensibility of it.

Before I jump in and start using the modx CMF, Im looking to design/code a full, and relatively complete security modx plugin that implements OWASP Enterprise Security API and a bot firewall for the new 2.0 revolution release. (owasp enterprise security link --> http://code.google.com/p/owasp-esapi-php/)


Coupla quick questions before i jump in feet first:

1. Does anyone know if this type of an existing (or attempted) site wide security module has already been started? (I saw nothing like it in the security section of the extra/addons)

2. Im also looking to basically build a dynamic ’bot firewall’ to keep unwanted spider/scraper traffic completely off the websites I build w/ modx. ( This might be a separate plugin, or part of owasp security plugin above, not sure yet on the design details) --- The firewall will probably be something similar to the php ’crawlwall’ ---> http://www.crawlwall.com/. Basic concept: try to determine bot from human immediately, and block all bots before many/fast page views occur --- except google, live, yahoo, etc. Maybe a couple choice others, of course.

3. Is there a page or link to info on general best design patterns or best practices that work well for modx plugins and revolution 2? Ive googled a bit and see lots of implementations of: plugins, chunks, snippets; but not lots on theory or best practice uses. Any tips pointers in that direction much appreciated.

Plenty of Q’s to get me rolling -- lots more detail questions once code starts flying.

Thanks.
Dave M. ---> looking forward to productive time with modx development and learning.

I don’t think this has been done. There is an Evo Add-on built around PHP IDS, but I’ve no personal experience.

On the crawl wall that’s an interesting idea and I’d love to see that especially if it does throttling. Bing spiders can be a "bit" aggressive at time, but they’re certainly legitimate. And by bit I mean horribly aggressive.

There’s a few reference plugins you could view for ideas that install via the Package Manager. Discuss (threaded forums), a Native RTE (coming soon), a Gallery and more can be found there.

(And moving this topic to the Revo forum threads where it will receive some TLC... )

Thanks, RT for the comments and moving to revo forum (although I was hoping for find existing evo docs on building a somewhat complex modx module-- thinking none probably not yet available for the revo beta)

I just found the vid by Shaun M about basic revo package setup details here: http://vimeo.com/1968472 which was a nice help for making package installs universal...

....found some detailed module creation docs for 0.9.6 here --> http://svn.modxcms.com/docs/display/MODx096/Modules. --- Will that change much in the jump to 2.0? Im assuming probably so.

Im also looking to integrate several other commercial and open source php apps and their forms/front end into modules in modx. Basically so the client’s modx CMS + their external apps all look like one cohesive enterprise application to them. You know show up at one place to do all their biz work. I.e running the vtiger crm front end through modx module tabs, that would be a nice professional programming touch. Any tips/pointers for that type of conversion of existing app forms --> module??

If you haven’t figured out, I like to RTFM pretty thoroughly, first, before I plunge cluelessly into frigid waters with an IDE open. Has saved me lots of time later on

I assume that you’ve already been here, but just in case: http://svn.modxcms.com/docs/display/revolution/Developer%27s+Guide

Quote from: BobRay at Feb 24, 2010, 12:53 PM

I assume that you’ve already been here, but just in case: http://svn.modxcms.com/docs/display/revolution/Developer%27s+Guide

Tnx Bob, I did see that, just needs a module section to make me a bit happier. If i weren’t so green around the collar with modx I’d volunteer to write it up myself. (maybe after a month or so of coding I’ll have enough module chops to write a draft...)

thanks for the pointer. Still puttering around reading dox before I install revo for a while.

Dave

Modules are an Evolution-only concept and are gone in Revolution. Components in Revolution can define custom manager pages instead.

Technically, there are no Modules in Revolution.

The documentation is still a little thin, but take a look at Custom Manager Pages and Components.

Quote from: BobRay at Feb 24, 2010, 03:16 PM

Technically, there are no Modules in Revolution.

The documentation is still a little thin, but take a look at Custom Manager Pages and Components.

Quote from: OpenGeek

Modules are an Evolution-only concept and are gone in Revolution.

That certainly explains why I got so few hits googling ’modx +module +revolution’, huh? Thanks for the terminology correction/heads-up. Should make the hunt less painful.

Forgive me for the late response.

Quote from: wowzow at Feb 21, 2010, 11:34 AM

1. Does anyone know if this type of an existing (or attempted) site wide security module has already been started? (I saw nothing like it in the security section of the extra/addons)

Things like modSecure for apache and suPHP gives you some protection under the web server. The addition of a "gateway" interface to catch user input using your link will be interesting to see implemented.


Quote from: wowzow at Feb 21, 2010, 11:34 AM

2. Im also looking to basically build a dynamic ’bot firewall’ to keep unwanted spider/scraper traffic completely off the websites I build w/ modx. ( This might be a separate plugin, or part of owasp security plugin above, not sure yet on the design details) --- The firewall will probably be something similar to the php ’crawlwall’ ---> http://www.crawlwall.com/. Basic concept: try to determine bot from human immediately, and block all bots before many/fast page views occur --- except google, live, yahoo, etc. Maybe a couple choice others, of course.

A simple iptables or other firewall ruleset should easily block all of the bots dead at the door.

Quote from: wowzow at Feb 21, 2010, 11:34 AM

3. Is there a page or link to info on general best design patterns or best practices that work well for modx plugins and revolution 2? Ive googled a bit and see lots of implementations of: plugins, chunks, snippets; but not lots on theory or best practice uses. Any tips pointers in that direction much appreciated.

Between Bob’s site, these forums, and the other MODx support sites there is a massive amount of information.

You can also visit http://www.shawnwilkerson.com/code/modx_revolution/ to get to some resources which may help answer more of your questions.

You might find these useful:

http://iplists.com/.

http://www.kloth.net/internet/bottrap.php

http://www.kloth.net/internet/spam/spambots.php

I’ve thought about bad spider and email-harvester blocking, but just never had the time.