Harden request headers, login interface and passwords to increase backend security.

Jung von Matt TECH

Last update: May 4, 2022

Related tags

Miscellaneous JvMTECH.NeosHardening

Overview

JvMTECH.NeosHardening Package for Neos CMS

Harden request headers, login interface and passwords to increase backend security.

Installation

composer require jvmtech/neos-hardening

Active by default

Remove Neos version info from request headers *
Set min password strength requirements

Optional features

Change the default login url "/neos" to something like "/neos-random-suffix" *:
```
JvMTECH:
  NeosHardening:
    loginUri: 'neos-random-suffix'
```

Limit login interface access to specified ip addresses:

JvMTECH:
  NeosHardening:
  allowedIPs:
    IPv4:
      - '172.20.30.40'
      - '172.20.0.0/24'
    IPv6:
      - '2001:0db8:85a3:0000:0000:8a2e:0370:7334'

Define password strength requirements, defaults:

JvMTECH:
  NeosHardening:
    checkPasswordStrengthOnAddUser: true
    checkPasswordStrengthOnSetUserPassword: true
    passwordRequirements:
      minLength: 8
      upperAndLowerCase: true
      numbers: true
      specialChars: false

*) Why hiding stuff?

Hiding the Neos version in the request headers and moving the login to an new url is nothing else than "security by obsurity".

Yes. But it's another layer to make it a little bit harder to get into your system. Therefore, it's a low-hanging fruit we should take.

by jvmtech.ch

SEOstats is a powerful open source PHP library to request a bunch of SEO relevant metrics.

SEOstats: SEO metrics library for PHP SEOstats is the open source PHP library to get SEO-relevant website metrics. SEOstats is used to gather metrics

1.4k Dec 28, 2022

Laravel style FormRequests for Symfony; inspired by adamsafr/form-request-bundle

Somnambulist Form Request Bundle An implementation of form requests from Laravel for Symfony based on the original work by Adam Sapraliev. Requirement

1 Dec 14, 2021

This document provides the details related to Remittance API. This APIs is used to initiate payment request from Mobile client/others exchange house.

City Bank Remittance API This is where your description should go. Limit it to a paragraph or two. Consider adding a small example. Installation You c

2 Oct 2, 2022

[READ-ONLY] CakePHP Utility classes such as Inflector, Text, Hash, Security and Xml. This repo is a split of the main code that can be found in https://github.com/cakephp/cakephp

CakePHP Utility Classes This library provides a range of utility classes that are used throughout the CakePHP framework What's in the toolbox? Hash A

112 Feb 15, 2022

Comments

FEATURE: Add option to check for consecutive numbers and letters in password

This feature will add further password checks and will allow developers to require passwords to have no more than x consecutive numbers or letters in the new password.

opened by Benjamin-K 1
Required password length is not taken from settings

Hey, nice package. I've already searched for a package to set the password strength for a while (see also neos/flow-development-collection#2662).

One little thing i found when checking the code: The required password length is currently hardcoded (See /Classes/Service/UserServiceAspect.php#L57). This should be changed to reflect the option defined in Settings.yaml.

opened by Benjamin-K 1
Throw error in Backend

When creating a User in Neos Backend it throws an Error 500 if the Password-Criteria is unmet. It would be way nicer to show this as an error in Neos-Backend instead 🤔 The password is too easy. Required is: MinLength >= 8, Numbers

Neos 7.3

opened by paavo 2

Harden request headers, login interface and passwords to increase backend security.

Related tags

Overview

JvMTECH.NeosHardening Package for Neos CMS

Installation

Active by default

Optional features

*) Why hiding stuff?

You might also like...

SEOstats is a powerful open source PHP library to request a bunch of SEO relevant metrics.

Laravel style FormRequests for Symfony; inspired by adamsafr/form-request-bundle

This document provides the details related to Remittance API. This APIs is used to initiate payment request from Mobile client/others exchange house.

[READ-ONLY] CakePHP Utility classes such as Inflector, Text, Hash, Security and Xml. This repo is a split of the main code that can be found in https://github.com/cakephp/cakephp

A htaccess boilerplate for all Magento Community installations. Features focus on speed, SEO and security.

This package is considered feature-complete, and is now in security-only maintenance mode

Here are few exercises to practice how to implement API Security with NGINX App-Protect WAF.

A PHP dependency vulnerabilities scanner based on the Security Advisories Database.

Your performance & security consultant, an artisan command away.

Comments

FEATURE: Add option to check for consecutive numbers and letters in password

Required password length is not taken from settings

Throw error in Backend

Releases(1.0.3)

1.0.3(Sep 28, 2022)

1.0.2(May 4, 2022)

1.0.1(Mar 30, 2022)

Owner

Jung von Matt TECH

Increase "Death by 1000 needles" attack up to 100x times

Exploiting and fixing security vulnerabilities of an old version of E-Class. Project implemented as part of the class YS13 Cyber-Security.

A Magento 2 module that enables configurable CORS Headers on the GraphQL and REST APIs

SAPI request and response objects for PHP 8.1

Simple loader to send request and read response from address.

FilterGuard is a simple PHP library for sanitizing data. It provides methods to sanitize strings, integers, floats, booleans, arrays, and objects. The library helps protect against common security vulnerabilities such as XSS and SQL injection.

Execute time consuming tasks as late as possible in a request

Simple game server with php without socket programming. Uses the Api request post(json).

Add the W3C payment request on Magento 2

Echo your public IP address with a very simple cURL request