Difference between revisions of "X-Cart:Store Security"

From X-Cart 4 Classic
Jump to: navigation, search
(How to protect my X-Cart admin and provider areas with password?)
(How to secure your X-Cart)
Line 40: Line 40:
 
1. Ensure you have a secure https connection for your store using a valid SSL certificate.
 
1. Ensure you have a secure https connection for your store using a valid SSL certificate.
  
2. Do not use the “master” x-cart admin account. To change this, login using your “master” x-cart admin account, create a new administrator with a username that is less generic. Log in as that new user and delete the “master” user account.
+
2. Do not use the "master" x-cart admin account. To change this, login using your "master" x-cart admin account, create a new administrator with a username that is less generic. Log in as that new user and delete the "master" user account.
  
3. Immediately password protect your admin and provider directories. You can usually password protect these directories using a control panel such as cPanel, or you can use .htaccess and .htpasswd files (run a quick google search if you are unsure how).
+
3. Immediately password protect your admin and provider directories. You can usually password protect these directories using a control panel such as cPanel, or you can use .htaccess and .htpasswd files (Please find an example [[X-Cart:Store_Security#How_di_I_set_up_password_protection_for_my_X-Cart_admin_and_provider_areas.3F | here]], or run a quick google search if you are unsure how).
  
 
4. Be aware of your site’s file permissions, as having loose file permissions in conjunction with an exploit, can allow someone to write and execute files on your website – this is a very common exploit against x-cart so take this seriously. In general your file chmod permissions should appear as follows:
 
4. Be aware of your site’s file permissions, as having loose file permissions in conjunction with an exploit, can allow someone to write and execute files on your website – this is a very common exploit against x-cart so take this seriously. In general your file chmod permissions should appear as follows:

Revision as of 12:57, 20 June 2012

Introduction

X-Cart makes it easy for nearly anyone with the desire to establish an e-commerce store to do so, however not everyone has the background knowledge to know to address security issues. Many store owners begin designing, adding products, and focusing on sales and SEO without ensuring that their x-cart e-commerce store is developed in a secure environment with a focus on security. Once established often x-cart store owners are not aware of what is required to maintain their x-cart in a manner that keeps it secure over time.

The purpose of this tutorial is to assist you in understanding:

  • The importance of X-Cart security
  • Hosting X-Cart in a secure environment
  • How to secure your X-Cart
  • Maintenance of X-Cart security

The importance of X-Cart security

Website security should always be a priority, but is absolutely crucial when dealing with e-commerce stores that transact and store sensitive customer data such as email addresses, phone numbers, addresses, and credit card information. Reading through the x-cart forums you will find many x-cart store owners who have had the misfortune of having their x-cart hacked/exploited. Having worked with x-cart since 2002, I’ve had many of those store owners come to me asking what can be done to fix their store, and I have repeatedly heard the common response that nobody had ever talked to them about security and they were unaware of anything that needed to be done. Believe me when I say that if you are not aware of what is required to secure and maintain your x-cart, it is by sheer luck that your x-cart has not been hacked or exploited and it is only a matter of time before you become a victim. That said, by reading this tutorial you are well on your way to understanding and performing x-cart security to keep you and your customers safe.

Hosting X-Cart in a secure environment

The environment on which your x-cart is hosted is the base for all security, and if your host and/or server is not secure, all the security settings on your x-cart are not going to keep you from being exploited. There are generally two types of hosting: a shared server where you purchase a plan with a host and they provide you space for your site to reside on a server with many other clients, or a dedicated server, which is a computer where you can host your site(s) exclusively (a VPS is essentially a combination allowing dedicated server privileges in an environment shared with less users than with shared hosting).

Secured Shared Hosting

The main benefits of shared hosting is the reduced cost available by sharing the server with other users, and having the server company manage the server security. These same benefits can also pose a security threat however, as the sites of other clients can jeopardize your security if their sites are breached, and if you rely on a server company to secure a server and they fail to do so correctly, you can find yourself in serious trouble. To combat these potential problems, it is imperative that you host with a trusted hosting provider who makes server security a priority. View our recommended X-Cart Hosting providers.

Dedicated unmanaged server

I unfortunately often see x-cart store owners establish or move to an unmanaged dedicated server without knowing the onus of security that falls on them in doing so. When working with an unmanaged server, you are responsible for ALL server security. This includes the configuration of all your server settings, as well as keeping your kernel, os, php/mysql, control panel, etc. up-to-date as new branches and patches are released. This is a daunting task for anyone not very experienced with server security, and is not recommended for the average user.

Dedicated managed server

Surprisingly, having a managed server does not necessarily mean your server is secure. When purchasing a managed plan, it is important to know what the server provider will and won’t do as part of your managed plan; it is not uncommon for someone to established a managed server and setup their site(s) thinking the host will take care of security, only to find their server exploited to which the server company responds saying they only perform security tasks upon request. If you rely on your host for a fully managed security package it is important that you work with a trusted hosting provider who takes security seriously, and ensure that all aspects of security are accounted for.

Server Management Companies

Personally, I recommend an unmanaged dedicated server package and then using the services of a server management company such as EZSM or ServerWizards. These companies will configure your initial security settings, put processes in place to manage your security, and keep your server up-to-date as upgrades and patches are made available.

How to secure your X-Cart

After securing the hosting environment, it is necessary to address security with x-cart itself. Taking the following steps will make great strides in securing your x-cart:

1. Ensure you have a secure https connection for your store using a valid SSL certificate.

2. Do not use the "master" x-cart admin account. To change this, login using your "master" x-cart admin account, create a new administrator with a username that is less generic. Log in as that new user and delete the "master" user account.

3. Immediately password protect your admin and provider directories. You can usually password protect these directories using a control panel such as cPanel, or you can use .htaccess and .htpasswd files (Please find an example here, or run a quick google search if you are unsure how).

4. Be aware of your site’s file permissions, as having loose file permissions in conjunction with an exploit, can allow someone to write and execute files on your website – this is a very common exploit against x-cart so take this seriously. In general your file chmod permissions should appear as follows:

File Type Permission

*.php 644

*.tpl 644

*.pl 755

*.sh 755

/catalog/ 777

/files/ 777

/images/ 777

/var/ 777

/var/* folders 777

/var/* files 666

5. Turn off the option of sending credit card information in e-mails in the General Settings -> E-Mail Options section of your x-cart admin section.

6. Unless you are using the subscriptions module, do not store credit card information in your database. To disable, or to ensure that this setting is disabled, open your config.php file and ensure the $store_cc variable is set to false:

$store_cc = false;

7. It is always a good idea to log into your x-cart admin section using https so that the data you transact during the x-cart session is encrypted. The following code will force your x-cart admins/providers to login using httрs:// by redirecting them when httр:// is used.

Add this code to the .htaccess of your admin section (adjust your url):

# Force https on the admin section

RewriteEngine On

RewriteCond %{SERVER_PORT} !443

RewriteRule ^(.*)$ https://www.your-domain.com/xcart-dir/admin/$1 [R=301,L]

Add this code to the .htaccess of your provider section (adjust your url):

# Force https on the provider section

RewriteEngine On

RewriteCond %{SERVER_PORT} !443

RewriteRule ^(.*)$ https://www.your-domain.com/xcart-dir/provider/$1 [R=301,L]

8. The following .htaccess code, which can be placed in an .htaccess file in your store’s root directory (same directory as / and cart.php), will prevent access to sensitive areas of the x-cart file structure. If you are on a server that does not support .htaccess files, you will want to find alternate ways to block access to these files.

Options +SymlinksIfOwnerMatch -Indexes

RewriteEngine on

# Block access to sensitive directories

RedirectMatch permanent ^.*/.pgp/.*$ http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/patch..*$ http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/sql/.*$ http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/schemes/.*$ http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/skin1_original/.*$ http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/Smarty.*$ http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/upgrade/.*$ http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/var/.*$ http://www.yourdomain.com/x-cart-path/error_message.php

# Block access to sensitive file types

RedirectMatch permanent ^.*.(ini|tpl|sql|log|conf|bak)$ http://www.yourdomain.com/x-cart-path/error_message.php

# Block access to sensitive files

RedirectMatch permanent ^.*/COPYRIGHT http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/INSTALL.*$ http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/NEW.*$ http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/README http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/UPGRADE.*$ http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/VERSION http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/include/version.php http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/config.php http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/top.inc.php http://www.yourdomain.com/x-cart-path/error_message.php

RedirectMatch permanent ^.*/install.php$ http://www.yourdomain.com/x-cart-path/error_message.php

X-Cart 4.4or above
Note: If you use X-Cart 4.4 replace this line:
RedirectMatch permanent ^.*/var/.*$ http://www.yourdomain.com/x-cart-path/error_message.php

with these lines:

<FilesMatch !"\.(css|js)$">
RedirectMatch permanent ^.*/var/.*$ http://www.yourdomain.com/x-cart-path/error_message.php
</FilesMatch>
Otherwise speed-up tool for Javascript and CSS will not work!
Note: Change http://www.yourdomain.com/x-cart-path/ to the url to your error_message.php file.

How di I set up password protection for my X-Cart admin and provider areas?

Generally, the password protection can be done as follows (assuming that you want to use "abc123" and "123" as login/password):

1. Open the Summary page of the X-Cart Admin area by selecting Tools -> Summary on the Admin menu.

2. In the Environment info section, find and copy the X-Cart directory path (something like /home/user/www/xcart). You will need it a bit later.

3. If you have shell access to your hosting server, enter the following command:

htpasswd -c .htpasswd abc123

and then press Enter. Now enter the desired password two times (in our example, it is "123").

4. Copy the .htpasswd file to the X-Cart's admin and provider directories.

5. Open admin/.htaccess and paste the following data to it:

AuthType Basic
AuthName "Restricted Admin Area"
# In the line below, replace /home/user/www/xcart/ with
# the actual X-Cart path shown on your Admin summary page.
AuthUserFile /home/user/www/xcart/admin/.htpasswd
require valid-user

6. Open provider/.htaccess and paste the following data to it:

AuthType Basic
AuthName "Restricted Provider Area"
# In the line below, replace /home/user/www/xcart/ with
# the actual X-Cart path shown on your Admin summary page.
AuthUserFile /home/user/www/xcart/provider/.htpasswd
require valid-user

Alternatively, you can password-protect the admin and provider areas using the password protection setup facility in the Control Panel of your hosting account.

Five security features that you might not know yet

SECURITY_BLOCK_UNKNOWN_ADMIN_IP

The mode of enhanced protection. It allows you to control from which IP addresses users can access your x-cart.

By default, it is disabled. To turn it on, edit config.php file. Set this value

SECURITY_BLOCK_UNKNOWN_ADMIN_IP

to 'true', i.e.

define("SECURITY_BLOCK_UNKNOWN_ADMIN_IP", true);

Immediately you enable this mode, you should login to x-cart admin so that your own IP address is registered in the system. After that, no user will be able to login to the admin back end until you register his/her IP address: all login attempts will be denied and the users will get an error message.

If login/password, submitted by a user, are correct (i.e. correspond to the login/password of an existing user, and this user belongs to a type with permissions to access this x-cart zone), a request to register the user's IP address will be sent to x-cart administrator email.

This notification will have information about the time of the login attempt, the username and the IP address. Thus you can consider whether or not to grant access to this user: by simply clicking on a link in the email. As a result, the IP address will be registered in your store's list of allowed IP addresses.

More information: X-Cart:User Access Control

System Fingerprints

X-Cart uses MD5 (Message-Digest algorithm 5) for data integrity control. Using this tool you can create lists of MD5 checksums of all the files in X-Cart installation directory and compare checksum lists generated at different periods of time to verify the integrity of your X-Cart files.

In X-Cart, a list of MD5 checksums of all the files is called "system fingerprint". The first system fingerprint in your store is generated automatically during x-cart installation.

Any system fingerprint can be compared with the current state of the store or with any other fingerprint. This process allows detecting any changes in /xcart directory. You get a list of files which have been modified, added or lost (removed from the system or renamed so they cannot be identified).

You can use this tool to track the changed and suspicious files. For ex, you think your store has been hacked. You get the full list of the changed files and check/repair them manually.

More information: X-Cart:System Fingerprints

Protection from CSRF attacks (cross site request forgery attacks)

There is a built-in protection from CSRF attacks. Each form in the backend has a unique identifier which ensures that this form is valid. This unique forms are used for the protection.

Unique form identifiers are generated within a user session and assigned to each x-cart page which is loaded in the user's browser and which contains an HTML form for submitting data via POST. The main purpose of these identifiers is to ensure authenticity of the form when the form is submitted by the user: if the submitted form contains a valid form identifier, the form is recognized as that generated by X-Cart in the current user's session, and therefore it detected as valid and safe for use. If there is no valid form identifier, the form is treated as suspicious and the submit process is canceled.

Information about the CSRF attacks: http://en.wikipedia.org/wiki/Cross-site_request_forgery

There are sooooo many web applications that just don't have such a protection :-(

FRAME_NOT_ALLOWED

It is possible to forbid calling X-Cart in IFRAME / FRAME tags.

If you do not use X-Cart in any pages where X-Cart is displayed through a frame, you can enable this option as an additional security measure. It prevents such attacks that the attackers display X-Cart through a frame and, using browser vulnerabilities, intercept the information entered in the form.

To enable this feature, edit the following line in config.php:

define("FRAME_NOT_ALLOWED", false);

Blowfish encryption (merchant key)

Blowfish data encryption (based on Merchant key) is more secure than the usual encryption method. In this method, you create a Merchant key - a password that allows you to encrypt the details of your customers' orders and to decrypt previously encrypted order details when you wish to view them.

Such a higher level of security is because the key, used to encrypt and decrypt order details, is not stored anywhere in the system. The only thing that is stored is an MD5 signature of the key. When you need to access the details of a certain order, you manually enter your Merchant key into a special form on the 'Order details' page. In the next session, you will have to re-enter the Merchant key to get access to order details.

So if somebody steals your database and all files, he will not be able to steal the credit card numbers anyway.

More information: X-Cart:Blowfish

Maintaining X-Cart security

A big mistake I see with users of software is thinking they can setup the software and run the software for an indefinite period of time. It is imperative with x-cart, and all software you run for that matter, that you apply security patches and upgrade as new releases are available. While the patches and upgrades do require time and/or money to apply, neglecting to do so can be potentially fatal to your business and they need to be made a priority.

X-Cart provides security and release bulletins that you can sign up for in your X-Cart Account. Be sure to sign-up for these bulletins and stay on top of your security.

Hint: If you need to walk away from your computer for whatsoever reason even for just a few moments, log off from the admin area of your store or lock your workstation.

See also


Article copyright 2007 WebsiteCM.com http://www.websitecm.com/x-cart-tutorials/x-cart-security/