Contributed modules for Securing your Site
Among the thousands of modules on drupal.org there are over 100 in the security category. Unfortunately some of those are abandoned or inaccurately tagged. We've looked at every module and compiled this resource to help you understand the security-related community modules available. Not all modules provide security exactly, some are about hardening your site against weaknesses and others are about monitoring and reporting abuses.
This list will stay up-to-date as new modules are added and we will be expanding it for usefulness and to include our assessment of each module's capabilities.
Login and session
- Persistent Login
- How long, how many, and on what pages login is remembered
- Single Login
- Detect and prevent duplicate logins
Password
- Login Security
- Limit unsuccessful logins, ban by IP, notifications (i.e. prevent brute force password cracking attacks)
- Password change confirm
- Require existing password before changing password
- Password Require
- Require a password for submitting any form
- Password sentry
- Track logins
- Password Strength
- Check and enforce password strength
- Password Expire
- Passwords expire after a set time
- Password Policy
- Enforce password strength
- Salt
- Prepend a "salt" to passwords prior to storage (Not needed in Drupal 7)
- Secure Password Hashes (phpass)
- Store password hashes using phpass instead of MD5 (Not needed in Drupal 7)
Authentication
- PassWindow
- Two-step authentication via visual decoding with physical card
- OpenID
- Authentication via OpenID service (in core Drupal 6)
- Swekey
- Two-step authentication using USB key
- Windows Live ID
- Authentication via Windows Live
- YubiKey
- Two-step authentication using USB key
Analysis
- BadBehavior
- Monitor traffic and block spampots or malicious requests
- ClamAV integration
- ClamAV analysis of uploaded files
- GoAway
- Light-weight ban by IP
- HTTP Black List (http:BL)
- Implement the http:BL in Drupal, blocking requests from blacklisted IPs
- HTTP Reject
- Drupal-based request monitoring and rejection
- MD5 Check
- Create MD5 checksum of all Drupal files and monitor for alterations
- PHP Intrusion Detection System (PHPIDS)
- Implement the PHP Intrusion Detection System for monitoring and alerting for malicious visitors
- Remote File Inclusion Report
- Record attempts to have remote files included in Drupal
- Security Review
- Check for misconfiguration that leads to an insecure site
- Security scanner component for SimpleTest
- Penetration test your site
- Troll
- Track and ban IPs
Secure communications
- Client Side Encryption (cse)
- Encrypt data transfer between browser and server
- Encrypt Submissions
- Javascript encryption of form submissions
- OpenPGP
- Encrypt outgoing emails
- Secure by role
- Force certain pages over SSL
- Secure Pages
- Force certain pages over SSL
- Secure Pages Prevent Hijack - Prevent hijacked sessions from accessing secure pages.
Anti-spam and protection
- Prevent spam submissions
- Email2Image
- Obfuscate emails by displaying them as images
- Secure Permissions
- Control access to the permissions setting page
- Spamspan Filter
- Obfuscate emails
- GTSpam
- Obfuscate emails
- Paranoia
- Disable some of Drupal's features not necessary for all sites, like the PHP input filter.
- Paranoid Form Validator
- Reject form submissions containing potentially-dangerous input
Comments
Password change confirmation
Password change confirmation module:
http://drupal.org/project/password_change
Forces you to enter your current password when editing your user account page (user/your-uid/edit/*). Helps prevent any kind of XSS admin account attack.
Thanks Dave, great catch! I
Thanks Dave, great catch! I hope to spend some time trying to get http://drupal.org/node/86299 into core because of exactly what you say, it helps prevent an XSS attack changing the uid 1 password.
Encryption of database
A recommended best practice for Data Security in the context of EU Data Protection law compliance is that sensitive data (e.g. information about medical conditions, political beliefs etc) should be encrypted in databases. So basically data input on forms needs to (ideally) be stored in an encrypted form within the database.
This basically mitigates the risk to the data owner (the site owner) of personal data being disclosed if their database is compromised (e.g. an attack on a shared hosting environment or any other attack vector which allows a data export to be run on the database).
Any suggestions for modules which might support this kind of requirement?
Encrypt Submissions appears to meet the requirement (based on my reading) but I'd appreciate an insight on any other modules that might exist to meet this kind of requirement.
I don't know of any modules
I don't know of any modules that do that.
The closest I know is Creating a Sanitized Database which will help when sharing the database with developers or other folks.