<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/4.2.2">
</HEAD>
<BODY>
Hi Alan, Bastiaan,<BR>
<BR>
Just to share my thoughts :<BR>
<BR>
Le mardi 01 juillet 2014 à 09:12 +0100, Alan Lord a écrit :
<BLOCKQUOTE TYPE=CITE>
<PRE>
On 01/07/14 08:43, Zebra Hosting wrote:
> Since the CRM is used to store a lot of personal data, I was wondering
> how secure vTiger is and if there are any extra options we could discuss.
>
> Let me start with a few points:
> 1. At the login I don’t see something simple as brute force protection.
+1
</PRE>
</BLOCKQUOTE>
+1 -> A simple captcha is deceptive enough to robots (but also to humain -> See honeypots.)
<BLOCKQUOTE TYPE=CITE>
<PRE>
> 2. The standard admin user cannot be changed, it needs another account
> and then needs to be deleted. Using standard admin usernames is bad
> practice.
In 5.4.0 as long as you had another admin user configured and you logged
in with the new admin users credentials you could remove the default
"admin" user. Does this not work in 6?
</PRE>
</BLOCKQUOTE>
Agreed wuth Bastiaan it is a bad practice, sure it does work. Furthermore, I haven't found anything talking <BR>
about that substitution's workaround in the "official manual" also<BR>
even if it would, it looks like a risky operation for a average user. <BR>
BTW, is the admin user really wipe from database when doing this ? <BR>
<BR>
<BLOCKQUOTE TYPE=CITE>
<PRE>
> 3. Having the vTiger name and even the version number at the login
> screen makes it very easy for hackers .
I don't think this makes much difference frankly.
</PRE>
</BLOCKQUOTE>
I disagree on the principle : any easy gained valuable information is a tentation for easy *cracking*.<BR>
<BR>
<BLOCKQUOTE TYPE=CITE>
<PRE>
> 4. It would be nice to have a black/whitelist to restrict access by IP.
> (yes I know htaccess could be used but I talking about average users)
This should be done at the network level not at the application layer.
> 5. Use the <A HREF="http://www.projecthoneypot.org/">http://www.projecthoneypot.org/</A> project to ban access at the
> gate for spammers. (Works so very well in Joomla, I don’t need to use
> captcha’s anymore )
vtiger doesn't really have a public "form" as such so I don't see the
need for this? Maybe for the Customer Portal yes?
> 6. Big warning in the installer to use https:// to encrypt the
> loginscreen pw.
This would only really be required if the CRM is visible from the
Internet without going through a VPN surely?
</PRE>
</BLOCKQUOTE>
On those points, Bastiaan points something fondamental I think.<BR>
It is factual : users does this without even thinking of it as many host services companies<BR>
offers a one-clic hosted-and-ready-roll vtiger. This is not customer portal specific only issue.<BR>
<BR>
I personally wouldn't rely on the idea all users owns their<BR>
network, nor they can change relevant settings on it to achieve <BR>
better security in the software (if that makes sense)<BR>
<BR>
Actually the general assumption should rather be the exact opposite.<BR>
<BR>
<BR>
<BLOCKQUOTE TYPE=CITE>
<PRE>
> 7. Minimum password length/complexity
+1
Al
_______________________________________________
<A HREF="http://www.vtiger.com/">http://www.vtiger.com/</A>
</PRE>
</BLOCKQUOTE>
<BR>
</BODY>
</HTML>