Perplex Security Package. Useful security insights for all!

Transcription

1 Perplex Security Package Useful security insights for all! Created by: Jeffrey Schoemaker & Daniël Knippers Date first published: Last edit date:

2 Introduction We love Umbraco, we love dashboards in Umbraco and we love security. If you combine all these together you get useful dashboards with a quick overview of a lot of data in Umbraco and we would like to share some of our favourite security dashboards. The package includes: - Several new dashboards - A few new datatypes The ideas of the package is mostly based on the ideas that are described in two blog posts: - I have a dream about user management in Umbraco, by Jeffrey Schoemaker (October 05, 2015): and the mock-up - I have a dream about Umbraco and GDPR, by Jeffrey Schoemaker (December 04, 2017): and the mockup If you have any questions or remarks, please get in contact with us via daniel.knippers@perplex.nl, our website, or preferably via the Umbraco-forum.

3 User section If you have installed the package you ll get a few new dashboards into your user section. Activity log The first added dashboard gives an overview of all user authentication actions in Umbraco. With the introduction of Umbraco 7.7 also came along a few new user-events that are triggered when users perform actions in the Umbraco backoffice ( User actions like login and logout were only logged into the UmbracoLog-file on disk, but that file gets purged by default every 30 days. With this package we hook into these events and store them in a table so you can inspect them when needed. If you go to the User-section you will see this dashboard: In this overview you see all actions, and you can filter on date, specific user, event or IP Adress. You will also see if for example people are trying to guess loginnames. The implemented actions by Umbraco where we hook into are: - Account locked - Account unlocked - Forgot password request

4 - Forgot password changed success - Login failed - Login requires verification - Login success - Logout success - Password changed - Password reset - Reset access failed count All these events are implemented by Umbraco and if one does not trigger correctly, it will not be shown in the dashboard. In that case the best option is to create an issue on issues.umbraco.org.

5 Umbraco Security Settings On this dashboard you see an overview of the most import security settings in Umbraco. We chose to not give editors the possibility to edit these settings over here, but instead extend the Umbraco documentation and reference this. So power users / developers will know where to change these settings, instead of giving editors the possibility to change settings to rubbish settings and restarting the website each time they save the configuration (because they are stored in the web.config). The settings that are shown are: - Minimum password length - Minimum number of non-alphanumeric characters - Maximum Invalid Password Attempts - Password Storage Format - Use Legacy Encoding - Forgot Password link available on Login Page - Automatically logoff after X minutes of inactivity - Umbraco use SSL? - Max Request Length - Disable alternative templates? - Disable find content by id?

6 Lockout s On the last dashboard you can specify whether an administrator will receive an when a user gets locked out of Umbraco. The default behaviour of Umbraco is that when you get locked out, you cannot log in again until an administrator unlocks you, or you ll go into the Forgot password -flow (if available). Wouldn t it be convenient if an administrator gets an that an user was locked out, so he could go into the authentication log and details, and determine whether it were valid attempts, or somebody tries to get into the site. In this dashboard you can specify the receiver of the (an administrator preferably), the subject and the body of the . Within the subject and body of the you can use a few tags to dynamically insert some values: - [#username#]: The username of the locked user - [#datetime#]: The date and time that the account was locked - [#website#]: The name of the website

7 Member section In this section you ll get even more dashboards. Locked accounts A dashboard for locked accounts. This dashboard will work out of the box, because it looks to the Umbraco property Locked. From this dashboard you could lock one or more members directly. Unapproved accounts A dashboard for unapproved accounts: Here you can select one or more members to directly approve or delete them.

8 Activity log This dashboard gives a paginated overview of all events that have happened on a member: From here you can click to the specific member to get an overview of all their actions. This dashboard will only work by adding some custom code to your member login-logic on the frontend. On all the relevante actions you should add some code for the logging like: using PerplexDashboards.Models.MemberDashboard; using PerplexDashboards.Code; // Log a Login action of member, // after member has successfully logged in. int memberid = Members.GetCurrentMemberId(); MemberLogItem.Log(memberId, MemberAuditAction.Login); When implemented they will directly show up in the activity log dashboard.

9 Access log Because of GDPR it s a good habit to register which Umbraco User has viewed or edited data of a member. This data is private to a member and it should be registered when somebody has accessed it. This is shown in this dashboard. Note: To get this data to be shown in the dashboard you ll have to add one datatype to your membertype. - Create a new tab on a membertype called Access Log (or whatever you want to call it). - Add the datatype PerplexDashboards - Member Dashboard - Access Log with the name Access log (or something else). By doing this you ll track the individual view attempts on the user.

10 Password Policy On this dashboard you see an overview of the most import security settings for the member section. The settings that are shown are: - Minimum password length - Minimum number of non-alphanumeric characters - Maximum Invalid Password Attempts - Password Storage Format - Use Legacy Encoding

11 Member Type extension You ll get two additional datatypes that you could add to your Member Type. In the Member Type configuration add the following properties: These will show on an individual member their activity log (login, logout, etcetera) and the access log (who has accessed their data in the backoffice). Figure 1 Member 'Daniel knippers' is viewed several times by Umbracoo User 'techniek@perplex.nl'

12 Added stuff By installing this package you get three new datatypes: - PerplexDashboards - Locked Members ListView - PerplexDashboards - Member Dashboard - Access Log - PerplexDashboards - MemberDashboard - ActivityLog - PerplexDashboards - Unapproved Members ListView The first two are needed to be displayed on the dashboards and the last one is a datatype that you can add to a Member Type in the Member-section. By doing this you will get an overview of all events for that specific user: You have to manually this datatype to your specific Member type! This is not done on install.

13 New tables All events are logged into the tables perplexumbracomemberaccesslog, perplexumbracomemberlog and perplexumbracouserlog which are automatically created by the package. The userlog-table will be automatically filled with relevant data because there are events in Umbraco that are triggered where we hook into. For the memberlog-table you ll have to some lines of code yourself on the relevant places in your code. This can be done with this snippet of code: using PerplexDashboards.Models.MemberDashboard; using PerplexDashboards.Code; // Log a Login action of member, // after member has successfully logged in. int memberid = Members.GetCurrentMemberId(); MemberLogItem.Log(memberId, MemberAuditAction.Login); When implemented they will show up in the member-dashboard.

14 Configuration files The packages need two configuration files that are stored in /config/-folder in your Umbraco solution. Dashboard.config This file is a default Umbraco configuration file, that is used to show dashboards. On startup of Umbraco we will look at the dashboard.config-file (/config/dashboard.config) and we add the following section, if not already present: <section alias="perplexdashboards_memberdashboard"> <areas> <area>member</area> </areas> <tab caption="locked Accounts"> <control showonce="false" addpanel="true">/app_plugins/perplexdashboards/memberdashboard/html/lockedmemberaccounts.html</control> </tab> <tab caption="unapproved Accounts"> <control showonce="false" addpanel="true">/app_plugins/perplexdashboards/memberdashboard/html/unapprovedmemberacco unts.html</control> </tab> <tab caption="activity Log"> <control showonce="false" addpanel="true">/app_plugins/perplexdashboards/memberdashboard/html/memberslog.html</con trol> </tab> </section> <section alias="perplexdashboards_userdashboard"> <areas> <area>users</area> </areas> <tab caption="user Dashboard"> <control showonce="true" addpanel="true" panelcaption="">/app_plugins/perplexdashboards/userdashboard/html/perplex.userdashboard.html</control> </tab> </section> If you want to hide one or more of our dashboards you can remove them over here.

15 userdashboardsettings.config This is a configuration file to store the Lockout- s that can be configured on the tab Lockout s in the User-section. On install it looks like this:

16 Wishlist Hopefully we can extend the functionality in the near future even further. Some of the features we would like to build are: - We would like to extend the Security settings dashboard with some additional properties: o MaxAllowedContentLength o MaxRequestLength (in the Umbraco-folder) o MaxAllowedContentLength (in the Umbraco-folder) - Add the possibility to send the lockout also the involved Umbraco User. Currently it s only possible to send it to the administrator, but it would be really useful if also the user would receive this so he could identify suspicious behaviour - Create a NuGet-packages for this Some known Umbraco issues Our package mostly gives insights for the events that are triggered in the core of Umbraco. We have some known issues that we cannot solve in our package but should be solved in Umbraco Core: - Add UserEvents for enabling and disabling users: - Failed Logon attempts resets to 0 after maximum number of attempts: - PasswordChanged event triggered twice when changing password on Avatar-click: - AccountUnlocked, PasswordChanged AffectedUserId and UserId are switched in the user event: - No affecteduser in UserEvents should be NULL: References - Perplex Internetmarketing, - Package url, - Issue-log Umbraco Our other Umbraco packages: - Umbraco Forms on Perplex Steroids, - PerplexMail, - Official Kraken Image Optimizer plugin for Umbraco,

17