Piwik - Revision history

Maltfield at 17:04, 30 May 2018

2018-05-30T17:04:34Z

← Older revision		Revision as of 17:04, 30 May 2018
Line 266:		Line 266:
	*[[Website]]		*[[Website]]
	*[[OSE Server]]		*[[OSE Server]]


			[[Category: IT Infrastructure]]
			[[Category: Software]]

Maltfield at 01:08, 24 December 2017

2017-12-24T01:08:27Z

← Older revision		Revision as of 01:08, 24 December 2017
Line 262:		Line 262:

	TODO		TODO

			==See Also==
			*[[Website]]
			*[[OSE Server]]

Maltfield at 00:54, 24 November 2017

2017-11-24T00:54:14Z

← Older revision		Revision as of 00:54, 24 November 2017
Line 1:		Line 1:
			Note: OSE Decided not to use Piwik. The numerous security concerns documented below did not justify its benefits over awstasts. We should just use awstats.

	=Why=		=Why=

Maltfield: /* Numerous Vulnerabilities */

2017-09-25T23:53:58Z

Numerous Vulnerabilities

← Older revision		Revision as of 23:53, 25 September 2017
Line 43:		Line 43:
	The good news is they fix them. For example, this XSS mistake allowed anyone (even when not logged in) to update the plugin's settings--allowing anyone to add custom JS code to the WP website. This, of course, is extremely dangerous. After an [https://www.pluginvulnerabilities.com/2016/08/29/persistent-cross-site-scripting-xss-vulnerability-in-wp-piwik/ independent security researcher notified the developer], they pushed a fix 19 days later.		The good news is they fix them. For example, this XSS mistake allowed anyone (even when not logged in) to update the plugin's settings--allowing anyone to add custom JS code to the WP website. This, of course, is extremely dangerous. After an [https://www.pluginvulnerabilities.com/2016/08/29/persistent-cross-site-scripting-xss-vulnerability-in-wp-piwik/ independent security researcher notified the developer], they pushed a fix 19 days later.

	This is worth noting, but not necessarily bad. I'd rather use a mature project (and Piwik appears to be the most mature of its kind) ~~with many users~~ where vulnerabilities have been reported & fixed--rather than a smaller project whoose vulnerabilities simply haven't yet to be discovered..		This is worth noting, but not necessarily bad. I'd rather use a mature project with many users (and Piwik appears to be the most mature of its kind) where vulnerabilities have been reported & fixed--rather than a smaller project whoose vulnerabilities simply haven't yet to be discovered..

	=Install=		=Install=

Maltfield: /* Numerous Vulnerabilities */

2017-09-25T23:53:42Z

Numerous Vulnerabilities

← Older revision		Revision as of 23:53, 25 September 2017
Line 43:		Line 43:
	The good news is they fix them. For example, this XSS mistake allowed anyone (even when not logged in) to update the plugin's settings--allowing anyone to add custom JS code to the WP website. This, of course, is extremely dangerous. After an [https://www.pluginvulnerabilities.com/2016/08/29/persistent-cross-site-scripting-xss-vulnerability-in-wp-piwik/ independent security researcher notified the developer], they pushed a fix 19 days later.		The good news is they fix them. For example, this XSS mistake allowed anyone (even when not logged in) to update the plugin's settings--allowing anyone to add custom JS code to the WP website. This, of course, is extremely dangerous. After an [https://www.pluginvulnerabilities.com/2016/08/29/persistent-cross-site-scripting-xss-vulnerability-in-wp-piwik/ independent security researcher notified the developer], they pushed a fix 19 days later.

	~~That said~~, I'd rather use a mature project with many users where vulnerabilities have been reported & fixed--rather than a smaller project whoose vulnerabilities simply haven't yet to be discovered..		This is worth noting, but not necessarily bad. I'd rather use a mature project (and Piwik appears to be the most mature of its kind) with many users where vulnerabilities have been reported & fixed--rather than a smaller project whoose vulnerabilities simply haven't yet to be discovered..

	=Install=		=Install=

Maltfield: /* numerous vulnerabilities */

2017-09-25T23:52:30Z

numerous vulnerabilities

← Older revision		Revision as of 23:52, 25 September 2017
Line 37:		Line 37:
	For this reason, web application config files that contain passwords are usually located outside the docroot. This is a common/obvious practice that is either entirely unknown to the Piwik team, or simply undocumented. For example, wordpress will search one directory up above the docroot to find 'wp-config.php', which is where we store it at OSE.		For this reason, web application config files that contain passwords are usually located outside the docroot. This is a common/obvious practice that is either entirely unknown to the Piwik team, or simply undocumented. For example, wordpress will search one directory up above the docroot to find 'wp-config.php', which is where we store it at OSE.

	==~~numerous vulnerabilities~~==		==Numerous Vulnerabilities==

			There have been [https://www.cvedetails.com/vulnerability-list/vendor_id-9612/Piwik.html numerous Piwik security issues in the past], mostly in the old versions.

	The good news is they fix them. For example, this XSS mistake allowed anyone (even when not logged in) to update the plugin's settings--allowing anyone to add custom JS code to the WP website. This, of course, is extremely dangerous. After an [https://www.pluginvulnerabilities.com/2016/08/29/persistent-cross-site-scripting-xss-vulnerability-in-wp-piwik/ independent security researcher notified the developer], they pushed a fix 19 days later.		The good news is they fix them. For example, this XSS mistake allowed anyone (even when not logged in) to update the plugin's settings--allowing anyone to add custom JS code to the WP website. This, of course, is extremely dangerous. After an [https://www.pluginvulnerabilities.com/2016/08/29/persistent-cross-site-scripting-xss-vulnerability-in-wp-piwik/ independent security researcher notified the developer], they pushed a fix 19 days later.

	~~There have been [https://www.cvedetails.com/vulnerability-list/vendor_id-9612/Piwik.html numerous Piwik security issues in the past], mostly in the old versions.~~

	That said, I'd rather use a mature project with many users where vulnerabilities have been reported & fixed--rather than a smaller project whoose vulnerabilities simply haven't yet to be discovered..		That said, I'd rather use a mature project with many users where vulnerabilities have been reported & fixed--rather than a smaller project whoose vulnerabilities simply haven't yet to be discovered..

Maltfield: /* Unaddressed Wordpress plugin vulnerabilities */

2017-09-25T23:52:07Z

Unaddressed Wordpress plugin vulnerabilities

← Older revision		Revision as of 23:52, 25 September 2017
Line 37:		Line 37:
	For this reason, web application config files that contain passwords are usually located outside the docroot. This is a common/obvious practice that is either entirely unknown to the Piwik team, or simply undocumented. For example, wordpress will search one directory up above the docroot to find 'wp-config.php', which is where we store it at OSE.		For this reason, web application config files that contain passwords are usually located outside the docroot. This is a common/obvious practice that is either entirely unknown to the Piwik team, or simply undocumented. For example, wordpress will search one directory up above the docroot to find 'wp-config.php', which is where we store it at OSE.

	==~~Unaddressed Wordpress plugin~~ vulnerabilities==		==numerous vulnerabilities==

	~~TODO~~		The good news is they fix them. For example, this XSS mistake allowed anyone (even when not logged in) to update the plugin's settings--allowing anyone to add custom JS code to the WP website. This, of course, is extremely dangerous. After an [https://www.pluginvulnerabilities.com/2016/08/29/persistent-cross-site-scripting-xss-vulnerability-in-wp-piwik/ independent security researcher notified the developer], they pushed a fix 19 days later.

			There have been [https://www.cvedetails.com/vulnerability-list/vendor_id-9612/Piwik.html numerous Piwik security issues in the past], mostly in the old versions.

			That said, I'd rather use a mature project with many users where vulnerabilities have been reported & fixed--rather than a smaller project whoose vulnerabilities simply haven't yet to be discovered..

	=Install=		=Install=

Maltfield: /* Passwords stored in docroot */

2017-09-25T23:38:42Z

Passwords stored in docroot

← Older revision		Revision as of 23:38, 25 September 2017
Line 31:		Line 31:
	==Passwords stored in docroot==		==Passwords stored in docroot==

	~~TODO~~		Obviously, it's necessary for Piwik's configuration to have some passwords (ie: db user credentials). However, we should store these outside the docroot. Their [https://piwik.org/docs/how-to-secure-piwik/ How to configure Piwik for security] guide does not mention how to move this config file outside the docroot, which is stored in 'htdocs/config/config.ini.php' by default.

			If this file is hit directly, it won't output anything--assuming php is running. However, it is a possibility that apache's config gets fucked (ie: if someone at OSE has to step-up & do the sysamdin work, but doesn't know exactly what they're doing), and php isn't running. Then Apache will happily dump the contents of the config file, including passwords.

			For this reason, web application config files that contain passwords are usually located outside the docroot. This is a common/obvious practice that is either entirely unknown to the Piwik team, or simply undocumented. For example, wordpress will search one directory up above the docroot to find 'wp-config.php', which is where we store it at OSE.

	==Unaddressed Wordpress plugin vulnerabilities==		==Unaddressed Wordpress plugin vulnerabilities==

Maltfield: /* Step 7: Harden config file */

2017-09-22T15:40:20Z

Step 7: Harden config file

← Older revision		Revision as of 15:40, 22 September 2017
Line 222:		Line 222:
	...		...
	[General]		[General]
	trusted_hosts[] = "piwik.~~openbuildinginstitute~~.org:~~4443~~"		trusted_hosts[] = "piwik.opensourceecology.org:4444"
	force_ssl = 1		force_ssl = 1
	...		...

Maltfield: /* Step 7: Harden config file */

2017-09-22T15:39:59Z

Step 7: Harden config file

← Older revision		Revision as of 15:39, 22 September 2017
Line 217:		Line 217:
	<pre>		<pre>
	vim ${piwikDocroot}/config/config.ini.php		vim ${piwikDocroot}/config/config.ini.php
			</pre>

			<pre>
			...
			[General]
			trusted_hosts[] = "piwik.openbuildinginstitute.org:4443"
			force_ssl = 1
			...
	</pre>		</pre>