Login or Register

RSS IconRecent posts in this topic

avatar
rsherman on May 8. 2007. 11:47 am
I was wondering if anyone had any idea about how to secure some of the information that you post in aC. I am looking to manage account information that is very private. Does anyone have any suggestions about how to do this or can anyone give me an idea about the level of security that aC already has?

Or does anyone have a suggestion for a way to store secure information on the web?

Thanks!
avatar Staff
Ilija Studen on May 8. 2007. 1:11 pm
If data is really sensitive the best thing to would be to hire a security expert or system administrator who worked on systems that required tight security.

I would recommend you to use more secure version of PHP (check out Hardened PHP project) and SSL. mod_security is also a good solution, but there are some situations where it breaks activeCollab (search forum for more details on that) so you'd most probably want to turn off some checks to have a fully functional system.

As I said in the start, best thing to do would be to hire security expert to help you out.
activeCollab Team Member
avatar
lhd333 on Aug 25. 2007. 11:11 am
Can Google index content beyond the login screen? I know this is probably a stupid question, but I know little about security of these kinds of web applications.

Also, If I have my aC installation put on a secure platform, does it prevent clients from being able to log in?

Anyone out there know how to put aC on a secure server (under my shared webhost?)
avatar Staff
Ilija Studen on Aug 25. 2007. 11:16 am
lhd333:
Can Google index content beyond the login screen?


No, it cannot.

lhd333:
Also, If I have my aC installation put on a secure platform, does it prevent clients from being able to log in?

Anyone out there know how to put aC on a secure server (under my shared webhost?)


Can you please explain what do you mean by "secure server"?
activeCollab Team Member
avatar
lhd333 on Aug 25. 2007. 12:31 pm
Perhaps I really don't know. I suppose an https type security.
avatar Staff
Ilija Studen on Aug 25. 2007. 1:08 pm
You should check with your hosting provider about that.
activeCollab Team Member
avatar
levi on Aug 29. 2007. 11:07 am
to secure your webserver in general, you need an SSL cert, to have an SSL sert, your shared host has to support it, and you probably have to pay for it through them (about $100/year).

That only covers clients accessing the information. You still need to make sure your database is secure. If someone manages to access your database (steal your password or hack your website), or your database is being accessed across an unencrypted network (from your web server to your db server) any information can be easily stolen. In general, a shared host is NOT! a good place to store "very private" information. You really need a dedicated server with SSL enabled and enforced, with the webserver and db on the same server, or an SSL cert between the web and db servers, OR a private network containing the 2 servers.

again, a shared host is NOT a good place for very private information.

all in all, if you are worried about security, you should hire a security consultant. I am NOT a security expert.
Topic is locked. If you have something important to say about issues discussed on this page please write at hi@a51dev.com.

RSS IconRecent posts in this topic