Download the PHP package jvmtech/neos-hardening without Composer
On this page you can find all versions of the php package jvmtech/neos-hardening. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download jvmtech/neos-hardening
More information about jvmtech/neos-hardening
Files in jvmtech/neos-hardening
Package neos-hardening
Short Description Harden request headers, login interface and passwords to increase backend security.
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package neos-hardening
JvMTECH.NeosHardening Package for Neos CMS
Harden request headers, login interface and passwords to increase backend security.
Installation
Active by default
- Remove Neos version info from request headers *
- Set min password strength requirements
Optional features
-
Change the default login url "/neos" to something like "/neos-random-suffix" *:
-
Replace the dynamic login url check with a custom RegEx (not needed if you just replace
loginUri): -
Limit login interface access to specified ip addresses:
-
Define password strength requirements, defaults:
-
An example for secure passwords (should be your standard because you use a password manager, right? 😉):
-
Disable user on too many failed login attempts:
- Prevent reuse of old passwords:
*) Why hiding stuff?
Hiding the Neos version in the request headers and moving the login to an new url is nothing else than "security by obsurity".
Yes. But it's another layer to make it a little bit harder to get into your system. Therefore, it's a low-hanging fruit we should take.
by jvmtech.ch
