Security: eZ publish security

Table of contents:

This is a Stub article. Help the eZ Publish community by expanding it!

For a general description of security, we recommend Computer security on Wikipedia.

eZ publish is very secure! The U.S Department of Defense uses eZ publish!

eZ publish security

eZ publish in production! A look at hardening best practices.

"Also in productive environments the extension directory should not be any longer writeable to apache cause of security." -- [email protected]

Use a separate user for each eZ publish installation
Reduce user database server permissions to minimum.
1. Forum: MySQL Database Privileges Required

Use an browser and web server which supports ssl/https. Require all login and admin usage use ssl.
The use of ssl protects the clear text information (username and password) during transmission.

Use an httpd browser based authentication realm to protect eZ publish
The use of two forms of authentication, ACL and eZ reduces greatly the chance someone can compromise eZ publish

Do not use the 'admin' user. This is similar to the unix-like operating system's rule to use a non-privileged user as much as possible.
If you need more permissions, create a group called say 'ez-admin', and add a new user 'eza-john' to the group. Add permissions as needed to your group/user roles.