Security concept for the dilbo application for the association.
Bonner_RuderGesellschaft_eV
As of: 21.02.2025 18:23:34
dilbo Server.
1.0.0
© dilbo.org
Club: Bonner_RuderGesellschaft_eV
Responsible for the operation of the dilbo.
Server:
Operator of the web server:
URL of the dilbo application: localhost
Date of AVV with the operator of the web server: 01.01.1970
dilbo version: 1.0.0
PHP version: 8.1.2-1ubuntu2.20
PHP extensions: Core, date, libxml, openssl, pcre, zlib, filter, hash, json, Reflection, SPL, session, standard, sodium, apache2handler, mysqlnd, PDO, xml, bz2, calendar, ctype, curl, dom, mbstring, FFI, fileinfo, ftp, gd, gettext, iconv, exif, mysqli, pdo_mysql, Phar, posix, readline, shmop, SimpleXML, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, xmlreader, xmlwriter, xsl, zip, xdebug, Zend OPcache,
Database Version:
Client info = mysqlnd 8.1.2-1ubuntu2.20, Server info = 8.0.41-0ubuntu0.22.04.1, Server version = 80041
Database User Password length:
8
User password security: 8 - 32 characters from
three groups of the following four groups must be included: Numerals,
lower case letters, upper case letters, special characters. Permitted
special characters are !"#$%&'*+,-./:;<=>?@[\]^_`{|}~
The application consists of an executable PHP script, which accesses accesses a MySQL database, and a file system for code storage Code storage, configuration and monitoring.
The file system is not externally readable except for selected directories. externally readable. Only the directories that are accessed directly via browser or accessed directly via browser or API: api, forms, js, license, pages, public, resources.
All other directories are readable both through authorization assignment, as well as by depositing a .htaccess file. file for access from the outside.
The application uses besides the standard modules of PHP no framework.
The technical user used to access the application's Database is stored in the configuration. This Configuration is located in the inaccessible area of the file directory and is not stored in plain text, but is additionally "hidden" by simple symmetrical scrambling and subsequent subsequent base64 encoding. This does not protect against real hackers, but it requires an access to the protected server area and is thus secured.
The application has a built-in load throttle that throttles throughput beyond max. 3000 accesses or API containers and max. 100 errors per hour on both the PHP application and the API. Beyond the limit web access or API containers are increasingly delayed.
The API and the PHP application encapsulate all database accesses, so direct SQL statements by the user are are not possible. On the API, up to. up to ten transactions bundled in a container, e.g. for synchronization of multiple data sets.
The user will be notified in the API for each containerauthorized. When using the browser, the successful login establishes a session, which in case of inactivity is closed after 600 seconds.
The communication takes place exclusively over HTTPS to protect the data from being read, lost and manipulated. protect. Use via HTTP is blocked in the Server setting.
Human users basically access... via PHP forms or pages access the data. Technical users, such as for example, a boathouse PC, can access via an API.
You authorize yourself for this with a Password, which is stored in the user record as a hash. To do this, the PHP supplied Hashalgorithm supplied with PHP is used in the default setting.
dilbo provides a Javascript application within the dilbo server package. This does not access the data directly, but via the API, just like any other client. There is no direct access from the efaWeb logbook application to the database.
It stores tables in the local storage except the persons and logbook table, which is only held in memory. The logbook data are only the last 50 sessions.
The dilbo application distinguishes six roles, those marked with *. marked are privileged roles, for which the Authorizations are listed by name below. Each role has basically all permissions of the role listed before:
The permissions for anonymous users are:
The permissions on the web are:
The permissions on the API interface are:
The application includes extensive monitoring logic as well as. the possibility of auditing.
Every transaction on the API, every login, every error and every data change, and every list deployment is logged. However, the corresponding logs are only accessible to users in the role of 'admin' role, as it also contains, in particular, in the data change log contains real data.
Users with an administrative privilege must be that their activity can be recorded and assigned.
The log is only accessible to users in the 'admin' role. can be assigned.
The application performs periodic "audits" during which the file access permissions in the application directory are corrected, if necessary.
Cron jobs are used for database control and allow the dispatching of personal logbooks to members.
All accesses are executed via HTTPS. Only during the installation, a one-time sftp access is required to store the installation file Installation file in the root directory. Upgrades also use HTTPS access to the dilbo server.
Data can be exported as lists via the API as well as via the User application to be exported as lists. The export via the API is required for the synchronization of the boathouse PCs with the server. The export as a list in the server application is for administrative purposes - it is written along with the exporting user and and requires the permission level "board".
Data can be imported as lists via the API as well as via the User application to be imported as lists. Importing via the API is required for the synchronization of the boathouse PCs with the server. Exporting as a list in the server application is used for Restoring backups and require 'admin' privileges.
In order to adequately ensure data protection. the following procedures for granting and verifying permissions. agreed.
Permissions will be assigned by a user with the the authorization "admin" after checking the function of the user in the club. The authorization "board" is thereby assigned only to function holders in the Association.
The authorization "board" or "admin" will be withdrawn in the event that the Association function from by a user with the authorization "admin" to "member". The user is set to the "anonymous" permission level when the user leaves the association set to the authorization level "anonymous".
Once a year, the permissions are checked by the operator of the of the application.
An automated deletion or anonymization of the data does not take place.
Once a year, this security concept will be updated and submitted the association's board of directors and the data protection officer for and the data protection officer for information and control of appropriate implementation of the application.
The following is a summary of the current Access Status and the current audit result is provided. Variable Information always refers to the last 14 days, thus represents therefore only represent a random sample.
With regard to the data sets, it should be noted that versioned tables. (boats, destinations, groups, persons) frequently contain more records than objects, because an object like the for example the person has several records with different temporal validity.
This monitoring information is also available to the administrator available online.
The access type is login, init (= page views), and error. (generated redirects to the error.php error page) are distinguished.
| Date | init | error | login |
|---|---|---|---|
| 2025-02-21 | 0 | 0 | 0 |
| 2025-02-20 | 1265 | 17 | 14 |
| 2025-02-19 | 3950 | - | 33 |
| 2025-02-18 | 3979 | 36 | 35 |
| 2025-02-17 | 5004 | 51 | 54 |
| 2025-02-16 | 5525 | 65 | 69 |
| 2025-02-15 | 5695 | 73 | 75 |
| 2025-02-14 | 5781 | 76 | 78 |
| 2025-02-13 | 6073 | 88 | 102 |
| 2025-02-12 | 6267 | 91 | 110 |
| 2025-02-11 | 6357 | 92 | 115 |
| 2025-02-10 | 6569 | 97 | 125 |
| 2025-02-09 | 6885 | 105 | 139 |
| 2025-02-08 | 7193 | 151 | 148 |
| 2025-02-07 | 7531 | 161 | 159 |
| 2025-02-06 | 7710 | 166 | 170 |
| 2025-02-05 | 8088 | - | 181 |
| 2025-02-04 | 8130 | 176 | 182 |
| 2025-02-03 | 8650 | 195 | 202 |
| 2025-01-31 | 9024 | - | - |
| 2025-01-30 | 9506 | 201 | 217 |
| 2025-01-29 | 9821 | 203 | 223 |
| 2025-01-28 | 10041 | 208 | 235 |
| 2025-01-27 | 10113 | 209 | 238 |
| 2025-01-26 | 10233 | 212 | 247 |
| 2025-01-25 | 11084 | 225 | - |
| Total days: 26 | 11112 | 229 | 257 |
| Author | Modifications: Count |
|---|
Users with special rights are listed by name here for the control of the security concept by the club board.
The users with privileged roles are:
admin: (1142) Alexa Alexa
On a daily basis, dilbo records the status in the form of an audit. At creation of the concept, an audit was performed, the result of which is is printed here as well.
2025-02-21 16:16:29: Starting audit 'dilbo' at 'http://localhost/pages/runCronJobs.php', version '1.0.0'
Starting audit at: 2025-02-21 16:16:29
Directory access right check ...
Forbidden directories access check
file permissions for App: drwxrwxrwx.
file permissions for Attachments: drwxrwxrwx.
file permissions for Authentication: drwxrwxrwx.
file permissions for Config: drwxrwxrwx.
file permissions for Log: drwxrwxrwx.
file permissions for Pdfs: drwxrwxrwx.
file permissions for Run: drwxrwxrwx.
file permissions for Tcpdf: drwxrwxrwx.
file permissions for Templates: drwxrwxrwx.
file permissions for Texts: drwxrwxrwx.
file permissions for Uploads: drwxrwxrwx.
file permissions for _Api: drwxrwxrwx.
file permissions for _Control: drwxrwxrwx.
file permissions for _Data: drwxrwxrwx.
file permissions for _Install: drwxrwxrwx.
file permissions for _Util: drwxrwxrwx.
Publicly available directories
file permissons for _forms: drwxrwxrwx.
file permissons for _pages: drwxrwxrwx.
file permissons for all_mails_localhost: drwxrwxrwx.
file permissons for api: drwxrwxrwx.
file permissons for forms: drwxrwxrwx.
file permissons for i18n: drwxrwxrwx.
file permissons for info.php: rrwxrwxrwx.
file permissons for js_01: drwxrwxrwx.
file permissons for license: drwxrwxrwx.
file permissons for not_in_package: drwxrwxrwx.
file permissons for pages: drwxrwxrwx.
file permissons for public: drwxrwxrwx.
file permissons for resources: drwxrwxrwx.
Framework configuration ...
api ()
synch_check_period = 60
synch_period = 3600
app ()
name = dilbo
version = 1.0.0
copyright = ©dilbo.org
url = https://www.dilbo.org
support_url = https://www.dilbo.org/request.php
database_connector ()
history = history
max_versions = 20
changelog_name = changes
logger ()
maxsize = 400000
remove_files =
pdf ()
footer_text = dilbo
margins = [15, 15, 15, 10, 10]
select ()
timezone =
language =
sport =
name_format =
ui_provider =
sessions ()
max_inits_per_hour = 3000
max_errors_per_hour = 100
max_concurrent_sessions = 50
max_session_duration = 7200
max_session_keepalive = 600
users ()
action_links = ["admin: <a href='../_pages/viewRecord.php?table=persons&uid={#uid}'> - i('uo2ViI|show')</a>,", "admin: <a href='../_forms/changeUser.php?uid={#uid}'> - i('vskZuv|change/delete')</a>,"]
user_table_name = persons
user_id_field_name = user_id
user_firstname_field_name = first_name
user_lastname_field_name = last_name
user_mail_field_name = email
user_account_field_name = missing_in_dilbo
useradmin_role = admin
useradmin_workflows = 0
self_registered_role = anonymous
anonymous_role = anonymous
form_fields ()
submit =
account =
password = ~
password_repeat = ~
password_delete =
search =
user_file =
import_config =
import_data =
reset_db =
efaCloud_password = ~
logo_file =
Table configuration check
_common [0*5],
_versionized [0*4],
archive [0*7],
assets [233*43],
badges [178*25],
changes [0*6],
clubwork [0*14],
crews [0*10],
damages [245*19],
destinations [45*20],
groups [0*13],
logbook [6057*19],
messages [550*14],
persons [3261*43],
reservations [9*18],
status [4*8],
trash [0*7],
uidindex [0*3],
waters [215*9],
wordindex [0*4],
workbook [0*14],
In total 10797 records in 21 tables
Users and access rights.
Count of privileged roles: bths - 0; analyst - 0; admin - 1;
Count of non-privileged roles: anonymous - 0; guest - 0; member - 0;
workflows:
No users for @1: write into logbook A, @2: write into logbook B, @4: write into logbook C, @8: write into logbook D, @16: write into logbook E, @32: Nachrichten hinterlassen, @64: Schadensmeldungen abgeben, @128: Boote reservieren, @256: Fahrtenbuch anzeigen, @512: Nachrichten lesen, @1024: Schadensmeldungen lesen, @2048: efaWeb: Reservierungen lesen,
concessions:
No users for $1: edit assets, $2: edit badges, $4: edit crews, $8: edit damages, $16: edit destinations, $32: edit groups, $64: edit logbook, $128: edit messages, $256: edit persons, $512: edit reservations, $1024: edit status, $2048: edit waters, $4096: edit workbook,
subscriptions:
No users for #1: personal logbook,
Audit completed.