Is it possible to make WHMCS even more secure?

[SilverNodashi]

I'd like to add a few points.

 

1. Using a .htaccess file to secure the admin folder is very good idea. This is the first level of security, and cannot be circumvented without the correct username & password.

 

2. Install something like Fail2Ban which can automatically ban an IP address for a preset amount of time, or infinitely on repeated incorrect password attempts - for example if someone is trying a dictionary attack, their IP could automatically be blocked from the server on the 10th retry. This could also be used for other stuff like SSH, STMP, FTP, etc. Train your users on this and it's like a dedicated security admin on your server.

 

3. Make the Admin staff sign an NDA (Non Disclosed Agreement) that they are not allowed to use / share / sell / etc any info from the system. This is something you definately have todo, whether the passwords are in clear text or not.

[Nick]

2. Install something like Fail2Ban which can automatically ban an IP address for a preset amount of time, or infinitely on repeated incorrect password attempts - for example if someone is trying a dictionary attack, their IP could automatically be blocked from the server on the 10th retry. This could also be used for other stuff like SSH, STMP, FTP, etc. Train your users on this and it's like a dedicated security admin on your server.

 

If you're using cPanel then CSF (ConfigServer firewall) + LFD work very nicely to achieve this. This includes major services such as SSH, FTP etc, as you mentioned, but also http auth if you enable it in the configuration.

[SilverNodashi]

If you're using cPanel then CSF (ConfigServer firewall) + LFD work very nicely to achieve this. This includes major services such as SSH, FTP etc, as you mentioned, but also http auth if you enable it in the configuration.

 

CSF can be installed on any server, not just cPanel. On a normal Linux / Plesk / Webmin server it's just a manual configuration, and there's not fancy interface, but it works as well

[brianoz]

I don't know of any professional service that offers this, however, and I'd be very leery of providing the raw code to a third party anyway, if I'd written something as valuable as WHMCS.

Know someone that does this service professionally? I'd love to know who.

I'm sure that sitepoint would have the ability to do this. As pretty much the premier PHP developers in the world they're very well known. They run the sitepoint forums which I believe are the largest and highest quality PHP forums in the world.

 

More info at http://www.sitepoint.com.au'>http://www.sitepoint.com.au (parent company) and http://www.sitepoint.com (forums)

 

(This is just an answer to bear's question in case it is ever useful, I'm not pushing WHMCS for a security audit, see my earlier post).

[riddell]

Does anyone know what this code injection hoped to accomplish?

/users/includes/jscript/,f=b.nodeType?:b;while(c=l.match.PSEUDO.exec(a))e+=c[0],a=a.replace(l.match.PSEUDO, HTTP/1.0