paimpozhil / magefirewall

Magento Firewall for securing your e-commerce system.

MageFirewall

Magento Firewall for securing your e-commerce system. Tested to work with Magento 1.6 and above.

###Features

• Neat Dashboard.
• Alert / List about recently modified files which has potentially dangerous code.
• Incorporates rules from NinjaFirewall to analyze / stop the attackers.
• Scan your magento from internet for security issues on your magento.
• Scans your magento installation from within and checks if you have unpatched security issues.
• Has Whitelisting / Blacklisting.
• Prevents bruteforcing on your admin credentials / adds attackers to black list.
• Debug / Diagnostics / Ninja Firewall Consoles availabe.

More information & support available at http://www.magefirewall.com

Install

Shell

change directory to your magento directory

cd /path/to/magento
curl https://raw.githubusercontent.com/paimpozhil/MageFirewall/master/install.sh | sh

FTP

Download the https://github.com/paimpozhil/MageFirewall/archive/master.zip and extract the folder called MageFirewall-master.

Upload contents to the root folder of your Magento installation.

Support

Need support?

Please buy Installation / support from http://magefirewall.com

Beta

MageFirewall is in Beta, so please use carefully. You should test this extension in a testing / staging enivornment before pushing to a live site.

We accept no responsibility if this plugin causes any downtime to your store or locks you out from the Admin area. If you are concerned about errors that may occur we offer a paid support service.

Credits

Thanks to NinjaFirewall , We used rules/some code from their free/opensource version.

http://ninjafirewall.com/

magefirewall's Issues

If i add the firewall to php autoprepend I get this..

Fatal error: Uncaught exception 'PDOException' with message 'SQLSTATE[42S02]: Base table or view not found: 1146 Table 'magento.ncjgb_nf_options' doesn't exist' in /srv/magento/lib/Zend/Db/Statement/Pdo.php:228 Stack trace: #0 /srv/magento/lib/Zend/Db/Statement/Pdo.php(228): PDOStatement->execute(Array) #1 /srv/magento/lib/Varien/Db/Statement/Pdo/Mysql.php(110): Zend_Db_Statement_Pdo->_execute(Array) #2 /srv/magento/app/code/core/Zend/Db/Statement.php(291): Varien_Db_Statement_Pdo_Mysql->_execute(Array) #3 /srv/magento/lib/Zend/Db/Adapter/Abstract.php(480): Zend_Db_Statement->execute(Array) #4 /srv/magento/lib/Zend/Db/Adapter/Pdo/Abstract.php(238): Zend_Db_Adapter_Abstract->query('SELECT * FROM n...', Array) #5 /srv/magento/lib/Varien/Db/Adapter/Pdo/Mysql.php(428): Zend_Db_Adapter_Pdo_Abstract->query('SELECT * FROM n...', Array) #6 /srv/magento/lib/Zend/Db/Adapter/Abstract.php(737): Varien_Db_Adapter_Pdo_Mysql->query('SELECT * FROM n...', Array) #7 /srv/magento/lib/firewall/firewall.php(45): Zend_Db_Adapter_Abstract->fetc in /srv/magento/lib/Zend/Db/Statement/Pdo.php on line 234

Use this kind of code to find the ip address of remote user

Hi All

You should use this and not use the $_SERVER['REMOTE_ADDR'] directly;

Store the $ip_address at one place at lib/firewall.php and it use it at all the code and not get it from the $_SERVER

if(isset($_SERVER['HTTP_X_FORWARDED_FOR']) && $_SERVER['HTTP_X_FORWARDED_FOR'] != '') {
$ip_address = $_SERVER['HTTP_X_FORWARDED_FOR'];
} else {
$ip_address = $_SERVER['REMOTE_ADDR'];
}

Problem using some dutch city names

Some dutch city names start with ' like 's-gravenhage or 's-Hertogenbosch
When a customer uses these names in the checkout the firewall prevents the order from going thru and a error message is displayed.

The firewall logs mentions this a leading quote error.
Problem is that customers from cities starting with 's are unable to place an order thru magento.

Sollution might be to allow 's-

Delete the old namespace files

also make sure etc/config/ xml has the right filename

Breaks login to the admin if someone has an IPV6 address

We have a client that cannot use the admin from their corporate network due to it being IPV6. Had to disable it. Hope this helps someone out there because it took me forever to figure out why it worked everywhere else.

Blocking post with rule 0

I have some problem with blocking by your firewall with rule 0. There is not such rule so thats why its not possible to disable or change such rule.

How to Test on localhost server?

How we can test on local host server.
now i wants to get only last edited files.

Our Namespace is bad

I think you have used the namespace as Mage and Wall as the app name

Namespace Mage should be already used by the magento core..

we should just use MageFire as the namespace and use Wall as the app name

WhiteList area is blank and sorting does not work

when i click on the sorting columns it just says 404 error.

rule 0 how to disable

I have a lot of blocked by firewall connections with rule number 0. But there is no such rule. How to stop using rule 0. Other rules i can enable and disable but there it is not possible with rule 0 because this number not exist

After Installing We are not able to login to Admin panel

Hi,

We have used this extension in our shop, We are able to install successfully, admin login panel loads. but login is not working. Is any specific things need to set up.

Thanks
Mohsin

Dashboard

a) Create a Menu called "Dashboard" under that page show these under different links/areas.

Add a toggle button to Turn the firewall on/off. when it is switched off..// firewall.php must NOT be active entirely...

Check your MageFirewall configuration.. (check if lib/firewall/firewall.php is loaded and say yes /no )

Check your server security overview from MageFirewall servers