Contrib documentation for security modules improvement

Thanks Coltrane for the review..

Just two cents about troll.. It may handle and avoid registrations using list of banned IP addresses, as well as (a feature I will request soon) deny registration using email addresses to be know as banned domains, so IMO they have something to do with security, even if they should be moved to a 'related' category.

For the rest of readers, Coltrane's blog post is license as Share Alike content. I'm not sure if this content could be introduced in D.O. due to license terms, if someone could point something about it I would appreciate any advice. If it is not possible, I will make my own review, but I'm afraid I'll reach a close "write up" as he already did. If there are no any concerns, I'm confident with Coltrane module revision and results, so I would suggest to use that work for this page, making the right license attributions.

Thanks for the tips about the categorization, I agree with you, looks a better approach.

I have introduced some changes. These are the current categories in the game..

* Secure communications (done)
* Session management (done)
* Password management (done)
* Authentication improvements (done)
* Spam control (will include badbehaviour in this list) (exists, and should be moved)
* IP blacklisting, atack detection and prevention (will include login_security here, as well as coder, as this one test for security vulnerabilities)
* Privacy management (done)
* Legal issues helpers (done)
* Uncategorized modules (paranoia and lockdown) (done)

So, the one missing right now is "IP blacklisting, atack detection and prevention". I'm reviewing the module list right now, but as I guessed, the final result is quite close to Coltrane's review (with some additions, and module rejections because of lack of code).

This one will include at least (close to coltrane's list):

GoAway, HTTP Black List and Troll for the black listing operations.
MD5 check, PHPIDS, for Prevention.
coder and security scanner for Detection.

The question is.. Should I separate "IP black listing" and "Detection and prevention" categories?

As you could see Access control is out of the list, the idea is to put a note in the "Security modules" handbook with the new location of the "access control" modules, under the "Content Management" tree.

Edited: typo.

I've created the tree behind the main security modules handbook. Some other handbook pages should be moved to get the tree completed, but this should be acomplished later IMO. I guess the following steps are:

• Set appropiate "Security Modules" handbook page content. I'm currently including a proposal in this comment.
• Move existing handbook pages to fit their right place in the tree:
• "Spam control modules" should go under "Security modules"
• (need to review) Bad Behavior module should be included in the "Spam control modules" category.
• "Login security module handbook" should go under "Password management" section
• Other Per-module handbooks if available should go into the selected module category (I'll provide a more detailed list of this movements).
• Complete the -Access Management modules- issue by creating a "Access management" handbook as child of "Contributed module documentation". This kind of page would resolve the differences between "Node Access", "User Access", "Taxonomy Access", "Group Access" and "Menu Access" categorization meaning just a permission management functionality.
• (this one I hate, but I should live with..) make an english grammar review of the content. Now it may be buggy, but it exists!

This is the proposal for the "security modules" page. I tried to focus on the important issues so people arriving here could be still be warned about changes in the handbook tree. This page should also be reviewed as soon as other child pages got their right placed in the doc.

------- cut here ---------

Security Modules Handbook

This page is a routed guide to help you find contributed modules related to security. You have reached here expecting some documentation, but this is a live process and you should realize current page status may be inaccurate. Please, browse this documentation and get your own conclusions about the module list, features and goals achieved. Once you have finished setting up and securing your site, you are kindly encouraged to update this information with your current findings.

Security is a huge concept that may vary depending on the speaker. This documentation has been written considering Drupal-ed audience, including site administrators that should be aware of security issues exposing their Drupal sites; module developers, to be able to test their on work for security vulnerabilities, and for end users, to be able to know and understand about security features available they would need or require when using a Drupal site.
Although the intention is to cover the whole spectrum, unfortunately the categorization should be done in a more technical way, and this is the outline we could provide.

Security modules category list

Using the module tagging facility you are able to do the following predefined searches, showing modules tagged using the selected tags. Your are advised, the results will probably be difficult to handle and make this filtering currently inappropiate.

• Security category (will provide the list of all modules tagged with the Security term)
• User access / authentication
• Spam prevention modules

Due to the previous exposed reasons, the following list introduces a more detailed categorization, including some module descriptions and handbook pages. This list was introduced to improve the reading and easy the access to the outline for these pages.

• Secure communications: In any case, when in doubt about security meassures, cyphering the communication is a good solution, and this modules provide that functionality.
• Session management: Control session usability and behaviour: duration, expiration, number of available sessions are examples of these control features.
• Password management: Enforce the complexity of a password, or control how many times a wrong login could be introduced blocking an account.
• Authentication improvements: Enrich the features of the authentication mechanism with more secure options. This is not a list of external authenticators (Windows Live ID, Google apps, Secondlife user, etc...).
• Spam Control Modules: If you experience undesired behaviour with automated bots or uncontrolled content, this modules will prevent your site from being abused.
• IP blacklisting modules: Sometimes the preivous meassures are not enough to manage your security risks, and the only solution is the real blockage of the site access.
• Privacy management: You store data from your users, make sure this information is not usable when being accessed by ways it should not be.
• Legal issues helpers: Probably the forgotten tale, but some regulations require non-technical compliance of simple tasks like: terms and condition acceptance, age validation facility, etc....
• Detection and Prevention: You can detect and find wrong behaviour in your site, or even vulnerabilities in your installation or in your code. These modules will help you to do so.
• Uncategorizable security modules: Yes, it is possible to create security modules that make amazing things, but that could not be categorized at all.

Important Notes

You should be aware that currently "Access control modules" (those providing "User Access", "Node Access", "Taxonomy Access", etc...) have been removed from this list. For so long the term "Security" had grown close to the term "Access", that now it is confusing some times. Documentation of modules providing "Access Control" features have been moved to Access management section within the scope of the Contributed module documentation section considering its functionality approach. This change also affects the Organic Groups family modules.

A more accurate search filter has been included in each category. This was intentionally, as new modules would be introduced in the CVS repository faster than this document would be updated. If you are looking for a module and can not find it, try the search queries at the bottom of each category handbook page.

------- cut here ---------

notes:
- Some handbook pages are being used as a tagging mechanism to have the same module being listed more than once in different categories. I don't know if this is right or not, but as an example: Authentication and login modules lists some modules and describes NOTHING at all. I guess this handbook is the right place to set the list of currently available external authenticators for Drupal: secondlife, windows live ID, google apps, and so. Including a description of the page usage should avoid the inclusion of security modules into the wrong handbook.

This is more or less the final content I guess would fit into the handbook.. Any comments?

Note: currently child pages have incorrect weights. To avoid almost void revision creation, I'll wait for other changes to be introduced in each child page (grammar review, other modules, whatever) and go correcting them in the future.

Thanks for the tips rfay. Unfortunately I'll be out the whole weekend untill tuesday. The proposed plan will take no more than 2 hours, but I guess I wont be able to do untill then.

Note: If any one is interested in keep the issue moving during these days feel free to do. I'll be back again after this little break.

I've see no concern about the new location for "Access" modules. I guess I would do some categorization with these kind of modules once I've finished this "Security modules" handbook, but I'm not sure about the quality I would get with it, becuase I seriously lack of access control experience far beyond the regular node access.

Cheers!

So, here we go!

Updated:

- Finally, now that Access Control modules handbook exists, I'm able to clean the old Security modules handbook.
- Updated content of Security modules, and now "Security Modules" links correctly to "Access Control modules"..
- I've moved Spam control modules as a child of Security modules.

Next steps:

- http://drupal.org/node/31637 should be moved. It is a contrib handbook of taxonomy_access module right in the middle of core documentation.
- (need to review) Bad Behavior module should be included in the "Spam control modules" category.
- "Login security module handbook" should go under "Password management" section (I will do)
- In general, other Per-module handbooks if available should go into the selected module category, so task is now seek and move.
- Write task in the issue queue of modules to move/review/create their appropiate handbook page in the right section.
- Provide a way for users to know that this handbook page exists from other D.O. places relating security of the Drupal setup.

I'm CEST (GMT+2) so we could meet at the end of the europe day, as we have done these previous days. I'll try to be on IRC tomorrow, it will not be possible today. Thanks rfay.