Sentinel Admin Security - Advanced Protection

Highlights

• IP lock on unsuccessful logins in admin (brute force protection)
• IP whitelist for company networks with fixed IP
• Change the URL of the admin area

Features

• Log for logins and login attempts in the admin
• Mime type control for media upload
• Easily read the admin log using the free “Tools” plugin from “Friends of Shopware” via the log viewer

Description

Frequently Asked Questions

• What is IP blocking good for? IP blocking is a protective measure that is activated in the event of repeated incorrect login attempts from the same IP address. It prevents brute force attacks, where hackers try to gain unauthorized access by repeatedly trying passwords. The lockdown protects against such attacks, detects suspicious activity and slows down the attack process, which increases the security of online accounts and systems.
• How does IP blocking work? The IP lock acts as a shield against brute force attacks. In case of repeated unsuccessful login attempts, the system stores the IP address and the number of attempts. Once a predefined limit (typically 3 attempts) is reached, the lock blocks the IP address for about 30 minutes. This block prevents unauthorized access. The setting, for the maximum number of attempts, can be adjusted via the plugin. After a successful login, the counter is reset. This increases security, while legitimate users are still granted access.
• Help, I have locked myself out. What should I do? The spear is automatically removed after 30 minutes. If they want or need to access again faster, they need a database access. In the database table of the plugin you can unblock it.
• What is the mime type control? Mime-type control is a security measure used to check uploaded files for potentially malicious content. Before we dive into the details, here is a brief explanation of what a mime type is: A mime type is an identifier that indicates the content type of a file. It helps software applications find the right way to handle a particular file. When uploading files to the Media section, our plugin performs a mime-type check. Not only the file extension, but also the mime-type of the file is analyzed. This double check is important because file extensions could be manipulated to disguise malicious code. An example illustrates this: If someone wants to upload a file with the extension ".png", it is now not only checked whether the file extension "png" is allowed but also whether the mime type matches "image/png". If not, the file will be rejected to protect the system from possible attacks.
• Why was my media upload blocked? It may happen that a safe-looking file upload is rejected. If this happens through our plugin, the reason is that the mime type of the file does not match its extension. For example, a ".png" file could have the mime type "image/jpg" before uploading due to incorrect creation or conversions. Unfortunately, we cannot automatically detect such cases. To solve the problem, it is necessary to adjust the file to ensure that the extension and mime type are correct. This is important to ensure system security. Note that the list of allowed mime types comes from the Shopware underlying Symfony modules and was not created by us. This helps to ensure security and minimize risk.
• How or where can the logs be viewed? The log files are located in the default log directory of Shopware under var/logs/. In the admin they can be viewed with the free "Tools" plugin from "Friends of Shopware".
• How do I find out my IP address? On the Internet there are several online tools to find out your public IP address. However, if you want to be sure that you have the correct IP address or if the Shopware is connected to your local network, you can use the maintenance mode field of Shopware to find the correct IP.
Show all questions and answers Show fewer questions and answers