mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-17 19:06:49 +03:00
Guidance required on security for BookStack #2343
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @techauthoruk on GitHub (Aug 3, 2021).
Hi
I am a VERY happy user of BookStack and am really impressed with its level of features, but I wonder if anyone could weigh in with their experiences of tightening security of BookStack.
I have been tasked with improving the security of both the app and server - not my field of expertise as I'm a Technical Author / Engineer, but I'm learning as I go... I don't really need suggestions on what to do, rather I need comments relating to the impact of enabling/implementing certain features within BookStack. I will summarise below (apologies for the length, but I'm trying to be thorough):
<Location "/uploads"> Options -Indexes </Location>ALLOW_ROBOTS=falseto the.envfile; I suppose this isn't necessary with public access off, but it seemed sensible to do. Is this the case?APP_URL- this is set to the specific https address of our instance in the.envfile - I assume nothing further is required for this?to the.env` file as well, more as a precaution - will this cause any issues?SESSION_SECURE_COOKIE=truein the.envfile even though the instance is served by https - again, will this cause issues?LOG_FAILED_LOGIN_MESSAGEoption to the.envfilestorage/uploads/imagesthen delete anything inpublic/uploads/images, but will my existing pages still be able to access the images once I have moved them? Also, what doesyou may have to clean-up and re-upload any ‘App Icon’ images, in settingsmean? Is this the 'Cleanup' option in 'Settings' 'Maintenance'?I think that covers everything - apologies for the length of the post and hope you can shed light on this for me!
Best wishes
Mark
@ssddanbrown commented on GitHub (Aug 3, 2021):
Hi @techauthoruk,
No way to apply to existing image uploads I'm afraid. I would advise that the
Options -Indexesis applied to your entire BookStack site, Not just the uploads.Disabling public access does add a good extra barrier of authentication and prevents a host of potential vulnerabilities being so much of a concern. Robots change is fairly redundant in terms of content being accessed but any extra anonymity is still good I suppose.
Yeah, As long as that's set to your https base URL then all good.
It would technically be more secure to leave this option empty unless BookStack is required to be served in an iframe on other sites. BookStack sets a high level of security on this by default then opens things up to allow iframe usage.
Should not cause issues. This is actually the default state anyway if you have a https-based APP_URL set.
If you have not already done so, Just installing Fail2Ban and enabling the option is not enough, You'll likely need to configure Fail2Ban to read the log messages and act upon them. Can go into a bit of a rabbit hole on this as details may change depending on operating system.
Make sure you do a backup of all files first. Image usage should remain as per before, and pages will still show those images. If an image is not found in the public space the request will go through BookStack which will check for active authentication. It can be a bit slower and potentially have issues on pages with many images but is often generally fine and adds a good layer of security to such images.
The "App Icon" note is in relation to the application logo setting. This image effectively has to remain in the public space due to being shown on the login/register etc... screen so re-uploading ensures it is put into the right place.
It's often about convenience but that can often lead to security. One less password/login for users to handle/store/lose. One less account for admins to remember to remove if someone leaves etc....
As an extra note, I'm currently working on MFA which will add some additional optional security to logins if desired.
Keep in mind this is still a fairly complex project maintained by a minimal team in free time, Vulnerabilities have and will again sneak into the codebase. One of the best things you can do, if not already signed-up, is sign up to the security updates email list: https://updates.bookstackapp.com/signup/bookstack-security-updates.
@Cave-Johnson commented on GitHub (Aug 3, 2021):
I would also recommend looking at putting your bookstack server behind an nginx reverse proxy and adding some additional security headers. A good starter config and description of the additional headers can be found here :https://gist.github.com/plentz/6737338
@ssddanbrown commented on GitHub (Aug 3, 2021):
An alternative, fairly digestible, guide to security headers, With apache config options, is Scott Helme's guide: https://scotthelme.co.uk/hardening-your-http-response-headers
@techauthoruk commented on GitHub (Aug 4, 2021):
@ssddanbrown - Dan, thank you for all the info. I have modified my changes in line with your comments, as well as implementing some of the things mentioned in Scott Helme's website. I think it's about as secure as I can make it for now. Thanks again Dan for all your input.
@Cave-Johnson - Thanks for the suggestion: currently we have one app behind an Apache reverse proxy, so I will ask our IT guys if they can do the same for my BookStack instance.
@ssddanbrown commented on GitHub (Aug 4, 2021):
When it comes to apache, You can easily add mod_security which adds an extra level or protection too, but might need to keep it in mind if you come across issues and you might need to tweak settings to be compatible with BookStack.
Will therefore close this off.