I'm making an web application, it's a kind of online shop using PHP, jQuery, AJAX and JavaScript.
I want to launch my site on only one PC on local host. How should I set my site so that it only runs on my single PC?
Even if anybody copy my code files and database files to his/her own PC it should not run on their PC. How to do this?
The one way I know is by using the IP address. but I not quite sure about this method works or not.
If someone gains access to your source code then there is nothing that you can do to stop them.
When hosting it on your own you can prevent external access but beyond that there is nothing you can do.
You can use an encoder script to encrypt your source code, and some of these come with an ability to lock down to MAC address. I think they are all commercial solutions, though; start with IonCube and SourceGuardian. Zend might have something as well.
I would imagine each of these solutions would have comprehensive tutorials on their respective sites. Your workflow is basically to check out a copy of your source code from version control, and encode that folder as part of your build process.
Technically, encrypted code can be reverse-engineered, since the encryption key is built into the code. However, it is a lot of work for someone to do so, and even if they decode it, they won't have your comments or your meaningful variable/method/class names.
Make sure no one gains access to that PC (where your application resides). Only in that case you can protect your application from being run by unauthorized person. Once you take this security measure then you can easily disable your application from being accessed from any other LAN computers by using your IP. This is how professional servers works so should you.
You can change the webserver binding to localhost 127.0.0.1 only.
Alternative way you can create a filter rule that the server only accepts remote from localhost/127.0.0.1
With apache you can do this by .htaccess or directory/server rules.
When you want to share that code, you need to encrypt it with zend-guard or equal tools. there is also some licence management inside it, where you can bind licences to machines.
Related
I wrote an app for my customer in Symfony2 and we went public with that. However, I am learning right now that he had a separate Wordpress app within previous server to manage some separate product.
Now, he asks that we transfer that WP app on a new server. Being all security in mind, I cannot feel but nervous about potential impact here. I am to have the following URL setup:
www.myclientapp.com
www.myclientapp.com/some-wp
What are my options here? I can think of some, but any suggestion would be helpful.
Buy separate shared hosting and put WP there. Then do redirection from our website.
My VPS server runs with nginx and php-fpm. Can I utilize separate pools which would run under different user. I would need to review access privileges to Symfony's files.
In any case I would allocate separate mysql user and database. Those wold be enforced by strict privileges which prohibit access to my primary database.
Can you guys think of anything else?
My primary goal is: If WP is vulnerable, let it be. Under no circumstances I would allow it to compromise my Symfony2 app. I am primarily concerned about configuration files (app/config/*.yml) which contain sensitive data.
I will recommend that you use something like a sub-domain eg wp.symfony.com.
They may still be hosted on the same server, but using different virtual host directories.
With that, the apps will never see each other.
A way is running symfony under a different php-fpm user than the WP website and make sure the file/directory rights are set correctly. Then a WP exploit cannot write/read to the symfony files depending on the directory/file rights.
A better way is to use the php config open_basedir and isolate the two sites into their own "jails" this way PHP prevents including/reading files from other websites. See http://php.net/manual/en/ini.core.php#ini.open-basedir for more information.
For this to work the code should be separated into different directories, you can use nginx aliases or virtualhosts to point the domainname to the correct directory.
So I am developing some software in php and mysql. The clients web application is hosted on their server but basically I want an easy way to turn their site off if they don't pay. I wanted to be able to host a say config file on my server that has maybe an array of data that says how long their subscription is good for, what they have access to etc. I obviously don't want to save this information directly on their server because they could manipulate the config to have whatever they want. Their are a number of other things I would be using this for but for the most part these are the most important parts. Also if there is a better way I am always open to any suggestions.
Thanks in advance!
I recently built a web application for my company, and now they want it to support an offline mode. To complicate things, my company is very concerned about security and does not want me to use Xampp or Mamp. The application handles sensitive data and they think these programs will somehow make the data visible to the outside world (although I'm entirely sure this would be the case).
Anyways, I'm looking for a way to allow my application to run offline, and to also support the following technologies: PHP, MySQL, jQuery. The most difficult part of this is I need to execute PHP code outside of the typical server environment.
Can anyone please give me some advice on how I could implement such a system, and any associated vulnerabilities that I may face in terms of security and data storage?
Assuming you're installing this for an individual user on their machine - your best bet is to install apache/php/mysql, and configure apache to reject connections from any remote IP address.
The environment should be basically identical to your current application, but with only 1 user in the system.
There are some strange points in your question
now they want it to support an offline mode
Well, that's easy enough - get familiar with html5's offline features
To complicate things, my company is very concerned about security and does not want me to use Xampp or Mamp
Have you deployed your web app on a desktop machine? Or do you mean you are forbidden to use a webserver?? Xampp/Mamp are development tools - your public facing applications should be on a machine configured specifically for that purpose with a webserver running apache/nginx/iis/PHP5.4-builtin/whatever you like.
The most difficult part of this is I need to execute PHP code outside of the typical server environment.
How is your environment none-typical? Mike mentions php-gtk - but IMO you shouldn't go down that route unless you're requirements are "desktop app" + "absolutely must be written in php" - which is unclear from your question.
any associated vulnerabilities that I may face in terms of security and data storage
Well, anything you put in local-storage on a client (browser) the user can access - just bear that in mind. Don't send sensitive data to what is, from your perspective, an insecure and pseudo-public location i.e. some user's browser cache.
If you want to run html/javascript, you will probably need to run this in a server/client environment because a browser isn't capable of running the php and the php app as a stand alone app needs something to parse the html/css/javascript ( it needs the browser for it's presentation view ).
Best course of action is to put the application onto a server that you control access to. Set the access controls to specific IP addresses only, or even better if you can run it off an intranet behind a firewall where no one outside the network would be able to get to it.
PHP can run on a desktop environment, but they key here is that it won't run the javascript/html you use to display. You could use php with a third party library like php-gtk to make a desktop app that doesn't need a server or browser, but php-gtk doesn't have the best support.
If the application needs to store data for other computers/users to access, then it needs to be on a network. If it doesn't need to do this you might consider using a different programming language geared toward desktop applications so you can keep it entirely offline ( such a java or .NET ).
I am about to deliver an Adobe AIR app to a customer.
But it's my first delivery of any sort, I.e. I have
no experience whatsoever with licensing etc.
Users of this app may or may not be online, so
can't count on that. In fact it's 99% sure that
they will be offline.
Nor do I expect them to very tech-savvy, who will
spend enough time scouting for ways to "crack" it.
So, is there an okeish type of way to protect this
app. That is, I don't want people to simply copy
the installation folder, take it to another machine
and run it. It should be slightly harder than this.
Oh, and I am also using PHP and MySql, with which
this AIR app communicates. So anything you guys could
help me with is very very welcome.
protect the php api and not the frontend app. have a license key which is bound to an ip address and authenticate the request (which contains the key) is coming from the correct ip.
If you want to protect your Flex app you can use irrObfuscator. There is a 30 days free demo.
If you wish to obfuscate your PHP code I would suggest ioncube. There is an online obfuscator that you can pay per à-la-carte. Pretty usefull. Tho you need ioncube loaders which is a set of PHP extension that you will find into the products section. Not sure but I think you can install loaders without playing with PHP config so it's shared-hosting friendly.
You can not protect anything that's webbased or javascript based, purely because there is complete sourcecode.
Anyone who knows how to use 'right click' could copy your files. You can obfuscate your code, but you cannot protect it. If you think that this shouldn't be possible, write a desktop app in a 'real' programming language.
When the app installs, I would do the following:
Create a file in "app-storage" that basically indicates the app has been installed.
Fire off a service call and make a record of the install
Change a file in the app directory to indicate the app has been installed
On subsequent startups, check for the presence of the file as long as the file in the app directory indicates the app has been installed. If you see the customer keeps installing their app over and over, this could be flagged in their account and appropriate action taken. If you want to get fancy, the file in "app-storage" could a one-way hash of some information from the file in the app directory (install date?) plus some value baked into the AIR application.
In general, I think the key here is to trust your users and not make the assumption they are trying to steal. You want to make the system as painless as possible. It does not build a good relationship with customers when you treat them like criminals, so creating an "ironclad" approach probably isn't even the best idea.
I think pretty much the only good way to do this is to require activation after installing (online activation, with a phone backup).
From what you're saying, it seems like the backend is installed on-site and would not be able to provide adequate copy protection.
I am hoping there is a way to do this but have had difficulty searching because the terms all seem too general and the results don't seem to be what I'm looking for.
I travel a lot and am often in areas where the internet on a shared computer is the ONLY method for accessing the web. I can't use SSH or SFTP.
I would like to make a web page (hosted publicly, accessible to the world) that will 1) be password protected itself (can do that with .htaccess, pretty sure), and then 2) when logged in, will present me a list of links that IF CLICKED will rename, remove, or move files on a server that's NOT on the same server as the web page is served.
Can this be done?
Basically, with SSH I'd just ssh to Server 1 (where the web server is) and then ssh AGAIN to the Server 2 (where the files I want to access are). Easy. But with just access to HTTP, it seems like this is much more complex.
I suspect the method is to create public/private keys and then use some php commands to trigger processes that are tied to hyperlinks on the page? For example:
Delete file 001
Rename file foo to bar
My idea is that the "deletefile001.php" file would contain the necessary ssh and link to a bash script that does what I need it to. That way, I wouldn't need access to SSH directly. It would be done in advance, with the process started by clicking the link.
Lastly, what kind of security risks are there in this? Can spiders trigger the links automatically? I'm not worried too much about people accessing maliciously, but mainly about accidental triggering that would cause sudden loss of the files.
Any and all help would be fantastic. Thank you!
What you're looking for is a web-based FTP or SSH client, something that would be a very large task to code yourself. Here are a couple frameworks that I found after a couple minutes of Google searching. I cannot guarantee the quality or the security of any of these services, as I have not used them myself.
Open-source frameworks that you could install on your own server:
Web-based FTP framework: Monsta FTP
Web-based SSH framework: Web Console
Online services that you could use independently of your website:
Online FTP client: net2ftp
Online SSH client: consoleFISH