Securing the Application
phpBMS can store sensitive information such as user names, passwords, client data, and payment information that could be exposed to the internet insecurely.
Required Security Steps
-
Delete Installation Folders
You must delete both the core installation folder, as well as all modules' installation folders before you can use the system
-
Setup and Restrict Access to the Cron Script
phpBMS has a scheduler function that runs items on a timed basis using cron or another scheduler program to run php via command line. Check the Scheduler under the system menu after logging in for details on configuring this in your crontab file. Once configured, you will want to disable your web server from allowing this file to be called from your web server (the outside).
Additional Security Steps
-
Payment Information Encryption
If you plan on storing sensitive payment information such as credit card numbers make sure to enable the encrption option in the configuration page underneath the BMS module section. You will also need to create and link to an external file on the server that contains the encryption key. Typically, encyrption key files are text files containing a 64-128 character hash.
-
Run phpBMS On a Secure Connection (SSL)
Make sure that usernames, passwords, credit card and other sensitive information are not passed in clear text over the internet by running phpBMS over a secure socket layer. Even if phpBMS is not exposed to the Internet, and is setup on a local LAN, we recommend running it over SSL.
-
Limit Access to the Application
phpBMS is not designed to be used as a client portal. Allowing clients the ability to log in to our system could give access to sensitive information to clients, vendors, or sales partners.