camindo CMS for server administrators

Argon2id with pepper

Password hashes according to OWASP, additionally peppered via HMAC with a server key. A database dump alone is of no use to attackers.

Signed rights tables

User accounts, user groups and rights carry HMAC signatures. Writing directly to the database does not grant anyone rights.

Key rotation via CLI

key rotate re-encrypts all data, re-signs it and migrates passwords softly. If it is aborted, nothing is lost. A backup runs automatically beforehand.

Encrypted fields

AES-GCM with AAD for email addresses, TOTP secrets, messages and freely definable encrypted fields. A value copied into another row cannot be decrypted there.

Two-factor authentication in the backend

TOTP according to RFC 6238 with replay protection, recovery codes and email code. TOTP can be made mandatory for superusers.

Two-factor authentication in the frontend

Configurable per customer area: off, optional, on an unknown device or always. TOTP with QR code or email code; SMS can be connected.

Brute-force and flooding protection

Sliding time windows, the lock also applies to unknown names, throttling per IP and address. The keys are stored only as HMAC.

Session hardening

A new session ID at every sign-in, cookies with HttpOnly, Secure and SameSite. A password change ends all other sessions.

Device management

Notification by email for a new device. Devices and sessions can be viewed and ended; “Sign out on all devices” is built in.

CSRF protection, three times over

Mandatory token, write actions only via POST, and Origin check in the backend. Frontend forms also require a mandatory token.

Content Security Policy

In the backend always script-src with nonce, without unsafe-inline. In the frontend it can be enabled per instance, with report mode and a reporting endpoint.

XSS filter in both directions

A whitelist sanitizer runs on writing and on reading. It defuses entity tricks, nested tags and javascript: URLs.

Security headers

X-Frame-Options, frame-ancestors, nosniff, Referrer-Policy and HSTS as opt-in. Default values per context; the template can override them.

Upload hardening

Server scripts are never accepted, active content from the frontend is always rejected. Such files are delivered with sandbox, nosniff and attachment.

ImageMagick policy

A custom policy.xml is always active, plus a MIME-based coder prefix, resource limits and a version warning. SVG and PDF are only processed after explicit approval.

Tamper-proof audit log

Every change with a before/after comparison, stored in the file system with an HMAC chain. The chain is checked automatically every day.

Fine-grained rights

Rights per module, instance, language, content area and owner. They are enforced in the user interface and on the data level.

Prepared statements

All database access uses bound parameters; SQL is never assembled from user input.

Dependencies at a glance

composer audit and composer outdated every day. Security advisories appear directly as a warning on the start page.

Operations monitoring

The start page checks the cron heartbeat, backups, write permissions, updates and the audit chain.

Clean directory structure

Only public/ is the docroot. Keys and access data are stored outside it with permissions 0600. Code never gets from the database into the file system.

Passwords via ENV

Passwords can be set via environment variables instead of in the config file, ideal in virtual environments.

Limits of security

Anyone who gains direct access to the file system holds all the cards, including access to the database and keys.