Increasing security measurements across the service

[domcloud]

Increasing security measurements across the service

[willnode]

This is a follow-up update.

As situation has been cooling down for weeks, so it's time to relax some rules regarding to firewall.

As of today, we have bring improvements to portal, especially the deployment feature. It is now possible to disable PHP execution and firewall, like this:

features:
- firewall: off
nginx:
  fastcgi: off

Unlike the past, we now allow all host turn off firewall explicitly, but with either condition is satisfied:

• PHP execution turned off fastcgi: off, or
• Using nested root public folder root: public_html/public

Why the conditions? We learn that most of attack is in websites with weak admin password and with application script files exposed to public root, like WordPress. So using nested root public folder root: public_html/public is essential to a website security, which is already been a common practice for modern frameworks like Laravel and all non-PHP apps running under Phusion Passenger. I believe static websites wouldn't cause much problem too so fastcgi: off is a viable alternative option to allow firewall turned off.

WordPress users may be affected the most, but I believe those who don't implement proper security also probably doesn't even know that they're under active firewall, as wordpress.org and other common APIs that required to run WordPress already on the whitelist.

On the side note, we have improved common functionalities like DNS and NGINX config checker, also added firewall check. And now you can also see deployment progress while it runs (no longer need to wait until it finished).

I will close this issue in later time, this issue isn't quite the right to post updates, actually.