Security and backups

Two-factor authentication, the logs worth reading, integrity checks and a backup you have actually restored.

Bondry ships with the controls; this page is about turning them on and knowing where to look when something is wrong.

Two-factor authentication#

System > Settings > Two-factor authentication decides who is offered it and who is required to use it. Require it for every group that can reach the admin panel. It is the single highest-value setting on this page.

A member who loses their device uses a recovery code. An administrator can reset a member's two-factor authentication from the member screen, which is also why administrator accounts need it themselves.

Sign-in protection#

System > Settings > Login and registration covers the lockout after failed attempts, whether e-mail verification is required and whether new accounts wait for approval. Ban filters (see Members and groups) stop the account before it is created.

Logs#

System > Logs holds seven trails, and the first three answer most questions:

Log	What it answers
System log	What the application did
Error log	What went wrong, with the stack trace
Email log	Whether a message actually left the server
Task log	Whether the scheduler ran
Admin log	Which administrator changed what
Admin sign-in log	Who signed in to the panel, and from where
Search log	What members searched for

The admin log is the one to read after an unexpected change. Every sensitive action in the panel writes to it, with the account and the IP.

File integrity#

Bondry can verify its own files against the manifest shipped with the version you are running. A file that does not match was either edited on purpose or changed by something you did not authorise. Run it from System > Support after any incident, or from a shell:

Shell

php artisan bondry:integrity

Backups#

The updater takes a backup of the files it touches and dumps the database before applying an update. That is a rollback for an update, not a backup strategy.

A real backup covers three things:

the database;
the uploads directory;
the .env file, kept somewhere separate, because without the application key the encrypted license token cannot be read.

Warning A backup you have never restored is a hypothesis. Restore one into a throwaway subdomain once, before you need it.

Practical hygiene#

Keep APP_DEBUG off. In production Bondry refuses to boot with it on.
Keep .env outside anything the web server serves, with restrictive permissions.
Give the database user only the privileges it needs.
Apply security releases promptly. That is what the update window is for.