Haubergeon

Haubergeon provides some defense in depth by several mechanisms:

• Enforce IP-restriction on the use of certain roles (thus guarding against elevation by gaining a role or taking over a user account)
• Forbid access to non-whitelisted paths
• Forbid access to blacklisted paths

The module doesn't modify access callbacks or calls to user_access, but listens early in the request and terminates if certain conditions are met.

Vulnerabilities that occur pre-hook_boot execution and, depending on the haubergeon_drupal_error setting, those in full bootstrap or drupal_not_found() can still be exploited. In the latter case Haubergeon does its best to neuter $_POST/$_GET/$_REQUEST.

See README.txt for configuration options.

Warning

CAUTION: Enabling Haubergeon without providing configuration in settings.php will result in an inaccessible site.

To Do

Important features that are in development:

• Support for traffic from "trusted" proxies on the exemption & rolebinding lists.
• Support/Investigate IP exemptions & Varnish