Security

This module simply exports the permissions configuration of a Drupal 7 site to CSV for auditing.

Find the local CA peer verification file to allow drupal to access HTTPS sites.

Lockr is an off-site key management service for Drupal allowing you to store API and Encryption keys using the Key module effortlessly.

Lockr is unique in that there are host specific sub-modules that will allow you to bypass manual site identification. When using a partnering host, simply install the module, visit the module settings to register the site to an email and begin setting keys as you normally would through the key module.

Introduction

Drupal 7 core stores session ids as is. This allows anyone with read only access to the database (via SQL-i) to take a session id, present it in a session cookie to Drupal and take over the session.

This module contains a patched core session.inc that only stores hashes of the session id. Attackers cannot offer this hash as a valid session id, nor derive the session id from the hash, nor realistically guess a string that hashes to the same value.

The module is a key provider for Encrypt. It generates an encryption key based on the user's session id. This is intended for short term storage of highly sensitive data. Think cache.

Note: hashed sessions by eg https://www.drupal.org/project/hashed_sessions are a requirement.

Overview

The Sodium module for Drupal provides an encryption method for the Encrypt
module that allows symmetric encryption and decryption of data using the
Sodium (libsodium) software library. PHP integration is provided by the
Halite library.

The Composer Security Manager module will check any installed Composer packages against using the SensioLabs Security Checker service (using their awesome connection library), and output a report similar to the core Update Manager report.

Verify your user's email address or mobile number during registration or landing page form submission with One Time Passcode(OTP).

OTP Verification module verifies Email Address/Mobile Number of users by sending verification code(OTP) during registration. It removes the possibility of a user registering with fake Email Address/Mobile Number. This module checks the existence of the Email Address/Mobile Number and the ability of a user to access that Email Address/Mobile Number.

How does this module work?

This project was a straight up clone of the Key module so I could test out something with git.

Its pretty pointless. If anyone with the access to do so comes across it please delete it.

Overview

A strict policy of requiring two-factor authentication can sometimes be onerous for users. The purpose of this module is to help site administrators give users a gentle, but insistent nudge to set up two-factor authentication.