Security

This module provides seamless jQuery UI dialog integration for login, register, password reset and logout links through out your Drupal installation.

Features

• Fallback Support - If browsers have JavaScript disabled, then all links will remain unaltered and continue to their original destination (themed page of form).
• Real-time validation - Speed up submissions without having to load a themed page to wait for feedback after an attempt.
• MD5 password encryption - Encrypts passwords using the same Drupal method of storage. No clear passwords sent, regardless of SSL. NOTE: Not compatible with all modules, please check README for more details.
• Secure Pages (for SSL support) - Secure your sensitive data and provide a secure login while user is currently on a non-secure page.
• Native Form API validation - This module integrates naturally with other modules that already handle user accounts. Works seamlessly for modules such as LDAP Integration.

Allow site administrators to make sure certain sections of their sites are always accessed through SSL.

This module adds a reaction plugin to the Context module and thus benefits from all the flexibility that the Context module provides.

Before setting up this module, make sure SSL is enabled and fully configured on your web server and that the "https version" of your URL is correctly pointing to your Drupal website.

Sponsored by Recidive Networks.

This module extends drupal to support http://www.cherokee-project.com/doc/modules_handlers_secdownload.html for private downloads. Urls generated for private ressources will expire after a certain time. The following transfer protocols are supported:

• Server (e.g. Cherokee)
• PHP
• X-Sendfile
• X-Accel-Redirect

This is an authentication module for Services (http://drupal.org/project/services).

It let's you specify a whitelist of domains. Domains in this whitelist will then
be allowed to make cross domain XMLHttpRequests. This works by setting the
*Access-Control-Allow-Origin* header to match the origin of the requester.

We also perform a server side check, and if the domain is not present in the
white list the request is denied access directly, which saves your server
resources.

What Is Username Enumeration Prevention

By default Drupal is very secure (especially Drupal 7). However, there is a way to exploit the system by using a technique called username enumeration. Both Drupal 6 and 7 have this issue, but it is much worse for people using Drupal 6. This is because Drupal 6 does not have any built in brute force prevention. When an attacker knows a username they can start a brute force attack to gain access with that user. To help prevent this, it is best if usernames on the system are not easy to find out.

This module creates the ability to encrypt fields/components from the Webform module. Each Webform component can be marked as "Encrypted" and every time a user submits the webform, the encrypted value for that component will be saved instead of the original value.

Encryption is provided by the Encrypt module.

The 7.x branch of this module requires Webform 4.x and Encrypt 2.x. It will not work with older versions of Webform

What is Duo?

Duo is the simplest and safest way to secure any Internet login or transaction. Duo leverages consumers’ existing mobile devices for strong, usable, risk-adaptive two-factor authentication, backed by a secure cloud-hosted service.

This Drupal module adds Duo Security's two-factor authentication to your Drupal 6.x/7.x site.

Experimental project that is unmaintained.

Audit reports
Provides reports with generally useful statistics and checks of your site for common configuration, performance, and security concerns.

Audit log
Logs auditable actions, e.g. user account creation, menu changes, content deletion, etc.

User knock emulates "port knocking" by disabling the superuser (uid 1) account when they log out. In order to log into the account, a "secret knock" must first happen. This knock is provided in Configuration -> User knock as a URL with a generated key. Once that URL has been visited, the superuser account is activated and login proceeds as normal.

This reduces the chances of the superuser's password being bruteforced, as the account is disabled until the knock.