Skip to main content

GROWING AND SUSTAINING RELATIONSHIPS

GROWING AND SUSTAINING RELATIONSHIPS
Close
Guillermo de los Santos

Administrator

Medecins Sans Frontieres Argentina

http://msf.org.ar

with the translation Spanish-English of the module and with the up-to-date upgrade of the modules e.g. peer to peer and campaigning

GROWING AND SUSTAINING RELATIONSHIPS
Close
Kellie Brownell

End-user

EFF

https://www.eff.org

The CiviCRM community has been a tremendous resource for new ideas and helping us solve problems. We are excited to contribute customizations EFF makes back to core and support new features such as batch entry for offline donations or multiple payment processors on one donation form.

GROWING AND SUSTAINING RELATIONSHIPS
Close
Kurund Jalmi

Developer, Implementor

Web Access India Pvt. Ltd.

http://webaccessglobal.com

I have been part of CiviCRM project from the beginning and feels great to see how it has grown over the years.
I am glad to be associated with such a wonderful open source project and an awesome community around it.

GROWING AND SUSTAINING RELATIONSHIPS
Close
Nicolas Ganivet

Implementor, Developper

cividesk

http://www.cividesk.com

The community around CiviCRM is international, multicultural, friendly, sometime opinionated but always respectful and welcoming new ideas. It is a real pleasure to interact with these people - but see for yourself: dive in and ask your first question on the forums!

We thoroughly appreciate CiviCRM as a software and this community, and when helping our customers implement and make the best of CiviCRM we are always looking for ways to contribute back.

GROWING AND SUSTAINING RELATIONSHIPS
Close
Kevin Krupp

Trainer

Emphanos

http://emphanos.com

As a CiviCRM trainer and implementer CiviCRM provides a great solution that allows Emphanos to help NGOs improve their ability to reach out and spread their messages.

GROWING AND SUSTAINING RELATIONSHIPS
Close
Hans Idink

Implementator, Developer

Orgis

http://www.orgis.com

CiviCRM has a key value for the Organisations I support with software.

GROWING AND SUSTAINING RELATIONSHIPS
Close
Sarah Gladstone

Implementor, Developer

Pogstone, Inc.

http://pogstone.com

I have been involved in the CiviCRM community for over 5 years, and enjoy implementing and programming CiviCRM for a variety of non-profits. I have been amazed at the rapid pace of innovation delivered with each new release, and CiviCRM's flexibility in being able to accommodate a variety of requirements. I have learned a lot about CiviCRM by participating in CiviCon, online forums, and CiviCRM book sprint.

GROWING AND SUSTAINING RELATIONSHIPS
Close
Jamie McClelland

DEVELOPER AND IMPLEMENTER

PROGRESSIVE TECHNOLOGY PROJECT

http://progressivetech.org
GROWING AND SUSTAINING RELATIONSHIPS
Close
Kasia Wakarecy

Administrator, Implementator, Developer, End-user

Freeform Solutions

http://www.freeformsolutions.ca

Freeform Solutions uses CiviCRM for our internal CRM. We are also a NFP IT support organization and we implement CiviCRM for NFP organizations we work for because we find that CiviCRM is the best open source CRM out there.

GROWING AND SUSTAINING RELATIONSHIPS
Close
Simon West

End-user, Administrator, Implementor

ZING

http://zing.uk.com

We feel there are too many obstacles facing not-for-profits (NFPs) considering commercial CRM offerings, including many of those that are charity oriented. From licensing models which restrict the fluid expansion of an organisation's user base (why should you be punished with higher costs for being successful?), to support from commercial companies being inherently tied to one supplier; a NFP would benefit from the option to 'shop around' for those most appropriate, e.g. based on: proximity and availability on-site, cost, experience, value added services... They also often lack the capacity for charity relevant workflows, necessitating either customisations, complicated and inefficient workarounds or an en-masse call for new functionality, as individual charities do not appear to carry the weight required to influence subtle NFP-only changes to market leading software, without large expense.

On the flip side, CiviCRM is completely free and open-source, carrying with it a friendly, hard-working and enthusiastic community of developers and implementers, constantly listening to the users' needs and sculpting future releases to the requirements of NFP organisations. This is exciting!

GROWING AND SUSTAINING RELATIONSHIPS
Close
Jane Hanley

implementor, administrator

AGH Strategies

http://www.aghstrategies.com

We help nonprofits make the best use of their data to further their mission.

GROWING AND SUSTAINING RELATIONSHIPS
Close
Sandra Mayers

Implementor, Developer

Unitarian Universalist Church of Lancaster

http://www.uuclonline.org

Contact management, email marketing/management and web site integration.

LOGIN | REGISTER
  • Create new account
  • Request new password

Search form

  • BLOG
  • DEMO
  • Find An Expert
  • NEED HELP
  • SUPPORT US
  • DEVELOPER RESOURCES
CiviCRM Community Site logo CiviCRM Community Site
  • WHAT IS CIVICRM
    • Community
    • Case Studies
    • Experts
    • Contributors
    • Core Team
    • Licensing
    • Contact Us
  • WILL CIVICRM MEET YOUR NEEDS?
    • Contacts
    • Contributions
    • Communications
    • Peer-To-Peer Fundraisers
    • Advocacy Campaigns
    • Events
    • Members
    • Reports
    • Case Management
  • GET STARTED
    • Evaluate Your CRM Needs
    • Evaluate CiviCRM Features
    • Read Books
    • Contact an Ambassador
    • Demo CiviCRM
    • Download CiviCRM
    • Download Extensions
    • Find An Expert
  • PARTICIPATE
    • Join the community
    • Make it happen
    • Support CiviCRM
    • Meet ups
    • Document CiviCRM
    • Translate CiviCRM
    • Developer resources

You are here

Home » Blogs » jamie's blog

Blog

  • API
  • Architecture Series
  • CiviCampaign
  • CiviCase
  • CiviCon
  • CiviContribute
  • CiviCRM
  • CiviCRM v4.1
  • CiviEvent
  • CiviMail
  • CiviMember
  • CiviMobile
  • CiviPledge
  • CiviReport
  • Documentation
  • Drupal
  • Extensions
  • Finance and Accounting
  • Interface Design and Layout Standards
  • Internationalization and Localization
  • Joomla
  • Make it happen
  • Marketing and Promotion
  • Meetups
  • Older Versions
  • Release
  • Schools
  • Solutions (case studies and user stories)
  • Sprints
  • Teams
  • Training
  • v1.6
  • v1.7
  • v1.8
  • v1.9
  • v2.0
  • v2.1
  • v2.2
  • v2.3
  • v3.0
  • v3.1
  • v3.2
  • v3.3
  • v3.4 and v4.0
  • v4.2
  • v4.3
  • WordPress

Dropping the password requirement for running CiviCRM via the command line

Submitted by jamie on March 9, 2012 - 08:33

Thanks to successful Make It Happen on consolidated cron jobs, we can set just one cron job per site.

As described in the docs, you can set this cron job using either an "URL" method or a "CLI" method.

The URL method uses wget or curl to mimic a web page request as if it was made anonymously over the Internet. With this method, we certainly want to require a password to avoid having anonymous users hitting your cron job (which could be a vector for a denial of service attack). And, CiviCRM rightly requires this password, refusing to run if it is missing or incorrect.

However, why are we requiring a password when using the cli method?

If you have command line access to a CiviCRM install and you have read-access to the civicrm.settings.php file, you already have full access to the database.

If we require users type a password when they run their cli commands, it will in fact reduce security because:

  • It encourages users to put plain-text passwords in their cron jobs
  • For users who run the cli commands manually, it encourages them to use short or easy to remember passwords to make it more convenient
  • Passwords provided directly on the command line are leaked to any other user on the system who can run ps to see running commands

There is a need to specify what user a cron job should be run as - however, the current cli.php implementation could provide for the ability to specify a user without a password.

What do others think? Am I missing anything? As a security issue, it's best to be safe!

  • jamie's blog
  • Log in or register to post comments

Comments

Issue has been created

Permalink Submitted by jamie on March 9, 2012 - 08:35

I've opened a complimentary issue.

  • Log in or register to post comments

I've wondered the same thing

Permalink Submitted by Martin.Schwenke on March 9, 2012 - 11:52

I've wondered the same thing myself.  Requiring the password on the command-line is a security minus rather than a security plus.  As you've said, if you have access to the config file then you have database access...

  • Log in or register to post comments

Skip it

Permalink Submitted by xavier on March 9, 2012 - 15:36

That's a no brainer, asking the password (on the cli) doesn't increase security, quite the contrary.

What ssh and phplist do is to have a whitelist of users that are allowed to run the cron. Not sure it adds anything but (sshd_config) you have:

AllowUsers bob cronjob whatever and if you want to run it as jammie it will block. I'm assuming the rationale would be that I can't create activities or what else as dlobo or dgg, only as the "technical" cronjob user(s) listed there

Don't have any opinion about it, beside yes, get rid of the mandatory password on the cli

X+

  • Log in or register to post comments

Thumbs up

Permalink Submitted by Sean Dague (not verified) on March 11, 2012 - 07:50

It would be great to get that added. I'd also really like it if it could get triggered directly from Drupal's cron system, as it seems weird that I need to be running 2 separate updaters for the same site.

Url: 

http://dague.net
  • Log in or register to post comments

CIVICRM


GROWING AND SUSTAINING RELATIONSHIPS

WHAT IS CIVICRM
  • Community
  • Case Studies
  • Experts
  • Contributors
  • Core Team
  • Licensing
  • Contact Us
WILL CIVICRM MEET YOUR NEEDS?
  • Contacts
  • Contributions
  • Communications
  • Peer-To-Peer Fundraisers
  • Advocacy Campaigns
  • Events
  • Members
  • Reports
  • Case Management
GET STARTED
  • Evaluate Your CRM Needs
  • Evaluate CiviCRM Features
  • Read Books
  • Contact an Ambassador
  • Demo CiviCRM
  • Download CiviCRM
  • Download Extensions
  • Find An Expert
PARTICIPATE
  • Join the CiviCRM Community
  • Read Our Blog
  • Community Forum
  • Attend a Training or Meetup
  • Make It Happen
  • Become A CiviCRM Developer
  • Issue Tracker
  • Help with Documentation
  • Translate