Security & hardening

An analytics instance holds data about your visitors and is often publicly reachable. I review Matomo, PHP, web server and operating system with tools such as Lynis, harden the instance following proven guidelines and back up the result with a before and after report. Hardening means switching off whatever is not needed and configuring everything else so that attackers find as little to attack as possible.

Let's talk All services

How I work

01Review Matomo, clean up access, roles and tokens
02Harden the operating system, trim packages and services
03Configure PHP and web server securely
04Check with Lynis and co., document and hand over

Securing Matomo itself

Current Matomo and plugin versions, unused plugins removed
Two-factor login, single sign-on, roles following least privilege
API tokens cleaned up, agency and legacy accounts removed
Configuration files, logs and temporary directories not reachable from outside

Single sign-on via LDAP or SAML 2.0, for example with Entra ID, Okta or Keycloak, permissions from directory groups
Accounts created and locked automatically via SCIM when someone leaves the company
A log of who changed which setting (Activity Log)
Separate accounts for agencies and service providers, removed when the project ends

Operating system and packages

System check with Lynis, complemented by package and update checks
Remove packages and services that are not needed, close open ports
Automatic security updates, for example with unattended-upgrades
SSH with keys only, no direct root login, fail2ban and a firewall
File and directory permissions as tight as possible

PHP and web server

A current PHP version, expose_php and display_errors off
Functions that are not needed disabled, open_basedir and secure session settings
Up-to-date TLS, security headers, rate limits for login and API
Admin interface restricted to certain networks or a VPN if required

Evidence

You get the reports from before and after hardening, a list of measures and a plan for updates and backups. That lets you show IT security and auditors what is configured.

Server check

From the operating system to the Matomo configuration.

Lynis checks packages, services, SSH, PHP and much more and sums up the result in a hardening index. We compare it before and after hardening. The output shown here is an example.

root@matomo: ~

$ lynis audit system
            [+] Boot and services
            
          
              - Service Manager
            [ systemd ]
          
            [+] Software: PHP
            
          
              - Checking expose_php option
            [ ON ]
          
              - Checking PHP disabled functions
            [ NONE ]
          
            [+] SSH Support
            
          
              - SSH option: PermitRootLogin
            [ SUGGESTION ]
          
              - SSH option: PasswordAuthentication
            [ SUGGESTION ]
          
            [+] Software: firewalls
            
          
              - Checking host based firewall
            [ ACTIVE ]
          
            [+] Packages
            
          
              - Checking for upgradeable packages
            [ FOUND ]

Hardening index, before58

Hardening index, after86

Operating system and packages
SSH, firewall and fail2ban
PHP settings
Web server, TLS and headers
Matomo, roles and tokens
Updates and backups

FAQ

Frequently asked questions

What do you check on the server?

The operating system and installed packages, open services and ports, SSH, firewall, updates and the settings of PHP, web server and database. Lynis provides a structured overview with a hardening index, which I assess and work through together with your IT team.

Do you need root access for this?

For a complete system check yes, limited in time and ideally with your IT team present. Alternatively your IT team runs the checks following my instructions and I evaluate the reports.

Do you also run penetration tests?

sonora reviews and hardens configuration and servers. Formal pentests during operations are offered by our sister brand feinwerk.io as part of its SLA operations.

Setup & infrastructureMatomo set up properly, on your server or in your cloud.Matomo auditFrom tracking code to report. What works, what is missing, what comes first.Performance & analysisWhen reports hang, archiving fails or the instance reaches its limits.

Questions about this?

In an intro call we'll clarify where you stand and whether I'm the right fit.

Your contactPeter Boehlke, Matomo consultant from Munich, 17 years in the Matomo team

Book an intro call Send a message