Planning for security with your custom Drupal distribution¶

Although Site Factory uses Drupal’s native multisite features for governance and resource efficiency, the distribution of Drupal used by Site Factory is ultimately your responsibility. You must remember your Site Factory-hosted websites will have separate databases, content, and user account—they are all in a single multi-tenant application. When granting Drupal users elevated platform admin or site builder permissions, these permissions may include permission to run PHP code using Drupal’s user interface, based on your configuration.

Acquia recommends the following security practices:

• Grant elevated permissions only to trusted developers on your team.

• When developing your distribution, ensure the standard user experience does not require elevated permissions.

• Never enable Drupal’s core PHP module.

• Follow Drupal best practices for writing secure code.

• Consider installing the Paranoia module, which provides safeguards against the injection of PHP code using Drupal’s user interface.

• Periodically compare your list of installed modules against the Paranoia module, and perform additional tests against the modules not covered by the Paranoia module. Evaluating your installed modules can ensure users cannot inject PHP code using the user interface.

Installing your distribution¶

To install a distribution that contains the current Drupal version in your Site Factory codebase and prepare it for use:

1. Add your SSH key to Cloud Platform, and then clone the website’s code repository to your local machine.

2. On your local machine, delete all files and subdirectories in the docroot directory you cloned from Site Factory. When removing its contents, don’t delete the actual docroot directory.

   You can run the following Git command from the docroot directory to remove the files:

   git rm -r * .htaccess .gitignore
   

   Do not run the previous Git command after you have installed your Drupal distribution in the docroot directory.

3. Move your custom Drupal distribution into the now empty docroot directory.

   After moving the distribution, the docroot directory should contain the distribution’s index.php file, along with all other files and subdirectories.

4. Install the Site Factory Connector module to your codebase as described in Updating with the acsf-init command.

5. Ensure each of the following files can be read, written to, and executed by its owner, its group, and by other users:

   • hooks/common/pre-web-activate/000-acquia-deployment.php

   • hooks/common/post-db-copy/000-acquia_required_scrub.php

   To set the correct permissions on Unix-like operating systems, use a command like the following example:

   chmod 0755 [file names]
   

After installing your distribution, you must configure it for use.

Configuring your distribution¶

To configure a distribution that contains the current Drupal version for use with your websites, complete the following:

1. Configure your installation profiles to require the module using the appropriate instruction by adding the following line to your profile’s installation profile file at profiles/[profilename]/[profilename].info.yml, where [profilename] is the name of your profile:

   - acsf

2. Run the following Drush command from the docroot directory to initialize your custom distribution:

   drush --include=/path/to/acsf/acsf_init acsf-init
   

   Note

   This command does not bootstrap a Drupal website, so you must run it with the --include argument pointing to acsf/acsf_init/acsf_init.

   The previous Drush command creates several directories, and then copies files Site Factory requires for its tasks, including locating the correct database credentials.

3. Run the following Drush command from the docroot directory to ensure everything is in order before you commit the custom distribution to the repository:

   drush --include=/path/to/acsf/acsf_init acsf-init-verify
   

   The command should return the following result:

   acsf-init required files ok
   

4. Commit and push your custom distribution’s files to Site Factory.

5. Update your Production environment with the custom distribution’s files that you just pushed.

6. If your custom distribution includes more than one installation profile, enable any installation profiles you want available to website builders when creating new websites.

Your new custom Drupal distribution is now configured and available for use.

Using the Drupal distribution¶

After installing and configuring your new Drupal distribution, website builders can select the distribution for their use when creating new websites. For more information about selecting your custom profile when creating a new Site Factory website, see Managing installation profiles in your Factory.