Bullet Proof CMS system. (Literally!)

**b0redom** · 16 January 2013, 10:00

Originally posted by bobspud View Post

A mate has some dicy chaps that need a website for storing sensitive documents while they are working abroad. I really don't think that a normal CMS is what they need, and I certainly don't want to get them in a situation where they get hacked becasue the PHP sucks. Normally I would make the site two different things and have a web site for clients and a private mega secure FTP server for client documents... But they want to combine the sites...

What is the tightest CMS out there today? I don't want to get shot dead...

Really depends on what you're doing and who for, and the sensitivity/classification of the protected documents. If I were in your position I wouldn't connect it directly to the Internet, I'd use either a VPN or private key based SSH port forwarding via a bastion host.

**bobspud** · 16 January 2013, 13:06

Originally posted by b0redom View Post

Really depends on what you're doing and who for, and the sensitivity/classification of the protected documents. If I were in your position I wouldn't connect it directly to the Internet, I'd use either a VPN or private key based SSH port forwarding via a bastion host.

Thats kind of what I was thinking. I am also of the mind not to use CMS because the sort of people they are dealing with are not going to take getting hacked in light humour. Its a well paying bit of work however the risks are very high.

**b0redom** · 16 January 2013, 13:52

If it's just for file storage, then you need to _tell_ them not to use CMS. VPN is really the best way forward.

**Sysman** · 16 January 2013, 15:06

Originally posted by bobspud View Post

I certainly don't want to get them in a situation where they get hacked becasue the PHP sucks.

There are tools like Octopress out there which don't use any PHP at all, instead producing totally static code. No integrated search engine, but there are other tools for that.

Octopress is probably not the right tool in its out of the box form, since it involves CLI stuff, but I imagine with some front end wrappers it could be made quite user friendly. It also has code for Twitter and all the other social stuff, but that's easy enough to comment out.

**bobspud** · 16 January 2013, 16:09

Originally posted by Sysman View Post

There are tools like Octopress out there which don't use any PHP at all, instead producing totally static code. No integrated search engine, but there are other tools for that.

Octopress is probably not the right tool in its out of the box form, since it involves CLI stuff, but I imagine with some front end wrappers it could be made quite user friendly. It also has code for Twitter and all the other social stuff, but that's easy enough to comment out.

Thanks. i will take a look at it. i am not affraid of cli's I grew up in unix land. It's the pluggins that concern me, because they are a high risk.

Bullet Proof CMS system. (Literally!)