Securing Matomo/PIWIK

This guide outlines steps to secure Matomo/PIWIK by installing the Security Info plugin, modifying PHP settings to limit access, and configuring log monitoring. It also includes a list of recommended third-party plugins to enhance security, performance, and visitor tracking. Following these steps helps protect the system from vulnerabilities and ensures a more stable analytics environment.

 

Audience

staff 

 

Overview

This guide provides steps to enhance the security of Matomo/PIWIK by addressing known vulnerabilities. It includes installing the Security Info plugin to identify security risks, modifying PHP settings to restrict unnecessary access, and configuring logging for better monitoring. Additionally, it lists essential third-party plugins that improve performance, security, and visitor tracking. Implementing these measures ensures a more secure and efficient analytics environment.

 

The below steps are used to secure Matomo/PIWIK from known security risks

 

1. The first item to identify security issues is installing the security plugin.
   1. Login to Matomo with an account that has administrative access
   2. click the administration wheel on the top right hand side of the main screen
   3. on the left hand side locate and click Platform & then click Market Place
   4. Locate the plugin called "Security Info". This plugin provides security information about the configuration of your PHP environment.
   5. Click the Install button
2. Now that the plugin is installed we can check to see which security issues we need to address.
   1. On the left side locate and click Diagnostics
   2. Under the diagnostics menu you will see "Security" click that option
   3. All displayed options should be GREEN. If any options are showing RED they need to be addressed. NOTE: There is one note concerning force_redirect. This option is not a concern because we are running IIS 8.5
   4. Core Section Open_basedir: The open_basedir is showing "disabled" this allows too much visibility into the Matomo system and therefore should be modified:
      1. To modify the open_basedir option locate your PHP installation folder and modify the php.ini file
      2. In our server this is the current location - C:\PHP\v8.0.9. Locate the area for the open_basedir (approximately line # 318) section and remove the commented out portion below is a completed example.
      3. The sections looks like this:
         1. ; open_basedir, if set, limits all file operations to the defined directory
         2. ; and below.  This directive makes most sense if used in a per-directory
         3. ; or per-virtualhost web server configuration file.
         4. ; http://php.net/open-basedir
         5. ;open_basedir = "E:\inetpub\wwwroot\webanalytics.hs.pitt.edu"
      4. Change the line to read this:
         1. open_basedir = "E:\inetpub\wwwroot\webanalytics.hs.pitt.edu"
3. Restart the server
4. Now go back to the security plugin under diagnostics and check if the entry shows GREEN.
5. Install the LogViewer plugin - Now we must configure the Log Writer to view the logs. In our instance being so small we are using the "file" log writer option.
   1. Naviagate to the Matomo config directory (E:\inetpub\wwwroot\webanalytics.hs.pitt.edu\config)
   2. Edit the config.ini.php file
   3. Add the below entry to the file (we placed this at the very bottom):
      1. [log]
      2. log_writers[] = file
      3. Reference: https://matomo.org/faq/how-to/faq_20991/

Plugins to be used
For best performance and a more detailed identification of visitor activities the below third party plugins were added to the normal default PIWIK installation.

1. AdminNotification: Allows for a message to be placed on all user dashboards. This can be used to pass technical information concerning scheduled maintenance.
2. BotTracker: Detects bots & spiders and counts their visits without tracking them in the visitor log.
3. CustomDimensions: Extend Piwik to your needs by defining and tracking Custom Dimensions in scope Action or Visit.
4. FreeMobileMessaging: Mobile Messaging Plugin: Free Mobile support.
5. IP2Location: Use IP2Location geolocation database to lookup for accurate visitor location in Piwik.
6. Ip2Hostname: Piwik plugin to get the hostname from the visitor IP.
7. LogViewer: View Log messages logged by PIWIK.
8. LoginLDAP: Login plugin with LDAP authentication. Provides an alternative to the standard Piwik Login plugin.
9. PerformanceInfo: Piwik plugin to check if the settings are good for security/performance.
10. PlatformsReport: New report in Visitors > Platforms that aggregates visits based on device type, OS version & browser version.
11. ReferrersManager: This plugin allows to view and manage search engines and social networks that are recognized with Piwik.
12. ReportPublisher: Publish Piwik reports to external systems using various protocols. Please consult the changelog for available protocols.
13. SecurityInfo: Based on PhpSecInfo from the PHP Security Consortium, this plugin provides security information about your PHP environment and offers suggestions for improvement. It is a tool in a multilayered security approach. It does not replace secure development practices nor audit the code/application.
14. TrackingCodeCustomizer: The provided values will replace the defaults in the generated tracking code (leave blank to use defaults). Viewing https://github.com/piwik/piwik/blob/master/core/Tracker/TrackerCodeGenerator.php is recommended to deconstruct how the tracking code is built.
15. TreemapVisualization: This Piwik plugin adds a new report visualization: the treemap.
16. kDeBug: Activate or deactivate DEBUG tracking mode with a simple click.

Feedback and Concerns:

If you have any feedback regarding this article, please reach out to hsitkb@pitt.edu.  You can also leave a comment below as well.