How to install eComscan on Adobe Commerce (Magento) Cloud
by Team Sansec
Published in Guides
See the general instructions for running ecomscan for the first time.
Magento Cloud has read-only storage, which is good practice from a security perspective. However, since eComscan uses auto-update to always have the latest detection capabilities, eComscan needs to be installed on a writable partition of your server.
For Magento Cloud, there is a writable section under /mnt/shared/
. You can use this to install eComscan:
mkdir -p /mnt/shared/$LOGNAME/sansec
curl https://sansec.io/downloads/linux-$(uname -m)/ecomscan -o /mnt/shared/$LOGNAME/sansec/ecomscan
chmod 755 /mnt/shared/$LOGNAME/sansec/ecomscan
To set up continuous monitoring, you should request special CRON access with Magento here: https://cloud.magento.com/project/<id>/setup/project_details
Once that is enabled, you can install a cron in your repository, as described here:
https://devdocs.magento.com/guides/v2.3/cloud/configure/setup-cron-jobs.html
Magento Cloud monitoring recommendations
We recommend to:
- Install ecomscan on the first node of your production environment.
- Run a daily scan for all files (path:
/app/$LOGNAME
). For a large store, this scan may take up to an hour. - Run an hourly scan for your database assets (path:
/app/$LOGNAME/app/etc/env.php
). Because only selected tables are scanned, this scan is completely unobtrusive.
Summing up, adding eComscan to your .magento.app.yaml
file may look like this:
crons:
ecomscanhourly:
spec: "10 * * * *"
cmd: "/mnt/shared/$LOGNAME/sansec/ecomscan -k YOURKEY --monitor [email protected] /app/$LOGNAME/app/etc/env.php"
ecomscandaily:
spec: "40 1 * * *"
cmd: "/mnt/shared/$LOGNAME/sansec/ecomscan -k YOURKEY --monitor [email protected] /app/$LOGNAME"
Safely storing eComscan key
While exposure of your license key would not expose your data (it would merely give access to our signature feed), we do recommend to treat it as any other secret and keep it separate from your source repo.
You can store the secret key outside of your repo root, for example in /mnt/shared/$LOGNAME/sansec/license.txt
and access it like this:
/mnt/shared/$LOGNAME/sansec/ecomscan -k $(cat /mnt/shared/$LOGNAME/sansec/license.txt) /app/$LOGNAME
In this article
Easy CSP for your store?
Try Sansec Watch! Free, simple and fully integrated. Get PCI compliant alerting with minimal effort.
Sansec Watch