Introduction

Dolibarr ERP & CRM has established itself as one of the most popular open-source business management platforms, appreciated for its flexibility, modular structure, and accessibility. Whether you are a small business owner, a large enterprise, or an IT service provider, deploying Dolibarr offers tremendous potential to streamline operations across sales, finance, inventory, HR, and customer relationship management.

However, with great power comes great responsibility.
Because Dolibarr manages sensitive company data—such as client information, financial records, product inventories, and internal workflows—securing your Dolibarr instance is absolutely critical.
Security breaches can lead to loss of data, financial damage, reputational harm, and even legal repercussions.

In this guide, we will cover comprehensive best practices and recommendations for securing your Dolibarr installation. From server configuration to user management, application hardening, backups, and monitoring, you’ll learn how to protect your business and ensure your Dolibarr system remains reliable and resilient.

Why Security Matters for Dolibarr

Before diving into technical recommendations, it’s essential to understand the risks associated with an unsecured Dolibarr instance:

• Data Breaches: Unauthorized access to customer data, invoices, and internal documents.

• Financial Losses: Alteration or theft of financial records.

• Reputation Damage: Loss of trust from customers and partners.

• Regulatory Penalties: Non-compliance with laws like GDPR can result in significant fines.

• Business Disruption: Ransomware attacks can lock you out of your system entirely.

Given that Dolibarr is often exposed over the internet, and ERP systems are prime targets for cybercriminals, proactive security measures are not optional—they are mandatory.

Server-Level Security for Dolibarr

1. Secure Hosting Environment

Choosing a reliable hosting provider is your first line of defense. Opt for:

• VPS, Dedicated, or Cloud servers (avoid shared hosting for production ERP).

• Data centers compliant with security standards (ISO 27001, SOC 2).

• Providers offering DDoS protection and firewall services.

Ensure your server OS (Linux distributions like Ubuntu, Debian, CentOS) is updated regularly.

2. Use HTTPS Exclusively

Never expose your Dolibarr instance over HTTP. Always:

• Install a valid SSL/TLS certificate (e.g., via Let’s Encrypt or paid providers).

• Redirect all HTTP traffic to HTTPS automatically.

• Use strong cipher suites to secure SSL communications.

Encrypted communication prevents attackers from intercepting sensitive data.

3. Firewall Configuration

Deploy firewalls to limit unwanted traffic:

• Host-based firewalls like UFW (Ubuntu) or Firewalld (CentOS).

• Cloud firewalls provided by your hosting platform.

• Only open necessary ports (80, 443, SSH, SMTP if needed).

• Restrict SSH access to known IP addresses when possible.

Firewalls drastically reduce the system’s attack surface.

4. Keep System Software Updated

Regularly update:

• Server operating systems.

• PHP, MySQL/MariaDB, Nginx/Apache versions.

• Security patches for all installed packages.

Unpatched software remains the number one cause of server compromises.

Dolibarr-Specific Security Hardening

1. Keep Dolibarr Up-to-Date

Each Dolibarr version includes security fixes. Upgrading regularly ensures:

• Protection against newly discovered vulnerabilities.

• Access to improved security features (e.g., session management, encryption options).

Always backup your database and files before upgrading.

2. Secure the /documents Directory

Dolibarr stores uploaded documents (e.g., invoices, proposals) under the /documents directory. Protect it:

• Place it outside the web root when possible.

• Use .htaccess (Apache) or server configuration (Nginx) to deny direct access:

  • Deny browsing.

  • Deny execution of uploaded scripts.

This prevents attackers from executing malicious files if they manage to upload them.

3. Enforce Strong Password Policies

Ensure that users:

• Create passwords with at least 12 characters including uppercase, lowercase, numbers, and special characters.

• Change default admin credentials immediately after installation.

• Rotate passwords periodically.

• Use two-factor authentication (2FA) when available (plugins/modules can extend this).

A strong password policy significantly reduces the risk of brute-force attacks.

4. Limit Admin Access

• Restrict administrative roles to only necessary users.

• Disable unused admin accounts.

• Apply least privilege principles: users should only have access to the data and functionality they require.

The fewer superusers you have, the lower the risk of account compromise.

5. Configure Session Settings

Adjust Dolibarr session management:

• Set short session timeouts for idle users.

• Enable session regeneration after login.

• Use secure session cookies (Secure, HttpOnly, and SameSite flags).

Good session security thwarts session hijacking attempts.

Database Security for Dolibarr

1. Secure Database Access

• Use strong database passwords.

• Avoid root-level database access in the application configuration.

• Create a dedicated database user with limited privileges.

Following the principle of least privilege minimizes the damage from potential application exploits.

2. Restrict Database Connections

• Bind the MySQL/MariaDB server to localhost if Dolibarr and the database are on the same machine.

• Use firewalls to restrict remote access if separate servers are used.

Reducing database exposure dramatically lowers the risk of attacks.

3. Encrypt Sensitive Data

While Dolibarr encrypts some data fields by default (e.g., passwords), consider:

• Encrypting sensitive custom fields.

• Using application-level encryption for highly confidential information.

Additional encryption layers make data theft less useful to attackers.

Backup and Recovery Strategies

1. Automated Backups

• Schedule daily backups of the Dolibarr database.

• Backup the application files, especially the /documents folder and custom modules.

Automated backups guarantee you won’t lose critical data.

2. Offsite Backup Storage

• Store backups offsite or in a cloud storage service.

• Encrypt backups to prevent unauthorized access.

In case your server is compromised, external backups are your lifeline.

3. Test Your Backups

Regularly:

• Verify backup integrity.

• Perform full restoration tests.

A backup is only valuable if it works when you need it.

Monitoring and Intrusion Detection

1. System Monitoring

Deploy monitoring tools to track:

• CPU and memory usage.

• Disk space.

• Web server status.

Tools like Zabbix, Prometheus, or server panels (e.g., Plesk, Webmin) can help.

2. Intrusion Detection Systems (IDS)

Consider using systems like:

• OSSEC (open-source host-based intrusion detection).

• Fail2ban (ban IPs after repeated failed login attempts).

Proactive monitoring and automatic banning mitigate brute-force and other attacks.

3. Log Management

• Enable and centralize logging (Apache/Nginx access logs, Dolibarr logs, syslog).

• Monitor logs for suspicious behavior (unexpected logins, injection attempts, excessive errors).

Logs are crucial for forensic analysis in case of incidents.

Application-Level Enhancements

1. Limit File Upload Types

Restrict file uploads to safe types (PDF, DOCX, JPEG, etc.):

• Validate file extensions and MIME types.

• Limit upload file size to prevent denial of service attacks.

Uncontrolled file uploads are a common vector for attacks.

2. Use Trusted Modules Only

When extending Dolibarr:

• Only install official or well-reviewed modules.

• Regularly update third-party modules.

Poorly coded modules can introduce security vulnerabilities.

3. Set Appropriate File and Folder Permissions

On your server:

• Files should have permissions 644.

• Folders should have permissions 755.

• Configuration files (e.g., conf.php) should be further restricted (600).

Proper permissions prevent unauthorized modifications.

Security Best Practices for Users

1. Train Your Staff

• Educate users about phishing and social engineering attacks.

• Teach them to recognize suspicious behavior and emails.

• Encourage the use of password managers.

Human error remains a major cause of cybersecurity incidents.

2. Regular Security Audits

• Schedule periodic security reviews.

• Hire external security experts to perform penetration tests if necessary.

Continuous evaluation keeps your system resilient.

3. Implement Access Logs and Auditing

• Track login attempts.

• Record critical actions performed by users (e.g., invoice modifications, account creations).

• Review access logs periodically.

Transparency and accountability help detect and deter malicious actions.

Conclusion

Securing your Dolibarr instance is a continuous process that requires attention to server hardening, application configuration, user management, monitoring, and disaster recovery.
By implementing the best practices and recommendations outlined above, you’ll dramatically reduce your exposure to cybersecurity risks and ensure the long-term integrity, performance, and reputation of your business.

Remember: strong security is not an option; it is an ongoing commitment to protecting your assets, your clients, and your future.

If you invest the necessary time and resources into hardening your Dolibarr system today, you’ll save yourself from costly breaches, downtime, and business disruptions tomorrow.