Security Suite byAkyras — 2FA, Bank Detail Protection, Access Control & Audit

Security Suite byAkyras — See the risks. Control access. Stay ready to act.

Does a former employee still have access? Has a supplier just changed their bank details? Is your latest backup recent enough? Who can export your data or grant sensitive permissions?

These questions matter every day. Security Suite byAkyras brings the tools to answer them into Dolibarr: strong authentication, access control, business protection, instance monitoring, alerts and incident management.

A security center built into your ERP, with issues to address and actions to take. Two-factor authentication is included; the suite also covers what happens after login.

A dashboard that helps you decide what to fix

See 2FA adoption, active administrators, inactive accounts and accounts holding an API key. An indicative score out of 100 summarizes the suite’s checks.

Issues are ranked by severity, with the finding and a recommended correction: missing backups, insufficient account protection, risky permissions, disabled approvals or settings to strengthen. Start with a practical action list inside Dolibarr.

1. Modern authentication that fits your team

The 2FA byAkyras engine is built in: Windows Hello, FIDO2/WebAuthn keys, TOTP apps and YubiKey OTP, with guided setup, recovery codes and remembered devices. Users have several methods available; you define enforcement through the module’s authentication policy.

Windows Hello supports PIN or biometric confirmation on compatible configurations. FIDO2/WebAuthn methods bind verification to the legitimate website; biometric data stays on the device. An authenticated Dolibarr session is established only after the second factor is verified when required.

2. Defenses against account attacks

• Brute force: temporary blocking by IP address and targeted username, with configurable thresholds.
• Password spraying: detection of an address trying many different usernames.
• Repeated attacks: progressively longer blocking, exempt IP addresses and an unblocking page.
• Decoy usernames: an attempt against a configured fictitious username triggers blocking and a critical alert.
• Compromised passwords: Have I Been Pwned checks, rejection when setting a compromised new password and a warning at login.

The password check sends only a five-character prefix of its SHA-1 hash through the k-anonymity mechanism, never the password itself.

3. Access policies before and during a session

Define restrictions by IP address or IPv4/IPv6 network range, country, day and time. Target everyone, administrators, non-administrators, a group or a specific account.

Start in monitoring mode, then enable blocking. Rules are checked at login and periodically during the session. A tester shows which rules a given user, address and time would violate. Safeguards help prevent accidental self-lockout, with a documented emergency override.

4. Know who is connected and take control of sessions

Review active sessions, IP addresses, devices and last activity. Close one session or a user’s sessions remotely; closure takes effect on their next request. Connection history includes session end reasons.

Manage known devices, forget a lost device and receive new-device or new-network alerts according to your settings. Detect simultaneous sessions with an optional limit. The “impossible travel” check can flag or reject a login geographically inconsistent with the previous one.

“My security” lets users participate in protecting their account. “That wasn’t me” closes their other sessions, forgets devices, removes their API key, alerts the security team, opens an incident and requires a new password.

5. Add a second approval to bank detail changes

Changes to an IBAN, BIC or account holder can require another person’s approval. Requesters cannot approve their own requests. Existing details remain in place until a decision; a new bank record awaiting approval has no IBAN.

Track requests, decisions and reasoned rejections, with notifications. Changes made through supported API workflows are also covered. Bank detail changes are logged with masked IBANs in events.

When creating a SEPA credit transfer order in Dolibarr, recently changed beneficiary details can trigger an alert or block the order. After checking with the supplier, “Bank details verified” releases that check.

The suite also monitors changes to supplier and contact email addresses, phone numbers and addresses, with configurable scope.

6. Manage effective permissions, not just user lists

Review effective permissions, granted directly or inherited from groups, and their origins. Identify administrators requiring attention, inactive accounts and combinations of permissions concentrating sensitive operations in one person’s hands.

Separation-of-duties checks cover scenarios such as supplier, invoice and payment; bank details and transfers; payroll and payment; bank entries and reconciliation. Correct permissions or accept a risk with a recorded justification.

Enable two-person approval for sensitive permissions: administrator status, selected permissions or membership of a group holding them. Relevant grants become requests for a second administrator to approve. Nobody approves their own request.

For short interventions, grant temporary administrator privileges for 15 minutes to 4 hours within configured limits, with or without approval. Elevations are visible and logged, with automatic removal at expiry through the module’s checks.

7. Organize onboarding, offboarding and periodic reviews

• Onboarding: create an account from a reference colleague, copy groups and optionally individual permissions. Set a 2FA setup deadline with a reminder and mandatory enrollment at expiry when an authentication method is available.
• Offboarding: a single procedure coordinates account deactivation, session closure, password change and removal of API keys, 2FA, permissions, groups and remembered devices. Explicit confirmation precedes the operation; a timestamped PDF record is retained.
• Review campaigns: snapshot active accounts and examine groups, permissions, 2FA, API keys and last logins. Record keep, modify or remove decisions, then close the campaign with a conclusion and evidence PDF. Overdue campaigns are flagged.

8. Keep API keys under oversight

Inventory accounts holding a key without displaying the key itself. Review the last call, address and call count. Identify unused keys and configure a maximum lifetime, with a warning before expiry.

Define permitted addresses and optionally apply access restrictions to the API. Treat technical credentials as access points in their own right.

9. Spot unusual data exports and deletions

The suite logs downloads from the Exports module and their row counts for supported formats. Thresholds flag large exports or many exports and document downloads in a short period. Backup generation and downloads are also tracked.

A dedicated view aggregates exports by user. Deletions of supported business objects are logged, with an alert available above your chosen hourly threshold. Get evidence to investigate unusual activity.

10. Monitor the condition of your instance

• Configuration scan: checks on Dolibarr, PHP, conf.php, the documents directory and potentially risky modules.
• File integrity: SHA-256 baseline, detection of added, changed or deleted executable files and suspicious scripts in documents. Approve a new baseline after an update.
• Settings history: track configuration changes with previous and new values; secret values are not retained in plain text.
• Backups: monitor age, size, failures and unusual size drops, with watched directories and reports or signals from external tools. Track declared off-server backups and restoration tests.
• Versions: check published Dolibarr releases, vulnerabilities listed in GitHub advisories and PHP security support end dates.

11. A verifiable log and alerts where you work

The log brings together login, session, account, permission, bank detail and other supported events, with filters and CSV or JSON exports. A chain of hashes enables integrity checks, with automatic verification, an alert for a broken chain and a PDF verification record.

Forward events to a SIEM or syslog server over UDP, TCP or TCP with TLS, using RFC 5424 with JSON or CEF. External retention can complement the local log.

Send alerts by email, Teams, Slack, Google Chat, Discord or JSON webhook. A weekly digest combines the score, activity, blocks, sensitive changes and issues to address.

12. Respond to incidents and document your actions

Create incidents with category, severity, owner, status and an action timeline. Review nearby security events and track suggested deadlines for NIS2 and GDPR processes.

Lockdown mode closes non-administrator sessions and refuses their new logins until lifted. Activation requires confirmation, records the reason and triggers an alert and an incident.

A PDF report consolidates checks, accounts requiring attention, incidents and activity for your chosen period, mapped to NIS2 and GDPR measures. Access reviews and records add supporting documentation. The suite helps document technical measures; it does not certify your organization or independently cover its organizational obligations.

A standalone suite. Continuity for existing 2FA byAkyras customers.

No separate 2FA purchase is required. For existing installations, activation reuses 2FA data, settings and permissions, preserves registered methods and disables the standalone 2FA module. Users do not need to enroll again.

Complete interface in French, English, German, Spanish, Italian and Dutch, with regional variants falling back to their base language. Other languages use available 2FA translations; the rest of the suite appears in English.

Requirements and scope

Dolibarr 20–24, PHP 7.4 minimum (8.2 or later recommended), MySQL or MariaDB. HTTPS for Windows Hello and FIDO2/WebAuthn. Scheduled jobs and system cron for automatic checks; GeoIP Maxmind for geographic features. Declare trusted proxies when using a reverse proxy. Multicompany has not been tested.

Have I Been Pwned and GitHub checks require outbound access and are skipped if services cannot be reached; YubiKey OTP uses YubiCloud. Backup monitoring does not create backups. Transfer checks cover Dolibarr SEPA orders, not payments made directly with your bank. REST exports and screenshots are outside export detection.

Two-person approvals cover supported Dolibarr and API workflows, not direct database writes. Permission approval is optional; without a second administrator, the grant proceeds with a bypass event. Log hashes are not independent evidence against someone controlling both the database and instance key. VPNs and mobile networks can affect geographic checks. See the documentation for settings, scope and emergency procedures.

Make Dolibarr security visible, actionable and part of your ongoing operations.