Key Takeaways
- Enable two-factor authentication for all users, especially administrator accounts
- Disable the database manager in production and restrict PostgreSQL network access
- Implement daily automated backups with monthly restoration testing
- Place Odoo behind a reverse proxy with HTTPS and configure firewall rules
- Subscribe to Odoo security advisories and apply patches within 72 hours
Access Control and Authentication
Access control is the first line of defense. Implement role-based access with the principle of least privilege: users get only the permissions their job function requires.
| Security Measure | Priority | Implementation |
|---|---|---|
| Role-based access groups | Critical | Define groups by job function, not individual |
| Two-factor authentication | Critical | TOTP for all users, mandatory for admins |
| Password policy | High | 12+ characters, complexity rules, 90-day rotation |
| Session timeout | High | 30-minute inactivity timeout |
| Login attempt limits | High | Lock after 5 failed attempts for 30 minutes |
| IP whitelisting | Medium | Restrict admin access to known IP ranges |
Never use the default admin account for daily operations. Create named administrator accounts with 2FA. Disable or rename the default admin. Audit admin actions separately from regular user activity.
Encryption and Data Protection
Protect data in transit and at rest with proper encryption configuration across all layers of the Odoo deployment.
- HTTPS: install valid SSL/TLS certificates and redirect all HTTP traffic to HTTPS
- Database connections: enable SSL for PostgreSQL client connections
- Backup encryption: encrypt database backups using GPG or AES-256 before offsite storage
- File storage: encrypt the filestore directory at the filesystem level
- API connections: require HTTPS for all XML-RPC and REST API calls
- Email: configure TLS for SMTP and IMAP connections
Use Let's Encrypt for free, automatically renewed SSL certificates. Configure your reverse proxy (Nginx) to handle SSL termination. Set HSTS headers to prevent protocol downgrade attacks.
Backup and Disaster Recovery
Your ERP contains irreplaceable business data. A robust backup strategy protects against data loss, corruption, ransomware, and system failures.
| Backup Type | Frequency | Retention | Storage |
|---|---|---|---|
| Full database + filestore | Daily | 30 days | Offsite/cloud |
| Transaction log backup | Hourly | 7 days | Local + offsite |
| Monthly archive | Monthly | 12 months | Cold storage |
| Pre-upgrade snapshot | Before updates | Until verified | Local + offsite |
- Automate daily backups with pg_dump and filestore rsync
- Encrypt backups before transferring to offsite storage
- Test restoration monthly by restoring to a staging server
- Document the disaster recovery procedure with step-by-step instructions
- Define RPO (Recovery Point Objective) and RTO (Recovery Time Objective) targets
- Maintain a runbook that any team member can follow to restore service
Network Security and Infrastructure
Proper network architecture prevents unauthorized access and limits the impact of potential breaches.
- Reverse proxy: place Nginx or HAProxy in front of Odoo for SSL termination, rate limiting, and request filtering
- Firewall rules: allow only ports 80/443 to the internet, restrict SSH to admin IPs, block direct PostgreSQL access
- VPN requirement: require VPN for administrative access (SSH, database management) from outside the office
- Database isolation: run PostgreSQL on a separate server or at minimum restrict network access to localhost
- Disable database manager: set list_db = False in odoo.conf to prevent web-based database operations
- Rate limiting: configure Nginx to limit request rates and prevent brute-force and DoS attacks
If using Odoo.sh, many infrastructure security measures are handled by Odoo. Focus your efforts on application-level security: access controls, password policies, and data handling procedures.
Monitoring and Patch Management
Proactive monitoring detects security incidents early. Prompt patching closes known vulnerabilities before attackers exploit them.
| Activity | Frequency | Tool/Method |
|---|---|---|
| Failed login monitoring | Real-time alerts | Odoo logs + alerting |
| Access audit review | Monthly | Odoo audit log module |
| Security patch application | Within 72 hours | Odoo security advisories |
| Dependency scanning | Monthly | pip audit, npm audit |
| Penetration testing | Annually | Third-party security firm |
| Access rights review | Quarterly | Manual review of user groups |
Subscribe to Odoo's security advisory mailing list. When critical patches are released, apply them within 72 hours. Test patches on staging first, but do not delay production patching for non-critical testing.
Frequently Asked Questions
Related services from Verbsz Technologies
If this article is relevant to a project on your roadmap, these are the services our team typically delivers.