GDPR-Compliant Security Concept for Association Websites with Virtualmin: Backup, 2FA & Access Control

Why a security concept for association websites is indispensable

Association websites often process personal data – from member lists to donation information. The General Data Protection Regulation (GDPR) requires you, as the responsible party, to take appropriate technical and organizational measures to protect this data. At the same time, associations often work with volunteers who have varying levels of technical expertise. A well-thought-out security concept with Virtualmin helps you meet GDPR requirements without relying on expensive external services. In this article, I'll show you how to implement backups, two-factor authentication, and access controls yourself.

Basics: Virtualmin as a central management solution

Virtualmin is a powerful management tool for servers and websites. It provides you with a graphical interface to manage domains, email accounts, databases, and more. For associations, it's ideal because you can centrally manage multiple websites or subdomains – for example, for different departments or projects. If you don't have hosting for your association yet, check out our web hosting, which already integrates many security features.

Backup strategies: Avoid data loss

Regular backups are the foundation of any data security. With Virtualmin, you can create automated backups that include both files and databases. Here are some proven strategies:

1. Set up automated backups

In Virtualmin, go to Virtualmin > Backup Configuration and set a schedule. Daily backups are recommended for websites with frequently updated content. Choose a secure storage location, e.g., a separate directory on the server or an external FTP server that you control yourself.

2. Encrypt backup files

Since backups contain personal data, you should encrypt them. Virtualmin offers the option to protect backups with a password. Use a strong password and store it securely. This prevents unauthorized access to the data if the backup falls into the wrong hands.

3. Regular restoration tests

A backup is only as good as its recoverability. Therefore, regularly test whether you can successfully restore the backups. Plan this at least once a quarter to ensure everything works in an emergency.

Two-factor authentication (2FA): More protection for admin access

Two-factor authentication is an effective measure against unauthorized access. You can also enable 2FA for Virtualmin itself to protect the admin interface. Additionally, you should enable 2FA for all services accessible over the internet, such as webmail or FTP.

Enable 2FA in Virtualmin

Virtualmin supports 2FA via TOTP (Time-based One-Time Password). Enable this under Virtualmin > Server Configuration > Login Settings. Make sure you use an authenticator app like Google Authenticator or Authy. This way, each admin needs the one-time code, which appears only on the registered device, in addition to the password.

Secure other services

For webmail (e.g., Roundcube), there are plugins that support 2FA. For FTP access, you can switch to SFTP and use key authentication. This ensures that all access points are protected with multiple layers.

Access controls for volunteers: The principle of least privilege

Volunteers often need access to certain areas of the website, but not everything. Virtualmin allows you to create users with different roles. For example, you can give a webmaster full rights while an editor can only edit content. The principle of least privilege reduces the risk of errors or misuse.

1. Define user roles

Create user accounts in Virtualmin and assign only the necessary permissions. For website management, you can use WordPress roles (e.g., Administrator, Editor, Author). For server access, you should create separate SSH accounts with limited permissions that can only access specific directories.

2. SSH keys instead of passwords

Instead of passwords for SSH access, you should use SSH keys. These are more secure and can be individually revoked if a volunteer leaves. Create a separate key for each person and store it in Virtualmin under Virtualmin > System Settings > SSH Keys.

3. Regularly review access rights

Check at least every six months which user accounts are still active and what permissions they have. Remove accounts that are no longer needed and adjust permissions when tasks change. Document this review to meet the GDPR accountability requirement.

Additional GDPR measures: SSL, updates, and privacy policy

In addition to the points mentioned, you should take further protective measures:

• SSL certificates: Ensure your website runs over HTTPS. Virtualmin makes it easy to install free Let's Encrypt certificates.
• Regular updates: Keep Virtualmin, the operating system, and all applications (e.g., WordPress) up to date to close security gaps.
• Privacy policy: Publish a GDPR-compliant privacy policy that informs about the processing of personal data.

If you don't have your own domain yet, you can register a suitable domain with us.

Conclusion: Take security into your own hands

With Virtualmin, you have all the tools to implement a GDPR-compliant security concept for your association website – without external services. Backups, 2FA, and access controls are essential to protect data and meet legal requirements. Start implementing today and strengthen the trust of your members and donors. If you need support with setup, you'll find helpful guides in our knowledge base.