47 lines
1.2 KiB
Markdown
47 lines
1.2 KiB
Markdown
# Server Hardening
|
|
|
|
This project now includes a built-in one-click hardening workflow that is executed during deployment.
|
|
|
|
## Entry point
|
|
|
|
Run as root from repository root:
|
|
|
|
```bash
|
|
bash scripts/security/install-security-stack.sh
|
|
```
|
|
|
|
This installer will:
|
|
|
|
1. Install/update `perf-guard` malware cleanup timer.
|
|
2. Apply baseline server hardening (`harden-server.sh`).
|
|
|
|
## What hardening does
|
|
|
|
- Enforces npm/pnpm registry to `https://registry.npmjs.org`.
|
|
- Adds SSH hardening drop-in file:
|
|
- limits auth retries and login grace time
|
|
- disables X11/TCP forwarding
|
|
- can enforce key-only login in strict mode
|
|
- Installs/configures fail2ban (`sshd` + nginx jails).
|
|
- Applies firewall rules (keep SSH port + 80/443, and optional custom ports).
|
|
- Applies kernel/network sysctl hardening.
|
|
|
|
## Runtime options
|
|
|
|
- `HARDEN_SSH_STRICT=1`
|
|
Enable key-only SSH auth (`PasswordAuthentication no`) when `/root/.ssh/authorized_keys` exists.
|
|
|
|
- `HARDEN_ALLOW_PORTS=3000,8080`
|
|
Extra TCP ports to allow in firewall.
|
|
|
|
- `HARDEN_FIREWALL_MODE=skip`
|
|
Skip firewall changes.
|
|
|
|
- `HARDEN_SKIP_PACKAGE_INSTALL=1`
|
|
Skip package installation (only apply config).
|
|
|
|
## Logs
|
|
|
|
- Hardening log: `/var/log/ai-chatbot-hardening.log`
|
|
- Perf guard log: `/var/log/perf-guard.log`
|