ai-chatbot/docs/security/server-hardening.md

Server Hardening

This project now includes a built-in one-click hardening workflow that is executed during deployment.

Entry point

Run as root from repository root:

bash scripts/security/install-security-stack.sh

This installer will:

1. Install/update perf-guard malware cleanup timer.
2. Apply baseline server hardening (harden-server.sh).

What hardening does

• Enforces npm/pnpm registry to https://registry.npmjs.org.
• Adds SSH hardening drop-in file:
  • limits auth retries and login grace time
  • disables X11/TCP forwarding
  • can enforce key-only login in strict mode
• Installs/configures fail2ban (sshd + nginx jails).
• Applies firewall rules (keep SSH port + 80/443, and optional custom ports).
• Applies kernel/network sysctl hardening.

Runtime options

• HARDEN_SSH_STRICT=1
  Enable key-only SSH auth (PasswordAuthentication no) when /root/.ssh/authorized_keys exists.

• HARDEN_ALLOW_PORTS=3000,8080
  Extra TCP ports to allow in firewall.

• HARDEN_FIREWALL_MODE=skip
  Skip firewall changes.

• HARDEN_SKIP_PACKAGE_INSTALL=1
  Skip package installation (only apply config).

Logs

• Hardening log: /var/log/ai-chatbot-hardening.log
• Perf guard log: /var/log/perf-guard.log