231 lines
7.0 KiB
Markdown
231 lines
7.0 KiB
Markdown
# Security Audit Summary
|
|
|
|
**Date**: 2026-02-09
|
|
**Servers Audited**: 16
|
|
**Full Report**: `/tmp/security-audit-full-report.txt`
|
|
|
|
## Executive Summary
|
|
|
|
Security audit completed across all infrastructure servers. Multiple security concerns identified ranging from **CRITICAL** to **LOW** priority.
|
|
|
|
## Critical Security Findings
|
|
|
|
### 🔴 CRITICAL
|
|
|
|
1. **Root Login Enabled via SSH** (`ansible-node`, `gitea`)
|
|
- **Risk**: Direct root access increases attack surface
|
|
- **Affected**: 2 servers
|
|
- **Recommendation**: Disable root login immediately
|
|
```yaml
|
|
PermitRootLogin no
|
|
```
|
|
|
|
2. **No Firewall on Multiple Servers**
|
|
- **Risk**: All ports exposed to network
|
|
- **Affected**: `ansible-node`, `gitea`, and others
|
|
- **Recommendation**: Enable UFW with strict rules
|
|
|
|
3. **Password Authentication Enabled on Jenkins**
|
|
- **Risk**: We enabled this for temporary AWS access
|
|
- **Status**: Known configuration (for AWS Jenkins Master)
|
|
- **Recommendation**: Switch to key-based auth when possible
|
|
|
|
### 🟠 HIGH
|
|
|
|
4. **Automatic Updates Not Configured**
|
|
- **Risk**: Servers missing security patches
|
|
- **Affected**: `ansible-node`, `docker`, and most servers
|
|
- **Recommendation**: Enable unattended-upgrades
|
|
|
|
5. **Security Updates Available**
|
|
- **Critical**: `docker` has **65 pending security updates**
|
|
- **Recommendation**: Apply immediately
|
|
```bash
|
|
ansible docker -m apt -a "upgrade=dist update_cache=yes" -b
|
|
```
|
|
|
|
6. **Multiple Services Exposed on Docker Server**
|
|
- **Risk**: Ports 5000, 8000-8082, 8443, 9000, 11434 publicly accessible
|
|
- **Firewall**: Currently disabled
|
|
- **Recommendation**: Enable firewall, restrict to internal network
|
|
|
|
### 🟡 MEDIUM
|
|
|
|
7. **Password-Based Users on Multiple Servers**
|
|
- **Users with passwords**: root, dlxadmin, directlx, jenkins
|
|
- **Risk**: Potential brute-force targets
|
|
- **Recommendation**: Enforce strong password policies
|
|
|
|
8. **PermitRootLogin Enabled**
|
|
- **Affected**: Several Proxmox nodes
|
|
- **Risk**: Root SSH access possible
|
|
- **Recommendation**: Disable after confirming Proxmox compatibility
|
|
|
|
## Server-Specific Findings
|
|
|
|
### ansible-node (192.168.200.106)
|
|
- ✅ Password auth: Disabled
|
|
- ❌ Root login: **ENABLED**
|
|
- ❌ Firewall: **NOT CONFIGURED**
|
|
- ❌ Auto-updates: **NOT CONFIGURED**
|
|
- Services: nginx (80, 443), MySQL (3306), Webmin (12321)
|
|
|
|
### docker (192.168.200.200)
|
|
- ✅ Root login: Disabled
|
|
- ❌ Firewall: **INACTIVE**
|
|
- ❌ Auto-updates: **NOT CONFIGURED**
|
|
- ⚠️ Security updates: **65 PENDING**
|
|
- Services: Many Docker containers on multiple ports
|
|
|
|
### jenkins (192.168.200.91)
|
|
- ✅ Firewall: Active (ports 22, 8080, 9000, 2222)
|
|
- ⚠️ Password auth: **ENABLED** (intentional for AWS)
|
|
- ⚠️ Keyboard-interactive: **ENABLED** (intentional)
|
|
- Services: Jenkins (8080), SonarQube (9000)
|
|
|
|
### npm (192.168.200.71)
|
|
- ✅ Firewall: Active (ports 22, 80, 443, 81, 2222)
|
|
- ✅ Password auth: Disabled
|
|
- Services: Nginx Proxy Manager, OpenResty
|
|
|
|
### hiveops, smartjournal, odoo
|
|
- ⚠️ Firewall: **DISABLED** (intentional for Docker networking)
|
|
- ❌ Auto-updates: **NOT CONFIGURED**
|
|
- Multiple Docker services running
|
|
|
|
### Proxmox Nodes (proxmox-00, 01, 02)
|
|
- ✅ Firewall: Active
|
|
- ⚠️ Root login: Enabled (may be required for Proxmox)
|
|
- Services: Proxmox web interface
|
|
|
|
## Immediate Actions Required
|
|
|
|
### Priority 1 (Critical - Do Now)
|
|
|
|
1. **Disable Root SSH Login**
|
|
```bash
|
|
ansible all -m lineinfile -a "path=/etc/ssh/sshd_config regexp='^PermitRootLogin' line='PermitRootLogin no'" -b
|
|
ansible all -m service -a "name=sshd state=restarted" -b
|
|
```
|
|
|
|
2. **Apply Security Updates on Docker Server**
|
|
```bash
|
|
ansible docker -m apt -a "upgrade=dist update_cache=yes" -b
|
|
```
|
|
|
|
3. **Enable Firewall on Critical Servers**
|
|
```bash
|
|
# For servers without firewall
|
|
ansible ansible-node,gitea -m apt -a "name=ufw state=present" -b
|
|
ansible ansible-node,gitea -m ufw -a "rule=allow port=22 proto=tcp" -b
|
|
ansible ansible-node,gitea -m ufw -a "state=enabled" -b
|
|
```
|
|
|
|
### Priority 2 (High - This Week)
|
|
|
|
4. **Enable Automatic Security Updates**
|
|
```bash
|
|
ansible all -m apt -a "name=unattended-upgrades state=present" -b
|
|
ansible all -m copy -a "dest=/etc/apt/apt.conf.d/20auto-upgrades content='APT::Periodic::Update-Package-Lists \"1\";\nAPT::Periodic::Unattended-Upgrade \"1\";' mode=0644" -b
|
|
```
|
|
|
|
5. **Configure Firewall for Docker Server**
|
|
```bash
|
|
ansible docker -m ufw -a "rule=allow port={{ item }} proto=tcp" -b
|
|
# Add specific ports needed for services
|
|
```
|
|
|
|
6. **Review and Secure Open Ports**
|
|
- Audit what services need external access
|
|
- Close unnecessary ports
|
|
- Use NPM proxy for web services
|
|
|
|
### Priority 3 (Medium - This Month)
|
|
|
|
7. **Implement Password Policy**
|
|
```yaml
|
|
# In /etc/login.defs
|
|
PASS_MAX_DAYS 90
|
|
PASS_MIN_DAYS 1
|
|
PASS_MIN_LEN 12
|
|
PASS_WARN_AGE 7
|
|
```
|
|
|
|
8. **Enable Fail2Ban**
|
|
```bash
|
|
ansible all -m apt -a "name=fail2ban state=present" -b
|
|
```
|
|
|
|
9. **Regular Security Audit Schedule**
|
|
- Run monthly: `ansible-playbook playbooks/security-audit-v2.yml`
|
|
- Review findings
|
|
- Track improvements
|
|
|
|
## Positive Security Practices Found
|
|
|
|
✅ **Jenkins Server**: Well-configured firewall with specific ports
|
|
✅ **NPM Server**: Good firewall configuration, SSL certificates managed
|
|
✅ **Most Servers**: Password SSH auth disabled (key-only)
|
|
✅ **Most Servers**: Root login restricted
|
|
✅ **Proxmox Nodes**: Firewalls active
|
|
|
|
## Recommended Playbooks
|
|
|
|
### security-hardening.yml (To Be Created)
|
|
```yaml
|
|
- Enable automatic security updates
|
|
- Disable root SSH login (except where needed)
|
|
- Configure UFW on all servers
|
|
- Install fail2ban
|
|
- Set password policies
|
|
- Remove world-writable files
|
|
```
|
|
|
|
### security-monitoring.yml (To Be Created)
|
|
```yaml
|
|
- Monitor failed login attempts
|
|
- Alert on unauthorized access
|
|
- Track open ports
|
|
- Monitor security updates
|
|
```
|
|
|
|
## Compliance Checklist
|
|
|
|
- [ ] All servers have firewall enabled
|
|
- [ ] Root SSH login disabled (except Proxmox)
|
|
- [ ] Password authentication disabled (except where needed)
|
|
- [ ] Automatic updates enabled
|
|
- [ ] No pending critical security updates
|
|
- [ ] Strong password policies enforced
|
|
- [ ] Fail2Ban installed and configured
|
|
- [ ] Regular security audits scheduled
|
|
- [ ] SSH keys rotated (90 days)
|
|
- [ ] Unnecessary services disabled
|
|
|
|
## Next Steps
|
|
|
|
1. **Review this report** with stakeholders
|
|
2. **Execute Priority 1 actions** immediately
|
|
3. **Schedule Priority 2 actions** for this week
|
|
4. **Create remediation playbooks** for automation
|
|
5. **Establish monthly security audit** routine
|
|
6. **Document exceptions** (e.g., Jenkins password auth for AWS)
|
|
|
|
## Resources
|
|
|
|
- Full audit report: `/tmp/security-audit-full-report.txt`
|
|
- Individual reports: `/tmp/security-audit-*/report.txt`
|
|
- Audit playbook: `playbooks/security-audit-v2.yml`
|
|
|
|
## Notes
|
|
|
|
- Jenkins password auth is intentional for AWS Jenkins Master connection
|
|
- Firewall disabled on hiveops/smartjournal/odoo due to Docker networking requirements
|
|
- Proxmox root login may be required for management interface
|
|
|
|
---
|
|
|
|
**Generated**: 2026-02-09
|
|
**Auditor**: Ansible Security Audit v2
|
|
**Next Audit**: 2026-03-09 (monthly)
|