hiveiq-src/hiveops-guide
7
0
Fork 0
Code Issues 10 Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs(guide): correct devops.backups + devops.security after prod audit

Browse Source 
First pass had a partial view. Backups are 3 layers (Swift dumps + encrypted
off-cluster borg to DLX + Cinder snapshots), not just pg_dumpall — #15 (DR)
resolved, #13/#14 re-scoped. Security has iptables auto-block (security-monitor)
+ AIDE FIM — #17 re-scoped; ClamAV (#16) remains the one real gap.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Johannes
2026-07-02 08:27:18 -04:00
parent 5d23388ef5
commit 03f6c16eab
2 changed files with 61 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/main/resources/content/devops/security/overview.md
+27 -30
View File
@@ -6,44 +6,41 @@ order: 20
audience: dev
---
> **DRAFT · internal.** Written 2026-07-02 from a live sweep of all prod VMs. Security posture
> below was **failing** at time of writing — see the tracked issues. Re-verify before citing.
> **DRAFT · internal.** Rewritten 2026-07-02 after auditing the prod VMs. The first pass reported a
> bare posture ("no firewall/fail2ban") — that was mis-scoped; there IS custom IDS + FIM. Scripts:
> `hiveops-devops/scripts/ops/security/`.
## What the daily check verifies (platform.production-checks §4)
## Controls actually in place
Lightweight "are the controls up" across **all prod VMs** — services (`10.10.10.164`), database
(`10.10.10.188`, **PCI CDE**), cdn (`10.10.10.103`), proxy (`10.10.10.12`), share (`10.10.10.170`),
ollama (`10.10.10.7`). Per VM:
| Control | How | Hosts | PCI |
|---------|-----|-------|-----|
| **Intrusion detection + auto-block** | `security-monitor.sh` (every 5 min): scans nginx logs for attack patterns (`.env`, `.git`, `id_rsa`, `/actuator/env`, `/actuator/heapdump`, webshells…) → **`iptables -I INPUT -s <ip> -j DROP`**; Slack alerts; daily/weekly reports | `.250`, `.252` | Req 1/10/11 (compensating) |
| **File-integrity monitoring** | `aide-check.sh` (daily 03:15): AIDE `--check` → email `alerts@bcos.cloud` on any change | `.250`, `.188` | **Req 11.5** |
| **Firewall** | `iptables` (managed via security-monitor blocks) + almost certainly **OpenStack security groups** at the network layer | all | Req 1 |
| **TLS** | `acme.sh` auto-renew | `.250`, `.252` | — |
```bash
dpkg -l | grep -c clamav # ClamAV installed?
systemctl is-active clamav-freshclam clamav-daemon # updater + daemon running?
ls -l --time-style=+%F /var/lib/clamav/daily.c[vl]d # signature DB age (< 2 days)
sudo ufw status | head -1 ; systemctl is-active fail2ban # host firewall / brute-force guard
```
So iptables auto-blocking and AIDE FIM are live — the box is **not** wide open.
**RED** if AV is missing/stale on any in-scope VM — loudest on the **database VM (PCI CDE)**.
## The one genuine gap: anti-virus (ClamAV)
## Posture as of 2026-07-02 (FAILING — being remediated)
This is the real finding and it still stands (**hiveiq-devops#16, Critical**). Audit 2026-07-02:
| VM | ClamAV | freshclam | DB age | clamd | ufw | fail2ban |
|----|--------|-----------|--------|-------|-----|----------|
| services `.250` | installed | active | current | **failed** | off | off |
| **database `.188` (CDE)** | installed | **stopped** | **stale 06-09** | — | off | off |
| cdn `.252` | installed | **stopped** | **stale 06-09** | off | off | off |
| proxy `.253` | **none** | — | — | — | off | off |
| share `.254` | **none** | — | — | — | off | off |
| ollama `.7` | **none** | — | — | — | off | off |
| VM | ClamAV | freshclam | DB age |
|----|--------|-----------|--------|
| services `.250` | installed | active | current — but **`clamd` failed** |
| **database `.188` (PCI CDE)** | installed | **stopped** | **stale 06-09** |
| cdn `.252` | installed | **stopped** | **stale 06-09** |
| proxy `.253` / share `.254` / ollama `.7` | **not installed** | — | — |
- **Anti-virus (PCI Req 5):** 3 VMs have no AV; db + cdn have a ~3-week-stale signature DB with the
updater stopped; services' `clamd` daemon is failed. Gap on the **CDE** host. → **hiveiq-devops#16 (Critical)**
- **Firewall / brute-force (PCI Req 1):** no host `ufw` and no `fail2ban` anywhere. **Caveat:**
network access is very likely gated by **OpenStack security groups** at the cloud layer — confirm
the SG rules before concluding "no firewall." → **hiveiq-devops#17 (High)**
PCI Req 5 (anti-malware) is not met on most hosts, including the CDE. Remediation: install/enable
ClamAV + freshclam everywhere, fix `clamd` on `.250`. The daily health check (platform.production-checks
§4) flags this per-VM.
## PCI context
## Residual (re-scoped from #17)
The A-LIGN engagement puts the prod stack (esp. the CDE DB VM) in scope. Anti-malware on the CDE is
a hard requirement (Req 5); this must be closed and evidenced. See the PCI notes in project memory.
- No **`ufw`** (iptables is used directly via security-monitor; confirm OpenStack SG rules are the
network firewall of record and document them).
- No **`fail2ban`** — but security-monitor covers *web* attack auto-blocking; **SSH brute-force**
specifically is the residual gap (SSH is key-only, which mitigates). → **hiveiq-devops#17** (re-scoped)
See **platform.production-checks**, **devops.backups**, **platform.topology**.