From f30e6aaa2887e377b3ca75cce5eb8f396941c974 Mon Sep 17 00:00:00 2001 From: Johannes Date: Thu, 2 Jul 2026 12:08:22 -0400 Subject: [PATCH] docs(guide): confirm firewall (OpenStack SGs) + SSH key-only posture (devops#17) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SGs are the firewall of record — public surface 80/443, SSH/Loki restricted to internal+admin. All VMs key-only (passwordauthentication no) -> brute-force mitigated, fail2ban optional. Dead SSH-ingress SG (22->world, unattached) to remove. Co-Authored-By: Claude Opus 4.8 --- .../content/devops/security/overview.md | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/backend/src/main/resources/content/devops/security/overview.md b/backend/src/main/resources/content/devops/security/overview.md index 7960056..8cbd517 100644 --- a/backend/src/main/resources/content/devops/security/overview.md +++ b/backend/src/main/resources/content/devops/security/overview.md @@ -47,11 +47,18 @@ Daily health check (platform.production-checks §4) flags per-VM state; also rea > a hung guest. Core services were unaffected. Always `free -m` a VM before adding memory-heavy agents. > Tiny VMs (proxy) → agentless/remote scanning, not on-host clamscan. -## Residual (re-scoped from #17) +## Firewall & SSH — confirmed 2026-07-02 (#17) -- No **`ufw`** (iptables is used directly via security-monitor; confirm OpenStack SG rules are the - network firewall of record and document them). -- No **`fail2ban`** — but security-monitor covers *web* attack auto-blocking; **SSH brute-force** - specifically is the residual gap (SSH is key-only, which mitigates). → **hiveiq-devops#17** (re-scoped) +**Firewall of record = OpenStack security groups** (host `ufw` is not the control and is not needed). +Public (`0.0.0.0/0`) ingress surface: +- `HTTPS ingress` SG → **443** +- `hiveiq-services` SG → **80** + ICMP. SSH **22 restricted** to internal CIDRs (`10.10.10.0/24`, + `10.200.0.0/24` VPN) + one admin IP (`45.16.76.42/32`); Loki **3100** restricted to `10.10.10.0/24`. + +**SSH brute-force = mitigated.** All VMs: `passwordauthentication no` (key-only), root key-only. So +password brute-force is impossible → **fail2ban is optional** (log-noise only, not a security gap). + +**Optional hygiene:** delete the dead **`SSH ingress` SG** (opens 22 to `0.0.0.0/0` but is attached to +no server — latent risk); consider `permitrootlogin no`. See **platform.production-checks**, **devops.backups**, **platform.topology**.