Skip to content

Commit 862c2e2

Browse files
author
Martial Mancip
committed
Lots of security improvement after global audit. Update versions. Add Doxygen docs and Github CI.
1 parent 9de6d3e commit 862c2e2

37 files changed

Lines changed: 9402 additions & 0 deletions

CONTRIBUTORS.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Time order
2+
3+
Martial Mancip Project Leader
4+
Yacouba Kaloga Mesh and grid
5+
Cécile Balsier Flask web site backend and frontend
6+
Augustin Visser Docker and micro-services
7+
Merieme Bourenane Machine learning PCA
8+
Yacine Souam Menus and autozoom
9+
Florent Nyberg Cybersecurity of cloud deployement
10+
Billal Guirre NetFilTers dynamic firewall
11+
Fatoumata Sidibe Users roles and cybersecurity audit
12+
Lucas Lablanche Updates and Github continuous integration

InstallOS/Ubuntu/root_install

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
sudo apt-get update
2+
sudo apt-get install -y build-essential gcc screen git htop lsof strace \
3+
emacs-nox nano patch libcap-dev python3-pip \
4+
python3-setuptools python3-dev postgresql \
5+
python-is-python3
6+
sudo setcap cap_net_admin=eip $(realpath $(which python3))
7+
8+
9+
# DOCKER INSTALL
10+
sudo apt-get install -y ca-certificates curl gnupg
11+
12+
sudo install -m 0755 -d /etc/apt/keyrings
13+
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
14+
sudo chmod a+r /etc/apt/keyrings/docker.asc
15+
16+
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
17+
Types: deb
18+
URIs: https://download.docker.com/linux/ubuntu
19+
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
20+
Components: stable
21+
Architectures: $(dpkg --print-architecture)
22+
Signed-By: /etc/apt/keyrings/docker.asc
23+
EOF
24+
25+
sudo apt-get update
26+
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
27+
28+
# Enable and start Docker
29+
sudo systemctl --now enable docker
30+
31+
# Generate a safe random high port (between 49152 and 65535)
32+
SSHport=$(shuf -i 49152-65535 -n 1)
33+
#echo "Your randomized SSH port is: $SSHport"
34+
35+
# Update sshd_config
36+
sudo sed -i -e "s/^#\?Port 22/Port $SSHport/" -e "s/^#\?GatewayPorts.*/GatewayPorts yes/" /etc/ssh/sshd_config
37+
38+
# CRITICAL FOR UBUNTU since 22.10 : Disable systemd socket activation for SSH so it honors sshd_config
39+
if systemctl is-active --quiet ssh.socket; then
40+
echo "Disabling SSH socket activation and switching to standard SSH service..."
41+
sudo systemctl disable --now ssh.socket
42+
sudo systemctl enable --now ssh.service
43+
fi
44+
# OR
45+
# sudo systemctl daemon-reload
46+
# sudo systemctl restart ssh.socket
47+
48+
sudo apt-get install -y nftables
49+
nft list ruleset
50+
51+
# Write the rules to Ubuntu's default configuration path
52+
nano /etc/nftables.conf
53+
```
54+
table inet filter {
55+
chain input {
56+
type filter hook input priority filter; policy drop;
57+
iif "lo" accept
58+
ct state established,related accept
59+
# Allow ping
60+
icmp type echo-request limit rate 5/second accept
61+
tcp dport $SSHport accept
62+
tcp dport 80 accept
63+
tcp dport 443 accept
64+
}
65+
}
66+
```
67+
68+
# Load the newly written rules immediately
69+
sudo nft -f /etc/nftables.conf
70+
# OR
71+
# nft add rule inet filter input tcp dport $SSHport accept
72+
# nft add rule inet filter input icmp type echo-request limit rate 5/second accept
73+
74+
# Add custom TILEDVIZ tables and chains
75+
sudo nft add table ip filter
76+
sudo nft add chain ip filter TILEDVIZ
77+
sudo nft add rule ip filter TILEDVIZ tcp dport $SSHport accept
78+
79+
# Enable and start nftables service on boot
80+
sudo systemctl --now enable nftables.service
81+
82+
# Restart SSH to apply the randomized port
83+
sudo systemctl restart ssh
84+
85+
USER="myuser"
86+
sudo usermod -a -G docker $USER
87+
# User must logout and login again.
88+
89+
# copy SSL keys from local machine to VPS:
90+
rootVPS> chown $USER /path_to_keys/domain.my
91+
localUSER> rsync -e "ssh -T -p $SSHport " /local/SSLpath/domain.my/* $USER@host.docmain.my:/path_to_keys/domain.my
92+
rootVPS> chown root:root -R /path_to_keys/domain.my
93+
rootVPS> chmod o-rx /path_to_keys/domain.my
94+
95+
localUSER> rsync -e "ssh -T -p $SSHport " $TILEDVIZPATH/InstalOS/daemon.json $USER@host.docmain.my:./
96+
rootVPS> mv ~$USER/tmp/daemon.json /etc/docker/
97+
rootVPS> chown root:root /etc/docker/daemon.json
98+
rootVPS> systemctl restart docker
99+
100+
101+
rootVPS> apt-get install -y fail2ban
102+
#nginx
103+
104+
#rootVPS> mv /etc/nginx/nginx.conf /etc/nginx/nginx.conf_00
105+
#rootVPS> cp $TILEDVIZ/TVWeb/nginx/nginx.conf /etc/nginx
106+
#rootVPS> systemctl enable --now nginx
107+
rootVPS> mkdir /var/log/nginx
108+
rootVPS> touch /var/log/nginx/access.log /var/log/nginx/upstream.log /var/log/nginx/error.log
109+
110+
rootVPS> cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
111+
112+
rootVPS> sed -e 's&^\[sshd\]&[sshd]\nenabled=true\nbantime = 3600\nfindtime = 600\nmaxretry = 3&' -i /etc/fail2ban/jail.local
113+
rootVPS> sed -e "s&^port\ * = ssh&port = $SSHport&" -i /etc/fail2ban/jail.local
114+
rootVPS> sed -e 's&^\[\(nginx-.*\)\]&[\1]\nenabled=true&' -i /etc/fail2ban/jail.local
115+
#TODO :
116+
#* add nginx-botsearch2.conf
117+
#[nginx-botsearch2]
118+
#enabled=true
119+
#port = http,https
120+
#logpath = %(nginx_access_log)s
121+
#* Open php-url-fopen
122+
#[php-url-fopen]
123+
#enabled=true
124+
125+
rootVPS> mv /etc/logrotate.d/nginx /root
126+
127+
rootVPS> systemctl --now enable fail2ban
128+
129+
# TODO : relaunch fail2ban after TiledViz to see nginx error files mount on host ?
130+
rootVPS> systemctl restart fail2ban
131+
rootVPS> fail2ban-client status --all |less
132+
133+
# After TiledViz started :
134+
rootVPS> nft -nNsta list ruleset |less

TVDatabase/saveDB

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
#source ../envDB
3+
source $HOME/.cache/envTiledViz
4+
FILE=./TiledViz_$(date +%F_%H-%M).dump
5+
#pg_dump -h ${POSTGRES_HOST} -U tiledviz -d TiledViz -p ${POSTGRES_PASSWORD} > ${FILE}
6+
pg_dump -h ${POSTGRES_HOST} -U ${POSTGRES_USER} -d ${POSTGRES_DB} -p ${POSTGRES_PORT} > ${FILE}
7+
8+
9+
#docker cp ./TiledViz.dump $postgresNAME:/tmp/
10+
#docker exec $postgresNAME bash -c 'psql -h "'$POSTGRES_HOST'" -p "'$POSTGRES_PORT'" -U "'$POSTGRES_USER'" -d "'$POSTGRES_DB'" < /tmp/'${FILE}
Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8">
5+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
6+
<title>502 - Bad Gateway</title>
7+
<style>
8+
* { margin: 0; padding: 0; box-sizing: border-box; }
9+
body {
10+
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
11+
display: flex;
12+
justify-content: center;
13+
align-items: center;
14+
min-height: 100vh;
15+
background-color: #f5f5f5;
16+
color: #333;
17+
}
18+
.container {
19+
text-align: center;
20+
padding: 2rem;
21+
}
22+
.error-code {
23+
font-size: 6rem;
24+
font-weight: 700;
25+
color: #e67e22;
26+
line-height: 1;
27+
}
28+
.error-title {
29+
font-size: 1.5rem;
30+
margin: 1rem 0;
31+
color: #555;
32+
}
33+
.error-desc {
34+
font-size: 1rem;
35+
color: #777;
36+
margin-bottom: 2rem;
37+
}
38+
.btn {
39+
display: inline-block;
40+
padding: 0.75rem 1.5rem;
41+
background-color: #3498db;
42+
color: white;
43+
text-decoration: none;
44+
border-radius: 5px;
45+
font-size: 1rem;
46+
transition: background-color 0.2s;
47+
}
48+
.btn:hover { background-color: #2980b9; }
49+
</style>
50+
</head>
51+
<body>
52+
<div class="container">
53+
<div class="error-code">502</div>
54+
<h1 class="error-title">Bad Gateway</h1>
55+
<p class="error-desc">
56+
The server received an invalid response from an upstream server.
57+
Please try again in a moment.
58+
</p>
59+
<a href="/" class="btn">Go Home</a>
60+
</div>
61+
</body>
62+
</html>
Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8">
5+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
6+
<title>504 - Gateway Timeout</title>
7+
<style>
8+
* { margin: 0; padding: 0; box-sizing: border-box; }
9+
body {
10+
font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
11+
display: flex;
12+
justify-content: center;
13+
align-items: center;
14+
min-height: 100vh;
15+
background-color: #f5f5f5;
16+
color: #333;
17+
}
18+
.container {
19+
text-align: center;
20+
padding: 2rem;
21+
}
22+
.error-code {
23+
font-size: 6rem;
24+
font-weight: 700;
25+
color: #9b59b6;
26+
line-height: 1;
27+
}
28+
.error-title {
29+
font-size: 1.5rem;
30+
margin: 1rem 0;
31+
color: #555;
32+
}
33+
.error-desc {
34+
font-size: 1rem;
35+
color: #777;
36+
margin-bottom: 2rem;
37+
}
38+
.btn {
39+
display: inline-block;
40+
padding: 0.75rem 1.5rem;
41+
background-color: #3498db;
42+
color: white;
43+
text-decoration: none;
44+
border-radius: 5px;
45+
font-size: 1rem;
46+
transition: background-color 0.2s;
47+
}
48+
.btn:hover { background-color: #2980b9; }
49+
</style>
50+
</head>
51+
<body>
52+
<div class="container">
53+
<div class="error-code">504</div>
54+
<h1 class="error-title">Gateway Timeout</h1>
55+
<p class="error-desc">
56+
The server did not receive a timely response from an upstream server.
57+
Please try again later.
58+
</p>
59+
<a href="/" class="btn">Go Home</a>
60+
</div>
61+
</body>
62+
</html>
54.2 KB
Loading
51.3 KB
Loading
54.2 KB
Loading
8.84 KB
Loading
22.9 KB
Loading

0 commit comments

Comments
 (0)