Skip to content
Documentation
Run a server
Hardening

Hardening

This page lists the steps that make a Lasbolt server harder to attack. The install page already has the unit file. Read Security for what Lasbolt defends against.

The sandbox settings below come from the unit that runs a production server. They were not checked with systemd-analyze security for this page. Run systemd-analyze security lasboltd on your host and read the score.

Run as a separate user

Run lasboltd as its own user (lasbolt) with no login shell. Do not run it as root. lasboltd needs no capability, because it listens on a port above 1024 behind the proxy.

The systemd sandbox

SettingWhat it does
NoNewPrivileges=trueThe process and its children cannot get more rights.
CapabilityBoundingSet= and AmbientCapabilities= (empty)The process has no Linux capability.
ProtectSystem=strict and ReadWritePaths=/var/lib/lasboltThe file system is read-only, except the data folder.
ProtectHome=true, PrivateTmp=true, PrivateDevices=trueNo home folders, a private /tmp, no device files.
ProtectKernelTunables, ProtectKernelModules, ProtectKernelLogs, ProtectControlGroups, ProtectClock, ProtectHostname=trueThe process cannot change kernel settings, load modules, read the kernel log, change cgroups, the clock or the host name.
ProtectProc=invisible and ProcSubset=pidThe process sees only its own entries in /proc.
LockPersonality=trueThe process cannot change its execution domain.
MemoryDenyWriteExecute=trueNo memory is both writable and executable. A Go program built without cgo needs no JIT.
RestrictRealtime, RestrictSUIDSGID, RestrictNamespaces=trueNo realtime scheduling, no SUID files, no new namespaces.
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIXOnly IP sockets and Unix sockets.
SystemCallArchitectures=native, SystemCallFilter=@system-service, SystemCallErrorNumber=EPERMOnly the system calls that a normal service needs.
UMask=0077New files are private to the service user.
RuntimeDirectory=lasbolt, RuntimeDirectoryMode=0700A private folder for the control socket.

If you add a feature that needs more, for example a different folder for backups, add that path to ReadWritePaths.

File permissions

PathOwner and modeWhy
/var/lib/lasboltlasbolt:lasbolt, 0700The database and the backups.
/var/lib/lasbolt/backups0700The server sets this mode itself.
/etc/lasboltroot:lasbolt, 0750Settings and keys.
/etc/lasbolt/lasboltd.envroot:lasbolt, 0640Settings. No secrets.
/etc/lasbolt/passphrase or keklasbolt, 0600 or 0400The server refuses wider modes.
/etc/lasbolt/backup.key.pub0644A public key.
backup.key (private)not on the serverOpens sealed backups.
/run/lasbolt/ctl.socklasbolt, 0600Only the service user and root can use it.

Keep the private backup key and a copy of the unseal secret off the server.

Network exposure

  • lasboltd listens on 127.0.0.1 only. The proxy is the only way in.
  • Open ports 443 and 80 (for the redirect) on the proxy. Do not open 8080.
  • The UDP port 7849 of peer sync is open on all addresses by default. If you do not want it, set --peer-udp off. If you use it, allow it in the firewall. See TLS and proxy.
  • The control socket has no network port. Do not put it in a folder that other users can write to.
  • Set --trusted-proxy to the proxy address only.
  • Use HTTPS for all clients. The server sends Strict-Transport-Security with a long max age.
  • Keep the host patched. Restrict SSH to key login.

Example for firewalld:

sudo firewall-cmd --permanent --add-service=https --add-service=http
sudo firewall-cmd --permanent --add-port=7849/udp   # only if peer sync should work
sudo firewall-cmd --reload

Rate limits

The server limits failed logins. The limits are built in and have no flag:

  • Per user name: 5 failures, then one more try each minute.
  • Per client address: 20 failures, then one more try each 15 seconds.
  • Checks of invitation tokens, device-code logins and reset links have limits of their own.

The per-address limits work only if --trusted-proxy is right. Without it, all users share the address of the proxy. Add a limit in the proxy for the paths /login and /register if you expect many bad requests.

Registration

  • Keep the registration mode at invite or closed. See First owner and users.
  • Use open only for a short time.
  • Give the roles owner and admin to few people.

Second factors for admins

Ask each owner and admin to turn on two-factor authentication in Settings › Security. A second factor limits the damage of a stolen master password. Admin functions also need a login with the master password: the lasbolt CLI and the extensions cannot do them.

A policy that makes a second factor required for all users is planned. It is not available yet.

Other steps

  • Seal the backups to a key that is not on the server. See Backups and restore.
  • Use the terminal passphrase if a person can be there at a restart, or put the key file on a medium that is not the data disk.
  • Watch the log. See Monitoring.
  • Rebuild from a known commit. The build is reproducible: make release-check builds twice and compares the binaries.
Last updated on
MonitoringDeploy with Ansible