gortium/infra
1
1
Fork 0
Code Issues 13 Pull Requests 21 Actions Packages Projects 1 Releases Wiki Activity

security: harden lazyworkhorse with firewall, fail2ban, SSH hardening #27

Closed
Hermes wants to merge 4 commits from feature/server-hardening into master
pull from: feature/server-hardening
merge into: gortium:master
Conversation 0 Commits 4 Files Changed 7 +817 -1

4 Commits

Author SHA1 Message Date
Hermes Agent
ed7852ac08 security: remove deployment commands from ai-worker sudo rules 
ai-worker only needs security audit commands, not deployment access.

Removed:
- nh os switch
- nixos-rebuild switch

Kept:
- Firewall checks (iptables)
- Fail2ban status
- Log inspection (journalctl)
- SSH config (sshd -T)
- Docker service checks
- Network diagnostics
 2026-04-30 17:36:13 +00:00
Hermes Agent
b5b0d4c2d1 security: add restricted sudo for ai-worker with security audit commands 
- Deployment: nh os switch, nixos-rebuild switch (flake path locked)
- Firewall checks: iptables -L, iptables -S
- Fail2ban: status, banned IPs
- Logs: journalctl for kernel and fail2ban
- SSH config: sshd -T for verification
- Docker: ps, inspect (service health)
- Network: ss -tlnp, /proc/net/tcp

All commands are whitelisted with NOPASSWD.
No shell access, no ALL command - principle of least privilege.
 2026-04-30 17:33:05 +00:00
Hermes Agent
157d84e508 security: harden lazyworkhorse with firewall, fail2ban, SSH hardening 
- Firewall (default deny):
  - Allow only essential ports: SSH(2424), Gitea(2222), HTTP(80), HTTPS(443)
  - Rate limit SSH (max 4 new connections/60s)
  - Rate limit HTTP/HTTPS (25/minute)
  - Drop invalid packets, log dropped packets

- Fail2ban (auto-ban attackers):
  - SSH jail: 3 strikes = 1 hour ban
  - HTTP auth failures: 5 strikes = 1 hour ban
  - HTTP scanning: 2 strikes = 2 hour ban
  - Recidive jail: repeat offenders = 1 week ban

- SSH hardening:
  - No root login
  - Max 3 auth tries, 5 sessions
  - 30s login grace time
  - No X11/TCP/agent forwarding
  - Verbose logging

- Kernel network hardening:
  - SYN flood protection (syncookies)
  - IP spoofing protection (rp_filter)
  - Disable source routing, redirects
  - Log martian packets
  - Connection tuning for high load

- Audit logging enabled

Ports commented for review (likely internal-only):
- 8000 (Portainer), 4242 (Coms), 5000/8087/8089 (TAK)
 2026-04-30 17:10:16 +00:00
Hermes Agent
30f8ca3863 Add AI model optimizer cron job draft and initial state files 2026-04-28 17:19:45 +00:00