schiwagoaandClaude Opus 5.5
2e3f79236c
Web interface to view, ban and unban fail2ban IPs on several hosts via SSH, generalised from the private f2b-web tool. - Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication, English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers - Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo, from= restriction, protected networks, manual jail) - Hardened Docker image, examples, documentation, smoke test, testbed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
31 lines
1.6 KiB
Markdown
31 lines
1.6 KiB
Markdown
# Security
|
||
|
||
## Reporting a vulnerability
|
||
|
||
Please do **not** open a public issue. Send a description and, if possible, steps to
|
||
reproduce to the maintainer via a private message on
|
||
[git.retronerd.at](https://git.retronerd.at/schiwagoa). You will get an answer within a
|
||
few days; fixes are released as soon as possible and mentioned in the changelog.
|
||
|
||
## Security model
|
||
|
||
| Part | Trust | Protection |
|
||
|---|---|---|
|
||
| Browser → web UI | untrusted | login (local / OIDC / proxy), CSRF token on every change, Origin check, strict CSP, no caching |
|
||
| Web UI container | holds the SSH key for all agents | non-root (UID 10050), read-only root FS, no capabilities, `no-new-privileges`, bound to 127.0.0.1 by default |
|
||
| Web UI → agent | SSH with a single ed25519 key | host keys pinned (`StrictHostKeyChecking=yes`), key restricted with `restrict`, `from=` and a forced command |
|
||
| Agent (`f2b-webctl`) | runs as root via one sudo rule | fixed command whitelist, strict IP/jail validation, never bans private, own or protected addresses, syslog of every action |
|
||
|
||
What the web UI **cannot** do on a host: open a shell, forward ports, run other commands,
|
||
change fail2ban configuration, or ban protected addresses.
|
||
|
||
What an attacker **with access to the web UI** can do: ban and unban public IPs on the
|
||
configured hosts. Protect the UI accordingly (strong password or SSO, reverse proxy with
|
||
TLS, ideally an IP allow list).
|
||
|
||
Recommendations:
|
||
|
||
- Always install the agent with `--from <address of the web UI>`.
|
||
- Keep the `data/` directory (SSH key, session secret) readable for UID 10050 only.
|
||
- Rebuild or pull the image regularly – the base image receives Debian security updates.
|