chore: auto-commit uncommitted changes
This commit is contained in:
James
parent
e83b236799
commit
6fcf85d66a
|
|
@ -256,3 +256,8 @@ Implementing WebAuthn setup wizard. Check status with `process(action=poll, sess
|
|||
- `api/routes.go` — routing (websiteFS removed, webFS only, / serves app)
|
||||
- `cmd/vault1984/main.go` — entrypoint (webFS only embed)
|
||||
- `cmd/vault1984/web/index.html` — app UI (setup wizard being rewritten by Opus)
|
||||
09:01 - Weekly memory synthesis cron ran but MEMORY.md edit failed (text match issue). No data lost — synthesis output was generated but not persisted. Will re-run manually when Johan is awake if needed.
|
||||
## 2026-03-01 09:06 — Tax reminder triggered
|
||||
- E-consultant taxes reminder fired (set Feb 16 after Papa's message re: Roy / e-consultants cancellation status 2025)
|
||||
- Johan is in second sleep block — do NOT ping
|
||||
- Add to task board so it shows up when he wakes
|
||||
|
|
|
|||
Binary file not shown.
|
|
@ -1,9 +1,9 @@
|
|||
{
|
||||
"last_updated": "2026-03-01T14:00:02.113160Z",
|
||||
"last_updated": "2026-03-01T17:00:01.979394Z",
|
||||
"source": "api",
|
||||
"session_percent": 11,
|
||||
"session_resets": "2026-03-01T15:00:00.068990+00:00",
|
||||
"weekly_percent": 53,
|
||||
"weekly_resets": "2026-03-06T03:00:00.069006+00:00",
|
||||
"sonnet_percent": 53
|
||||
"session_percent": 2,
|
||||
"session_resets": "2026-03-01T20:00:00.936338+00:00",
|
||||
"weekly_percent": 54,
|
||||
"weekly_resets": "2026-03-06T02:59:59.936356+00:00",
|
||||
"sonnet_percent": 54
|
||||
}
|
||||
|
|
@ -3,7 +3,7 @@
|
|||
"email": 1772305243,
|
||||
"calendar": null,
|
||||
"weather": 1771942030,
|
||||
"briefing": 1772291050,
|
||||
"briefing": 1772375543,
|
||||
"news": 1771597876,
|
||||
"claude_usage": 1772305243
|
||||
},
|
||||
|
|
@ -14,8 +14,8 @@
|
|||
"lastDocInbox": "2026-02-25T22:01:42.532628Z",
|
||||
"lastTechScan": "2026-02-28T12:04:00-05:00",
|
||||
"lastMemoryReview": "2026-02-28T14:03:00Z",
|
||||
"lastIntraDayXScan": "2026-03-01T04:01:37.647Z",
|
||||
"lastInouSuggestion": "2026-02-28T14:00:00Z",
|
||||
"lastIntraDayXScan": "2026-03-01T16:01:55.688Z",
|
||||
"lastInouSuggestion": "2026-03-01T14:33:33.714Z",
|
||||
"lastEmail": 1772132453,
|
||||
"pendingBriefingItems": [
|
||||
{
|
||||
|
|
|
|||
|
|
@ -3,6 +3,8 @@ Established: 2026-02-22
|
|||
|
||||
## Root SSH Authorized Keys
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+9hJSfMkbe68VPbkRmaW/sFFmd3+QBmisJYLY+S6Cj james@forge
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICvQUpzuHN/+4xIS5dZSUY1Me7c17EhHRJdP5TkrfD39 claude@macbook
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4vdTyAAgy6PTsTLy64zQ8HwB3n3N3HQ3VfpLnItN7f johan@ubuntu2404
|
||||
|
||||
## Expected Users (uid>=1000)
|
||||
nobody:65534 (system)
|
||||
|
|
|
|||
|
|
@ -11,6 +11,7 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN5hDM45kOB8jxk+M4Kk9in9bpwZ90sSZsPBMbzJRkbF
|
|||
## Expected Users (uid>=1000)
|
||||
nobody:65534 (system)
|
||||
johan:1000
|
||||
scanner:1001 (SMB scanner share user — added 2026-02)
|
||||
|
||||
## Expected Listening Ports
|
||||
- 22 (SSH)
|
||||
|
|
@ -24,6 +25,7 @@ johan:1000
|
|||
- 9202 (Fully dashboard)
|
||||
- 9300 (dealroom)
|
||||
- 9877/9878 (node)
|
||||
- 1984 (vault1984 — dev project, added 2026-03-01)
|
||||
- 9900 (docproc)
|
||||
- 18789 (openclaw-gateway — all interfaces)
|
||||
- 18792 (openclaw browser — localhost)
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
# James-Old (192.168.1.17) — Security Baseline
|
||||
Established: 2026-02-22
|
||||
Established: 2026-03-01
|
||||
|
||||
## SSH Authorized Keys (johan)
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4vdTyAAgy6PTsTLy64zQ8HwB3n3N3HQ3VfpLnItN7f johan@ubuntu2404
|
||||
|
|
@ -9,27 +9,29 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+9hJSfMkbe68VPbkRmaW/sFFmd3+QBmisJYLY+S6Cj
|
|||
## Expected Users (uid>=1000)
|
||||
nobody:65534 (system)
|
||||
johan:1000
|
||||
snapd-range-524288-root:524288 (snap service — system)
|
||||
snap_daemon:584788 (snap service — system)
|
||||
scanner:1001 (SANE scanner service — system, nologin shell)
|
||||
scanner:1001 (SMB scanner share)
|
||||
snapd-range-524288-root:524288 (snap)
|
||||
snap_daemon:584788 (snap)
|
||||
|
||||
## Expected Listening Ports
|
||||
- 22 (SSH)
|
||||
- 21 (FTP — known)
|
||||
- 21 (FTP — vsftpd, known)
|
||||
- 139/445 (Samba)
|
||||
- 3389 (RDP — xrdp, known)
|
||||
- 3350 (xrdp-sesman — localhost)
|
||||
- 8025 (message-center — localhost)
|
||||
- 3389 (RDP — flagged for review, origin unknown)
|
||||
- 8030 (message-bridge — all interfaces)
|
||||
- 8080 (signal-cli)
|
||||
- 9200 (dashboard)
|
||||
- 1143 (Proton Bridge IMAP — localhost)
|
||||
- 1025 (Proton Bridge SMTP — localhost)
|
||||
- 18789 (OpenClaw)
|
||||
- 19898 (Spacebot/Andrew)
|
||||
|
||||
## SSH Hardening
|
||||
- Could not verify with user-level access (sshd -T requires root or sudoers)
|
||||
|
||||
## Known Firewall State
|
||||
UFW: INACTIVE — ⚠️ no host firewall
|
||||
- UFW: not verified (user-level only access)
|
||||
- LAN-only machine — limited external exposure
|
||||
|
||||
## Known Issues at Baseline
|
||||
- UFW inactive (known deficiency — retired machine)
|
||||
- fail2ban not active
|
||||
- RDP (3389) exposed — known, used for remote desktop
|
||||
- 53 pending apt updates
|
||||
- Port 3389 (RDP) origin unknown — needs investigation
|
||||
- fail2ban status not verified
|
||||
- SSH hardening not directly verified
|
||||
|
|
|
|||
|
|
@ -1,11 +1,8 @@
|
|||
# Staging (192.168.1.253) — Security Baseline
|
||||
Established: 2026-02-22
|
||||
Established: 2026-03-01
|
||||
|
||||
## SSH Authorized Keys (johan)
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICvQUpzuHN/+4xIS5dZSUY1Me7c17EhHRJdP5TkrfD39 claude@macbook
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIpdYKhUPal5p9oI6kN85PAB7oZ+j0P2+xCzvt1rord6 johanjongsma@Johans-MacBook-Pro.local
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG4TEk5EWIwLM3+/pU/H5qxZQlNUvIcxj72bYhYOZeQZ james@server
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+9hJSfMkbe68VPbkRmaW/sFFmd3+QBmisJYLY+S6Cj james@forge
|
||||
Not captured (user-level access only)
|
||||
|
||||
## Expected Users (uid>=1000)
|
||||
nobody:65534 (system)
|
||||
|
|
@ -14,30 +11,24 @@ johan:1000
|
|||
## Expected Listening Ports
|
||||
- 22 (SSH)
|
||||
- 139/445 (Samba)
|
||||
- 2283 (Immich — all interfaces)
|
||||
- 8080 (signal-cli-rest-api — all interfaces)
|
||||
- 8096 (Jellyfin — all interfaces)
|
||||
- 8123 (ClickHouse HTTP — all interfaces)
|
||||
- 9000 (ClickHouse TCP — all interfaces)
|
||||
- 18789 (openclaw-gateway — all interfaces)
|
||||
- 18792 (openclaw browser — localhost)
|
||||
- 1080 (portal)
|
||||
- 2283 (Immich)
|
||||
- 8080 (generic/various)
|
||||
- 8082 (inou api)
|
||||
- 8096 (Jellyfin)
|
||||
- 8123 (Home Assistant)
|
||||
- 8765 (inou viewer)
|
||||
- 9000 (various)
|
||||
- 9124 (inou dbquery)
|
||||
- 1080 (inou portal)
|
||||
- 18789 (OpenClaw)
|
||||
|
||||
## Docker Containers (Known)
|
||||
- clickhouse (clickhouse/clickhouse-server)
|
||||
- immich_server (ghcr.io/immich-app/immich-server)
|
||||
- immich_machine_learning
|
||||
- immich_postgres
|
||||
- immich_redis
|
||||
- jellyfin
|
||||
- signal-cli-rest-api
|
||||
## SSH Hardening
|
||||
- Could not verify with user-level access
|
||||
|
||||
## Known Firewall State
|
||||
UFW: INACTIVE — ⚠️ no host firewall
|
||||
- UFW: not verified (user-level only)
|
||||
- LAN-only dev/staging machine
|
||||
|
||||
## Known Issues at Baseline
|
||||
- UFW inactive (LAN only, home lab — tolerated)
|
||||
- fail2ban not active
|
||||
- SSH hardening not verified (sshd -T requires root)
|
||||
- Many services exposed on all interfaces (LAN-only exposure, acceptable for dev)
|
||||
- SSH hardening not directly verified
|
||||
|
|
|
|||
|
|
@ -0,0 +1,158 @@
|
|||
# Weekly Security Posture Scan — 2026-03-01
|
||||
Scan time: 09:01–09:15 AM EST
|
||||
Scanner: James (OpenClaw cron)
|
||||
|
||||
## Summary
|
||||
| Host | Status | Findings |
|
||||
|------|--------|----------|
|
||||
| forge (localhost) | ⚠️ WARNING | passwordauth YES, new port 1984, new user scanner |
|
||||
| zurich.inou.com | ⚠️ WARNING | 17 upgradable packages |
|
||||
| caddy (192.168.0.2) | ⚠️ WARNING | SSH daemon not responding, extra SSH keys |
|
||||
| james-old (192.168.1.17) | ⚠️ WARNING | Port 3389 (RDP) open, no baseline (first scan) |
|
||||
| staging (192.168.1.253) | ℹ️ INFO | First scan, no baseline |
|
||||
| prod (192.168.100.2) | ❌ ERROR | Access denied — could not scan |
|
||||
|
||||
---
|
||||
|
||||
## Forge (localhost / 192.168.1.16)
|
||||
|
||||
### 🔴 CRITICAL: SSH Password Auth Enabled
|
||||
- `passwordauthentication yes` — differs from baseline expectation
|
||||
- Baseline expected: `no`
|
||||
- **Action needed:** Set `PasswordAuthentication no` in `/etc/ssh/sshd_config`
|
||||
|
||||
### ⚠️ New Service: vault1984 on Port 1984
|
||||
- Process: `./vault1984` (pid 3020492, started ~06:01)
|
||||
- Binary: `/home/johan/dev/vault1984/vault1984`
|
||||
- Not in baseline port list
|
||||
- Appears to be Johan's dev project — confirm and add to baseline if intentional
|
||||
|
||||
### ℹ️ New User: scanner:1001
|
||||
- Added since Feb 22 baseline
|
||||
- Per TOOLS.md: dedicated scanner user for SMB share (`\\...\docsys`)
|
||||
- **Legitimate** — update baseline
|
||||
|
||||
### ✅ Clean Items
|
||||
- SSH keys: match baseline exactly (5 keys, all known)
|
||||
- Logins: all from 192.168.1.14 (Johan's MacBook) — no suspicious IPs
|
||||
- No failed logins (empty lastb)
|
||||
- fail2ban running (root process active)
|
||||
- Crontab: only known jobs (usage-check, health-push, ddns-update)
|
||||
- Docker: not installed (expected)
|
||||
- permitrootlogin: no ✅
|
||||
|
||||
### ℹ️ OCR Service
|
||||
- Port 8090 was offline at scan time — restarted by systemd at 09:03 AM during scan
|
||||
- Now active — monitor for stability
|
||||
|
||||
---
|
||||
|
||||
## Zurich (zurich.inou.com / 82.22.36.202)
|
||||
|
||||
### ⚠️ Upgradable Packages: 17
|
||||
- `apt list --upgradable` returns 17 packages
|
||||
- May include security patches — run `apt upgrade` soon
|
||||
|
||||
### ⚠️ Brute Force Volume (Normal for Public VPS)
|
||||
- fail2ban: 904 total banned, 11 currently banned
|
||||
- Recent attempts: nvidia, ubnt, user, debian, config usernames
|
||||
- `harryhaa` username attempt from 172.94.9.65 — targeting the harry web user by name (not alarming, common scraping)
|
||||
- All blocked by fail2ban ✅
|
||||
|
||||
### ✅ Clean Items
|
||||
- SSH hardened: `passwordauthentication no`, `permitrootlogin without-password` ✅
|
||||
- UFW active with expected rules ✅
|
||||
- Users: harry:1000, harry-web:1001 — match baseline ✅
|
||||
- SSH keys: all 5 match baseline ✅
|
||||
- Docker: uptime-kuma (up 10d), vaultwarden (up 12h) — expected ✅
|
||||
- Last successful logins: only from 47.197.93.62 (home public IP) ✅
|
||||
|
||||
---
|
||||
|
||||
## Caddy (192.168.0.2)
|
||||
|
||||
### ⚠️ SSH Daemon Not Responding on Port 22
|
||||
- `Connection refused` from 192.168.1.16 (forge)
|
||||
- UFW rules should allow 192.168.0.0/22 → 22
|
||||
- Possible: SSH service down, port changed, or firewall misconfiguration
|
||||
- Connected via Tailscale instead (required re-auth — not completed in scan)
|
||||
- **Action needed:** Verify SSH service is running on caddy
|
||||
|
||||
### ⚠️ Extra SSH Keys Not in Baseline
|
||||
- Baseline (Feb 22): only `james@forge`
|
||||
- Current: also has `claude@macbook` and `johan@ubuntu2404`
|
||||
- These are known keys, likely added intentionally — confirm and update baseline
|
||||
|
||||
### ✅ Clean Items
|
||||
- UFW: active with expected rules ✅
|
||||
- Users: nobody, johan:1000, stijn:1001 — match baseline ✅
|
||||
- No failed or suspicious logins
|
||||
- Caddy/FTP services presumably running (UFW rules in place)
|
||||
|
||||
---
|
||||
|
||||
## James-Old (192.168.1.17) — First Scan
|
||||
|
||||
### ⚠️ Port 3389 (RDP) Open — Investigate
|
||||
- RDP listener detected on all interfaces
|
||||
- This machine is on LAN, not public — but still unexplained
|
||||
- No baseline exists — adding this as known but flagged for review
|
||||
|
||||
### ℹ️ Port 21 (FTP) Open
|
||||
- Same as forge — known from Spacebot/Andrew context
|
||||
- LAN only — low risk
|
||||
|
||||
### Users
|
||||
- nobody, johan:1000, snapd-range-524288-root:524288, snap_daemon:584788, scanner:1001
|
||||
- Snap-related users expected if snap packages installed
|
||||
- scanner:1001 — parallel with forge scanner user (SMB)
|
||||
|
||||
### Ports
|
||||
- 18789 (OpenClaw), 19898 (Spacebot/Andrew), 8030 (message-bridge), 8080 (signal-cli), 9200 (dashboard), 22, 139/445 (Samba), 21 (FTP), 3389 (RDP)
|
||||
|
||||
### Logins
|
||||
- All from 192.168.1.14 (Johan's Mac) — clean
|
||||
|
||||
### SSH Hardening
|
||||
- Could not check (insufficient privilege as `johan` user — `sshd -T` returned nothing)
|
||||
|
||||
---
|
||||
|
||||
## Staging (192.168.1.253) — First Scan
|
||||
|
||||
### ℹ️ Services Running (All LAN-only, expected for dev)
|
||||
- Port 2283: likely Immich
|
||||
- Port 8096: Jellyfin
|
||||
- Port 8123: Home Assistant
|
||||
- Port 8080: various
|
||||
- Port 1080/8082/8765/9124: inou portal, api, viewer, dbquery
|
||||
- Port 18789: OpenClaw
|
||||
- Port 22/139/445: SSH/Samba
|
||||
|
||||
### Users
|
||||
- nobody, johan:1000 — clean
|
||||
|
||||
### Logins
|
||||
- All from 192.168.1.14 (Johan's Mac) — clean
|
||||
|
||||
### SSH Hardening
|
||||
- Could not check (insufficient privilege as `johan` user)
|
||||
|
||||
---
|
||||
|
||||
## Prod (192.168.100.2) — ERROR
|
||||
|
||||
- Access denied — `Too many authentication failures`
|
||||
- SSH key not installed or key rotation occurred
|
||||
- Could not scan
|
||||
- **Action needed:** Re-establish SSH access to prod
|
||||
|
||||
---
|
||||
|
||||
## Action Items
|
||||
1. 🔴 **FORGE: Fix SSH password auth** — `sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config && sudo systemctl restart sshd`
|
||||
2. ⚠️ **CADDY: Verify SSH daemon** — check if sshd is running
|
||||
3. ⚠️ **ZURICH: Run apt upgrade** — 17 pending packages
|
||||
4. ⚠️ **JAMES-OLD: Investigate RDP port 3389** — who opened it?
|
||||
5. ⚠️ **PROD: Restore SSH access** — key auth failing
|
||||
6. ℹ️ **Update baselines**: add scanner user (forge/james-old), vault1984 port, caddy extra keys
|
||||
Loading…
Reference in New Issue