264 lines
9.9 KiB
Markdown
264 lines
9.9 KiB
Markdown
# Security Posture Scan — 2026-03-22
|
||
Scan conducted twice: 09:00 AM ET and 14:37 ET (this file reflects both)
|
||
Conducted by: James (weekly cron job)
|
||
|
||
---
|
||
|
||
## AM Scan Summary (09:00 ET)
|
||
| Host | Status | Issues |
|
||
|------|--------|--------|
|
||
| forge (192.168.1.16) | ⚠️ WARNING | 3 findings (zombie+rogue server killed live) |
|
||
| james-old (192.168.1.17) | ⚠️ WARNING | RDP still open (known), xrdp running |
|
||
| staging (192.168.1.253) | ✅ CLEAN | Matches baseline |
|
||
| prod (192.168.100.2) | ❌ UNREACHABLE | SSH key not installed |
|
||
| caddy (192.168.0.2) | ⚠️ WARNING | New user `hans:1002` — needs confirmation |
|
||
| zurich (82.22.36.202) | ✅ CLEAN | High brute force volume (normal for VPS) |
|
||
|
||
---
|
||
|
||
## PM Scan Summary (14:37 ET)
|
||
| Host | Status | Issues |
|
||
|------|--------|--------|
|
||
| forge (192.168.1.16) | ⚠️ WARNING | OC gateway high CPU (83%), VNC unauth'd, hans key unconfirmed |
|
||
| james-old (192.168.1.17) | ❌ UNREACHABLE | SSH timeout (was accessible this morning) |
|
||
| staging (192.168.1.253) | ✅ CLEAN | ClickHouse high CPU (expected), all services healthy |
|
||
| prod (192.168.100.2) | ❌ UNREACHABLE | SSH auth failure (key not installed) |
|
||
| caddy (192.168.0.2) | ⚠️ WARNING | rsyslogd+journald CPU storm; hans:1002 still unconfirmed |
|
||
| zurich (82.22.36.202) | ✅ CLEAN | +32 bans since AM scan, all hardening intact |
|
||
|
||
---
|
||
|
||
## Forge (192.168.1.16) — ⚠️ WARNING
|
||
|
||
### AM Findings (Actions Taken)
|
||
**[FIXED] Zombie bash process (PID 3673859) — 99.9% CPU for ~5 days**
|
||
- `/bin/bash -c openclaw logs --follow | head -30 ...` — spinning log follow loop
|
||
- Killed. Confirmed gone.
|
||
|
||
**[FIXED] Rogue python3 http.server on port 8000 (LAN-bound)**
|
||
- Unexpected listener, no legitimate service
|
||
- Killed. Port confirmed closed.
|
||
|
||
### PM Findings (Ongoing)
|
||
**[WARNING] openclaw-gateway at 83% CPU (PID 1374638)**
|
||
- Running since 04:41 today, accumulated 496 CPU-minutes
|
||
- High but may be normal during heavy agentic work / active sessions
|
||
- Monitor: if sustained at >80% for hours without active sessions, investigate
|
||
|
||
**[INFO] opencode process at 52% CPU (PID 1062817, pts/14)**
|
||
- Started Mar 21, 1033 hours CPU time — long-running dev session
|
||
- Owner: johan, legitimate dev tool
|
||
|
||
**[INFO] fireworks-proxy on 127.0.0.1:18484**
|
||
- PID 1060741: `/usr/bin/python3 /home/johan/.local/bin/fireworks-proxy`
|
||
- localhost only, legitimate API proxy
|
||
|
||
**[KNOWN] x11vnc on port 5900 (all interfaces)**
|
||
- PID 3936577, running since Mar 18
|
||
- VNC without visible password flags in cmdline — authentication status unverified
|
||
- Baseline: not in baseline ports list. Needed for headed Chrome.
|
||
- Recommendation: Restrict to LAN or verify VNC password is set.
|
||
|
||
**[INFO] hans@vault1984-hq key still in authorized_keys**
|
||
- Added 2026-03-08, marked "pending confirmation" in baseline
|
||
- Has NOT been removed. Still awaiting Johan's confirmation.
|
||
|
||
**[INFO] Port 8888 dev server (clavitor) — GONE in PM scan**
|
||
- Was present in AM scan. No longer listening. Clean.
|
||
|
||
### Users
|
||
✅ `johan:1000`, `scanner:1001` — matches baseline
|
||
|
||
### Login History
|
||
✅ All from 192.168.1.14 (Johan's Mac) or 100.114.238.41 (Tailscale). Clean.
|
||
|
||
### Failed Logins
|
||
✅ None (LAN host, not brute-forced)
|
||
|
||
### Crontab (PM check)
|
||
✅ All entries are expected:
|
||
- backup-forge.sh (nightly 3am)
|
||
- claude-usage-check.sh (hourly)
|
||
- ddns-update.sh (every 5 min)
|
||
- health-push.sh (every minute)
|
||
- vault1984-twitter-drip.sh (Mar 18-19 scheduled tweets, past dates)
|
||
|
||
### SSH Hardening
|
||
⚠️ Cannot verify without sudo (user-level only — known limitation)
|
||
|
||
### UFW
|
||
❌ NOT installed (known deficiency — relying on router/network controls)
|
||
|
||
### fail2ban
|
||
✅ Active
|
||
|
||
---
|
||
|
||
## James-Old (192.168.1.17) — ❌ UNREACHABLE (PM scan)
|
||
|
||
SSH timeout (10s) in PM scan. Was accessible in AM scan (user-level).
|
||
|
||
Possible causes:
|
||
- Machine asleep/powered off
|
||
- Network issue
|
||
- SSH service crashed
|
||
|
||
Action needed: Johan to check on james-old. Last known login: Mar 2.
|
||
|
||
**AM findings (carried forward):**
|
||
- Port 3389 (RDP/xrdp) running — origin still unknown from baseline
|
||
- UFW/SSH hardening could not be verified (user-level access only)
|
||
|
||
---
|
||
|
||
## Staging (192.168.1.253) — ✅ CLEAN
|
||
|
||
### Users
|
||
✅ `johan:1000` only
|
||
|
||
### SSH Keys
|
||
Known keys + `johan@inou` (informational — not in baseline but legitimate dev device)
|
||
|
||
### Login History
|
||
Last login: Mar 1 from 192.168.1.14. Machine rarely accessed.
|
||
|
||
### Listening Ports
|
||
✅ All within baseline. Notable:
|
||
- clickhouse (8123/9000), immich (2283), jellyfin (8096), signal-cli (8080)
|
||
- inou services: api (8082), portal (1080), viewer (8765), dbquery (9124)
|
||
- Home Assistant (8123) — overlaps with clickhouse port; both via Docker
|
||
|
||
### Processes
|
||
**[INFO] ClickHouse at 468% CPU** — normal for a multi-core database server under load. Running in Docker (restarted 7 hours ago — fresh start). Healthy.
|
||
|
||
### Docker
|
||
✅ All containers healthy:
|
||
- clickhouse (7h up), immich_server (7h, healthy), immich_machine_learning (7h, healthy)
|
||
- signal-cli-rest-api (7 days, healthy), immich_postgres (6 weeks), immich_redis/valkey (6 weeks), jellyfin (6 weeks)
|
||
|
||
### OpenClaw
|
||
Not running on staging (was in baseline — likely decommissioned there). No concern.
|
||
|
||
---
|
||
|
||
## Prod (192.168.100.2) — ❌ UNREACHABLE
|
||
|
||
SSH returns "Too many authentication failures" — key not installed for james@forge.
|
||
Caddy IS connecting to prod (192.168.0.2→192.168.100.2:1080 outbound seen on caddy), so prod is alive.
|
||
|
||
Action needed: Install james@forge SSH key on prod for future auditing.
|
||
|
||
---
|
||
|
||
## Caddy (192.168.0.2) — ⚠️ WARNING
|
||
|
||
### ⚠️ NEW: rsyslogd + journald CPU Storm
|
||
**rsyslogd: 120% CPU / journald: 57.2% CPU**
|
||
- On a Raspberry Pi, this is severe. These processes have been running since Mar 13.
|
||
- Total CPU time accumulated: rsyslogd 15,973 minutes, journald 7,610 minutes
|
||
- Indicates a logging loop or log storm (possibly from caddy access logs, fail2ban, or a failing service)
|
||
- Recommendation: Check `/var/log/syslog` size and caddy access log volume. May need logrotate tuning.
|
||
- Not blocking, but will impact Pi performance and SD card lifespan.
|
||
|
||
### [CARRIED] hans:1002 — Unconfirmed
|
||
- User exists with bash shell and SSH access (key: `hans@vault1984-hq`)
|
||
- Same fingerprint as hans key in forge's authorized_keys
|
||
- Not in baseline. Needs Johan's confirmation that this was intentional.
|
||
|
||
### Users
|
||
⚠️ `hans:1002` — unconfirmed (see above)
|
||
✅ `stijn:1001` — expected (flourishevents web account)
|
||
|
||
### Root SSH Keys
|
||
✅ Only `james@forge` — matches baseline exactly
|
||
|
||
### Login History
|
||
✅ No interactive logins since boot (Aug 5, 2025). Clean.
|
||
|
||
### Failed Logins
|
||
✅ None (LAN-accessible only, not publicly brute-forced)
|
||
|
||
### Listening Ports
|
||
✅ All expected: 22, 80, 443, 40021 (vsftpd), 1984 (caddy proxying vault1984), 2283 (caddy proxying immich)
|
||
|
||
### SSH Hardening
|
||
✅ `passwordauthentication no`, `permitrootlogin without-password`, `pubkeyauthentication yes`
|
||
|
||
### UFW
|
||
✅ Active. Rules unchanged from AM scan.
|
||
|
||
### fail2ban
|
||
❌ Not running (known from baseline — never installed)
|
||
|
||
### TLS Certificate
|
||
✅ inou.com cert valid: Mar 5 – Jun 3, 2026 (73 days remaining)
|
||
|
||
### Security Patches
|
||
⚠️ `linux-image-raspi` 6.8.0-1048 security kernel update pending (same as AM scan — not yet applied)
|
||
|
||
### Outbound
|
||
✅ tailscaled (normal), SSH from james (192.168.1.16), caddy → 192.168.100.2:1080 (prod proxy)
|
||
|
||
---
|
||
|
||
## Zurich (82.22.36.202) — ✅ CLEAN
|
||
|
||
### SSH Brute Force (fail2ban)
|
||
- Total bans since boot: **2,741** (was 2,709 at AM scan — +32 in ~5.5h, normal rate ~6/hour)
|
||
- Currently banned: **4** active bans
|
||
- Recent attempts: ubuntu, susanna, default, sol, shop, admin, harryhaa — all blocked ✅
|
||
- 5 jails active: caddy-kuma, caddy-scanner, sshd, stalwart, vaultwarden ✅
|
||
|
||
### Users
|
||
✅ `harry:1000`, `harry-web:1001` — matches baseline exactly
|
||
|
||
### Root SSH Keys
|
||
✅ All 5 keys match baseline exactly. No additions or removals.
|
||
|
||
### Login History
|
||
Last root logins: Jan 27 from 47.197.93.62 (home IP) — no interactive logins since. ✅
|
||
Current connections: SSH from forge (47.197.93.62) — James' tool connections. ✅
|
||
|
||
### Listening Ports
|
||
✅ All within baseline: SSH, Stalwart mail (25/143/465/587/993/995/4190), 80/443 (Caddy), 3001 (Kuma)
|
||
|
||
### UFW
|
||
✅ Active with 24 rules. Port 3001 (Kuma) IS in UFW allow rules — externally accessible.
|
||
Note: This is a known issue from baseline. Kuma accessible at zurich.inou.com:3001.
|
||
|
||
### SSH Hardening
|
||
✅ `passwordauthentication no`, `permitrootlogin without-password`, `pubkeyauthentication yes`
|
||
|
||
### Security Patches
|
||
✅ No pending security updates
|
||
|
||
### Outbound
|
||
✅ Tailscale only + SSH inbound from forge. Clean.
|
||
|
||
---
|
||
|
||
## Actions Taken This Scan Cycle
|
||
1. **[AM] Killed** zombie bash log-follow process (PID 3673859) — 5-day 99.9% CPU zombie
|
||
2. **[AM] Killed** rogue `python3 -m http.server 8000` — unexpected LAN-bound listener
|
||
|
||
---
|
||
|
||
## Open Items for Johan (Consolidated)
|
||
|
||
### 🔴 Critical / Confirm Required
|
||
1. **Caddy: `hans:1002` user** — Unconfirmed since last scan. Has SSH login access. Confirm or remove.
|
||
2. **Forge: `hans@vault1984-hq` SSH key** — Still "pending confirmation" since 2026-03-08. Confirm or remove.
|
||
|
||
### 🟡 Warnings
|
||
3. **Caddy: rsyslogd/journald CPU storm** — 120%/57% CPU on Raspberry Pi. Check log volume, potential disk/SD wear. Run: `journalctl --disk-usage` and `du -sh /var/log/syslog*`
|
||
4. **James-Old: UNREACHABLE in PM scan** — Was accessible at 9am. Check if machine is up.
|
||
5. **Caddy: Kernel security update** — `linux-image-raspi` 6.8.0-1048 ready to install.
|
||
6. **Forge: VNC (x11vnc) on port 5900** — Verify VNC password is set. Restrict to LAN if not needed externally.
|
||
7. **Forge: openclaw-gateway at 83% CPU** — Monitor. May be normal during heavy agentic sessions.
|
||
|
||
### 🔵 Informational / Housekeeping
|
||
8. **Prod (192.168.100.2)** — Install james@forge SSH key to enable future audits.
|
||
9. **Caddy: fail2ban** — Still not installed (known from baseline).
|
||
10. **James-old: xrdp/RDP (3389)** — Still flagged since baseline. Disable if not needed.
|
||
11. **Zurich: Port 3001 (Kuma)** — Externally accessible via UFW. Consider closing if Caddy proxy is sufficient.
|