175 lines
7.6 KiB
Markdown
175 lines
7.6 KiB
Markdown
# Weekly Security Posture Scan — 2026-03-09
|
||
Scan time: 09:03–09:20 AM EST
|
||
Scanner: James (OpenClaw cron)
|
||
|
||
## Summary
|
||
| Host | Status | Key Findings |
|
||
|------|--------|--------------|
|
||
| forge (localhost) | 🔴 WARNING | python3 http.server on 9999 exposing /tmp to LAN; new SSH key hans@vault1984-hq; new agentchat:7777 |
|
||
| zurich.inou.com | ✅ CLEAN | 1 upgradable pkg; brute force normal; all services healthy |
|
||
| caddy (192.168.0.2) | ⚠️ WARNING | New user hans:1002 (not in baseline); SSH keys changed; port 2283 added |
|
||
| james-old (192.168.1.17) | ⚠️ WARNING | RDP 3389 still open (ongoing); k2-watchdog cron |
|
||
| staging (192.168.1.253) | ✅ CLEAN | All expected services; logins clean |
|
||
| prod (192.168.100.2) | ✅ CLEAN | SSH restored; services expected |
|
||
|
||
---
|
||
|
||
## Forge (localhost / 192.168.1.16)
|
||
|
||
### 🔴 CRITICAL: Python HTTP Server Exposing /tmp on Port 9999
|
||
- Process: `python3 -m http.server 9999 --bind 0.0.0.0`
|
||
- CWD: `/tmp` — serving the ENTIRE /tmp directory to all interfaces
|
||
- Binary: `/usr/bin/python3.12 (deleted)` — orphaned process, binary was updated/deleted
|
||
- UFW: Port 9999 accessible from entire LAN (192.168.0.0/22 → ALLOW Anywhere rule)
|
||
- **Files exposed:** `clawvault-preview.db`, `clawvault-preview.db-shm/wal`, `cron_keys.txt`, `Caddyfile.bak`, `Caddyfile.new`, dev logs, API test files, android APKs, SQL dumps, etc.
|
||
- **Action needed:** Kill this process immediately — `kill 866793`
|
||
- **Origin:** Started ~Mar 7 01:14 AM, likely left running from a dev session
|
||
|
||
### ⚠️ New SSH Key: hans@vault1984-hq
|
||
- Added to `~/.ssh/authorized_keys` on Mar 8 at 01:46 AM
|
||
- Comment: `hans@vault1984-hq` — appears to be vault1984 project key
|
||
- Not in baseline (baseline was last updated Mar 1)
|
||
- **Action:** Confirm this is intentional; update baseline if so
|
||
|
||
### ⚠️ New Service: agentchat on Port 7777
|
||
- Binary: `/home/johan/dev/agentchat/agentchat`
|
||
- Started ~Mar 8 04:55 AM
|
||
- Not in baseline
|
||
- **Action:** Confirm intentional; add to baseline if so
|
||
|
||
### ✅ FIXED: SSH Hardening (Previously Critical)
|
||
- `passwordauthentication no` ✅ ← FIXED from last week's critical finding!
|
||
- `permitrootlogin no` ✅
|
||
- `pubkeyauthentication yes` ✅
|
||
|
||
### ✅ Clean Items
|
||
- UFW: active ✅
|
||
- fail2ban: running, 0 bans (expected for LAN machine) ✅
|
||
- Users: johan:1000, scanner:1001 — match baseline ✅
|
||
- SSH keys (known): james@server, johan@ubuntu2404, claude@macbook, johanjongsma@Johans-MacBook-Pro.local, johan@thinkpad-x1 — all match baseline ✅
|
||
- Logins: all from 192.168.1.14 (Johan's MacBook) ✅
|
||
- Failed logins: none ✅
|
||
- Crontab: backup-forge, claude-usage-check, ddns-update, health-push — all known ✅
|
||
- vault1984 on 1984, 9900 (docproc), dealspace 9300 — expected ✅
|
||
|
||
---
|
||
|
||
## Zurich (zurich.inou.com / 82.22.36.202)
|
||
|
||
### ✅ Upgradable Packages: 1
|
||
- Down from 17 last week — packages were updated ✅
|
||
- 1 remaining package — low urgency
|
||
|
||
### ✅ Brute Force (Expected for Public VPS)
|
||
- fail2ban stats not captured this scan (output truncated)
|
||
- All SSH connections still restricted to key-only ✅
|
||
|
||
### ✅ Clean Items
|
||
- SSH hardened: passwordauth no, permitroot without-password ✅
|
||
- UFW active with expected rules ✅
|
||
- Docker: uptime-kuma (healthy), vaultwarden (healthy) ✅
|
||
- Services: stalwart-mail on all expected ports, caddy on 80/443 ✅
|
||
- Crontab: vaultwarden-backup, stalwart-allowlist-sync, config-backup, certbot, nuclei-monthly — all expected ✅
|
||
- Last logins from home public IP only ✅
|
||
|
||
---
|
||
|
||
## Caddy (192.168.0.2)
|
||
|
||
### ⚠️ New User: hans:1002
|
||
- `hans:x:1002:1005::/home/hans:/bin/bash`
|
||
- NOT in baseline (baseline: nobody, johan:1000, stijn:1001)
|
||
- Shell set to /bin/bash with home at /home/hans
|
||
- Correlates with `hans@vault1984-hq` key on forge — same person/project
|
||
- **Action:** Confirm who added this user and why; update baseline if intentional
|
||
|
||
### ⚠️ SSH Keys Changed
|
||
- Current root authorized_keys: only `james@forge` (1 key)
|
||
- Baseline had 3 keys: james@forge, claude@macbook, johan@ubuntu2404
|
||
- **2 keys removed** — actually reduces attack surface (good), but unexplained change
|
||
- **Action:** Update baseline to reflect current state
|
||
|
||
### ⚠️ Port 2283 (Caddy binding)
|
||
- Caddy listening on 2283 — likely new reverse proxy entry for Immich
|
||
- Not in baseline (baseline: 22, 80, 443, 40021, 2019-lo, 53-lo)
|
||
- No corresponding UFW rule visible — may be LAN-accessible
|
||
- **Action:** Confirm Caddy is proxying Immich on this port; add to baseline
|
||
|
||
### ✅ Clean Items
|
||
- SSH hardened: passwordauth no, permitroot without-password ✅
|
||
- UFW active ✅
|
||
- fail2ban: not active (known — unchanged from baseline)
|
||
- Logins: `reboot system boot` only (no user logins) — suggests rarely accessed ✅
|
||
- Failed logins: none ✅
|
||
- TLS cert: valid, `notAfter=Jun 3 2026` (~86 days remaining) ✅
|
||
- Crontab: daily config-backup to git ✅
|
||
- SSH daemon: responding normally ✅ (was showing "connection refused" last week — resolved)
|
||
- stijn user: present as expected ✅
|
||
|
||
---
|
||
|
||
## James-Old (192.168.1.17)
|
||
|
||
### ⚠️ RDP Port 3389 (Ongoing)
|
||
- Still open from last scan — investigation pending
|
||
- Process: xrdp (confirmed — shows in process list)
|
||
- LAN-only exposure; low external risk
|
||
- **Action:** Confirm need; disable xrdp if not actively used
|
||
|
||
### ℹ️ k2-watchdog.sh Cron
|
||
- `*/5 * * * * /home/johan/clawd/scripts/k2-watchdog.sh`
|
||
- Not noted in previous baseline (was not captured)
|
||
- Legitimate — added to baseline
|
||
|
||
### ✅ Clean Items
|
||
- Users: johan:1000, scanner:1001 — match baseline ✅ (snap users not present this scan)
|
||
- SSH keys: 3 keys — match baseline ✅
|
||
- Logins: all from 192.168.1.14 (Johan's MacBook), last Mar 2 ✅
|
||
- Failed logins: none ✅
|
||
- Ports: 18789, 19898, 22, 139/445, 8030, 8080, 9200, 3389, 21 — match baseline ✅
|
||
- Processes: xrdp (explains 3389), openclaw, message-bridge, signal-cli — expected ✅
|
||
|
||
---
|
||
|
||
## Staging (192.168.1.253)
|
||
|
||
### ✅ Clean Scan
|
||
- Users: only johan:1000 ✅
|
||
- SSH keys: claude@macbook, johanjongsma@Johans-MacBook-Pro.local, james@server, james@forge — reasonable
|
||
- Logins: all from 192.168.1.14, last Mar 1 ✅
|
||
- Ports: 22, 139/445, 2283 (Immich), 8080, 8082 (inou api), 8096 (Jellyfin), 8123 (HA), 8765, 9000, 9124, 1080 — expected ✅
|
||
- Crontab: inou start.sh @reboot — expected ✅
|
||
|
||
### ℹ️ ClickHouse at 485% CPU
|
||
- `clickhouse-server` pegging ~5 cores at scan time
|
||
- May be running a heavy query or replication/compaction
|
||
- Monitor — not necessarily alarming for ClickHouse
|
||
|
||
---
|
||
|
||
## Prod (192.168.100.2)
|
||
|
||
### ✅ Fully Clean — SSH Access Restored
|
||
- SSH access restored (was broken last week with "Too many auth failures")
|
||
- Users: only johan:1000 ✅
|
||
- SSH keys: claude@macbook, johan@ubuntu2404, james@forge — appropriate
|
||
- Logins: last from 192.168.1.14 on Mar 6 ✅
|
||
- Ports: 22, 8082 (inou api), 1080 (portal), 8765 (viewer) — lean, expected ✅
|
||
|
||
---
|
||
|
||
## Action Items
|
||
1. 🔴 **FORGE: Kill python3 http.server on 9999** — `kill 866793` — exposing /tmp including vault DBs to LAN
|
||
2. ⚠️ **FORGE: Confirm hans@vault1984-hq SSH key** — update baseline when verified
|
||
3. ⚠️ **FORGE: Confirm agentchat on 7777** — update baseline when verified
|
||
4. ⚠️ **CADDY: Who added user hans:1002?** — confirm and update baseline
|
||
5. ⚠️ **CADDY: Update SSH keys baseline** — claude@macbook + johan@ubuntu2404 removed
|
||
6. ⚠️ **CADDY: Confirm port 2283 (Immich proxy)** — add to baseline
|
||
7. ⚠️ **JAMES-OLD: Decision on xrdp/RDP 3389** — disable if not needed
|
||
|
||
## Improvements Since Last Scan
|
||
- ✅ Forge SSH password auth FIXED (was Critical last week)
|
||
- ✅ Zurich packages updated (17 → 1 upgradable)
|
||
- ✅ Prod SSH access restored
|
||
- ✅ Caddy SSH daemon responding normally (was connection refused last week)
|