docs: add Hardening-Cacti-Installation guide - #224
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a new OS-level hardening guide to the documentation set and links it from the existing security standards and installation navigation, alongside introducing baseline repo automation configs (CodeQL + Dependabot).
Changes:
- Added
Hardening-Cacti-Installation.mdwith guidance on permissions, web server restrictions, PHP-FPM, SELinux, AppArmor, and verification steps. - Linked the new guide from
README.md(Cacti Installation section) and fromStandards-Security.mdvia a new “See Also”. - Added
.github/workflows/codeql.ymland.github/dependabot.yml.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| Standards-Security.md | Adds a “See Also” link to the new hardening guide. |
| README.md | Adds the hardening guide to the installation navigation list. |
| Hardening-Cacti-Installation.md | New hardening guide content and verification checklist. |
| .github/workflows/codeql.yml | Introduces a CodeQL workflow configuration. |
| .github/dependabot.yml | Introduces Dependabot update configuration. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
8d46a5b to
5957f1c
Compare
The disable_functions list blocked exec/shell_exec/proc_open/popen/system, which the web tier uses for RRDtool, fping and spikekill, so graphs stopped rendering; restrict it to passthru and pcntl_exec. The recursive chmod 755 left config.php DB credentials world-readable; lock it to 640 root:www-data. Cite the real package-import advisory (GHSA-7cmj-g5qc-pj88, CVE-2024-25641), add execute rules for helper binaries to the AppArmor profile, and stop forcing the spine daemon into httpd_t. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
DirectoryMatch is invalid in .htaccess context; scope that example to vhost config and add an .htaccess-compatible FilesMatch alternative. Also move Standards-Security.md's See Also section above the copyright footer instead of after it, and add the missing footer to the new hardening guide. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
|
Fixed the two live issues from review: |
Summary
Hardening-Cacti-Installation.mdcovering OS-level hardening controlsREADME.md(item 8)Standards-Security.mdWhat the guide covers
<DirectoryMatch>and Nginxlocationsnippets that block direct HTTP access toscripts/andresource/; motivated by the package-import advisory where a crafted archive wroteresource/test.phpand reached it over the webclear_env,security.limit_extensions,php_admin_value[disable_functions],expose_php; note onopen_basedirtrade-offs (disables realpath cache)semanage fcontextwithhttpd_sys_content_tvshttpd_sys_rw_content_t,httpd_can_network_connect_dbboolean, systemd drop-inAppArmorProfile=systemd drop-in, complain-before-enforce workflowTest plan
README.mdnavigation entry resolves to the new fileStandards-Security.mdSee Also link resolves correctly