Skip to content

docs: add Hardening-Cacti-Installation guide - #224

Open
somethingwithproof wants to merge 5 commits into
Cacti:developfrom
somethingwithproof:docs/hardening-cacti-installation
Open

docs: add Hardening-Cacti-Installation guide#224
somethingwithproof wants to merge 5 commits into
Cacti:developfrom
somethingwithproof:docs/hardening-cacti-installation

Conversation

@somethingwithproof

Copy link
Copy Markdown
Contributor

Summary

  • Adds Hardening-Cacti-Installation.md covering OS-level hardening controls
  • Integrates into the Cacti Installation nav section in README.md (item 8)
  • Adds a See Also cross-reference in Standards-Security.md

What the guide covers

  • File permission matrix (writable: rra/, log/, cache/; read-only: scripts/, resource/, lib/)
  • Web server access restrictions — Apache <DirectoryMatch> and Nginx location snippets that block direct HTTP access to scripts/ and resource/; motivated by the package-import advisory where a crafted archive wrote resource/test.php and reached it over the web
  • PHP-FPM pool hardening: clear_env, security.limit_extensions, php_admin_value[disable_functions], expose_php; note on open_basedir trade-offs (disables realpath cache)
  • SELinux for RHEL/AlmaLinux/Rocky: semanage fcontext with httpd_sys_content_t vs httpd_sys_rw_content_t, httpd_can_network_connect_db boolean, systemd drop-in
  • AppArmor for Debian/Ubuntu: profile template with explicit deny on scripts/ and resource/ writes, AppArmorProfile= systemd drop-in, complain-before-enforce workflow
  • Verification checklist

Test plan

  • Verify markdown renders without broken links
  • Confirm README.md navigation entry resolves to the new file
  • Confirm Standards-Security.md See Also link resolves correctly

Copilot AI review requested due to automatic review settings April 3, 2026 02:36

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new OS-level hardening guide to the documentation set and links it from the existing security standards and installation navigation, alongside introducing baseline repo automation configs (CodeQL + Dependabot).

Changes:

  • Added Hardening-Cacti-Installation.md with guidance on permissions, web server restrictions, PHP-FPM, SELinux, AppArmor, and verification steps.
  • Linked the new guide from README.md (Cacti Installation section) and from Standards-Security.md via a new “See Also”.
  • Added .github/workflows/codeql.yml and .github/dependabot.yml.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
Standards-Security.md Adds a “See Also” link to the new hardening guide.
README.md Adds the hardening guide to the installation navigation list.
Hardening-Cacti-Installation.md New hardening guide content and verification checklist.
.github/workflows/codeql.yml Introduces a CodeQL workflow configuration.
.github/dependabot.yml Introduces Dependabot update configuration.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread Hardening-Cacti-Installation.md
Comment thread Hardening-Cacti-Installation.md
Comment thread Hardening-Cacti-Installation.md
Comment thread Standards-Security.md Outdated
Comment thread .github/dependabot.yml Outdated
Comment thread .github/workflows/codeql.yml Outdated
@somethingwithproof
somethingwithproof force-pushed the docs/hardening-cacti-installation branch from 8d46a5b to 5957f1c Compare April 4, 2026 02:01
The disable_functions list blocked exec/shell_exec/proc_open/popen/system,
which the web tier uses for RRDtool, fping and spikekill, so graphs stopped
rendering; restrict it to passthru and pcntl_exec. The recursive chmod 755
left config.php DB credentials world-readable; lock it to 640 root:www-data.
Cite the real package-import advisory (GHSA-7cmj-g5qc-pj88, CVE-2024-25641),
add execute rules for helper binaries to the AppArmor profile, and stop
forcing the spine daemon into httpd_t.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
DirectoryMatch is invalid in .htaccess context; scope that example to
vhost config and add an .htaccess-compatible FilesMatch alternative.
Also move Standards-Security.md's See Also section above the copyright
footer instead of after it, and add the missing footer to the new
hardening guide.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
@somethingwithproof

Copy link
Copy Markdown
Contributor Author

Fixed the two live issues from review: .htaccess cannot use DirectoryMatch, so that example is now scoped to vhost config with an .htaccess-compatible FilesMatch alternative added; and the See Also section in Standards-Security.md now sits above the copyright footer instead of after it (and the new hardening guide got its own trailing footer). The table-pipe and dependabot.yml/codeql.yml comments did not apply to the current diff (that table already uses single pipes, and this PR never touches .github/), so those threads are resolved as not applicable.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants