Security - Revision history

Jl: Add Security Checklist

2026-02-16T17:25:25Z

Add Security Checklist

← Older revision		Revision as of 17:25, 16 February 2026
Line 61:		Line 61:

	For more details — including which ports are affected in each region — see the page [[Blocked and Allowed Ports]].		For more details — including which ports are affected in each region — see the page [[Blocked and Allowed Ports]].

			= Security Checklist =

			The following checklist helps you harden your bwCloud-OS instance after creation.

			== 1) Secure SSH access ==
			* Read and apply the recommendations in the [[Guide:_SSH\|SSH guide]].

			== 2) Keep the system updated ==
			Keeping your instance up to date is one of the most effective security measures: security updates fix known vulnerabilities that may otherwise be exploitable.

			There are two common approaches:
			* '''Manual updates (one-time / on demand):''' You run updates yourself (e.g., after login, on a regular schedule).
			* '''Automatic updates:''' The system installs security updates automatically in the background. On Ubuntu/Debian this is commonly done via <code>unattended-upgrades</code>.

			=== Example (Ubuntu/Debian) ===
			<pre>
			# Manual updates (one-time)
			sudo apt update
			sudo apt -y upgrade

			# Automatic security updates (background)
			sudo apt -y install unattended-upgrades
			sudo dpkg-reconfigure --priority=low unattended-upgrades
			</pre>

			== 3) Allow only the minimal required ports in bwCloud-OS Security Groups ==
			Only open the ports you actually need. This reduces the attack surface and limits who can reach services on your VM.

			* Check your instance's security groups in the [https://portal.bw-cloud.org/ Dashboard] and allow only the minimal required inbound rules.
			* Restrict access by IP range (CIDR) wherever possible (avoid <code>0.0.0.0/0</code> unless truly required).
			* For step-by-step instructions and examples, see: [[Security#Security-Rules\|How do I open additional ports for my instance?]]
			* Note: some ports may be centrally filtered in certain regions; see [[Blocked_and_Allowed_Ports\|Blocked and Allowed Ports]].

			== 4) Optional host firewall (e.g., UFW on Ubuntu) ==
			Security groups are the primary inbound filter in bwCloud-OS. A host firewall can provide an additional layer (defense-in-depth), e.g., to enforce local policies on the VM.

			=== Example (Ubuntu with UFW) ===
			<pre>
			sudo apt -y install ufw
			sudo ufw default deny incoming
			sudo ufw default allow outgoing

			# Allow SSH (ideally restrict in the bwCloud-OS security group as well)
			sudo ufw allow 22/tcp

			# Example: allow HTTPS if you opened 443 in the security group
			sudo ufw allow 443/tcp

			sudo ufw enable
			sudo ufw status verbose
			</pre>

			''Important:'' If you block SSH on the host firewall while only having SSH access, you may lock yourself out. Always ensure SSH remains permitted (and test from your client).

			== 5) Document your configuration ==
			To operate and troubleshoot securely, keep a record of your instance configuration:

			* Which security groups/rules are attached (ports, protocols, CIDRs)?
			* Host firewall rules (if used), SSH hardening settings, update strategy.
			* Installed services and exposed endpoints.
			* Where secrets are stored/managed (avoid putting secrets in shell history or plain text files).

			== 6) Plan and test a backup strategy ==
			Backups are part of security (availability and recovery).

			* Define what needs to be recoverable (system, application data, databases, configuration).
			* Decide on backup frequency and retention (e.g., daily incremental + weekly full).
			* Store backups separately from the instance (avoid a single point of failure).
			* Regularly test restores (a backup that was never restored is an assumption, not a plan).

			== 7) Snapshots and images ==
			Snapshots capture the state of a VM or volume at a point in time (e.g., before risky changes). They can help with rollback, but they do not automatically replace a backup strategy.

			* Learn more: [[Guide:_Volumes_and_Images\|Guide: Volumes and Images]]
			* Recommended practice:
			** Take a snapshot before major changes (OS upgrades, large configuration changes).
			** Remove outdated snapshots according to your retention plan.

	= SSL Certificates & Secure Services =		= SSL Certificates & Secure Services =

Sia at 19:18, 18 January 2026

2026-01-18T19:18:31Z

← Older revision		Revision as of 19:18, 18 January 2026
Line 6:		Line 6:
	<li>If you suspect a <strong>security incident</strong>, stop the affected VMs and submit a [https://bw-support.scc.kit.edu/ support ticket] immediately.</li>		<li>If you suspect a <strong>security incident</strong>, stop the affected VMs and submit a [https://bw-support.scc.kit.edu/ support ticket] immediately.</li>
	}}		}}


	__TOC__		__TOC__

Sia at 19:17, 18 January 2026

2026-01-18T19:17:59Z

← Older revision		Revision as of 19:17, 18 January 2026
Line 7:		Line 7:
	}}		}}

	__TOC__		__TOC__

	= Access Control & Firewall Rules =		= Access Control & Firewall Rules =

Sia: /* Example: Opening a Port only for Access from certain IP Ranges */

2026-01-18T19:16:13Z

Example: Opening a Port only for Access from certain IP Ranges

← Older revision		Revision as of 19:16, 18 January 2026
Line 51:		Line 51:
	----		----

	=== Example: Opening a Port only for Access from ~~certain~~ IP Ranges ===		=== Example: Opening a Port only for Access from Certain IP Ranges ===
	'''➡️''' [[Guide: Security Group\|Security Groups Guide]]		'''➡️''' [[Guide: Security Group\|Security Groups Guide]]

Sia: /* Example: Opening a Port only from certain IP Ranges */

2026-01-18T19:15:02Z

Example: Opening a Port only from certain IP Ranges

← Older revision		Revision as of 19:15, 18 January 2026
Line 51:		Line 51:
	----		----

	=== Example: Opening a Port only from certain IP Ranges ===		=== Example: Opening a Port only for Access from certain IP Ranges ===
	'''➡️''' [[Guide: Security Group\|Security Groups Guide]]		'''➡️''' [[Guide: Security Group\|Security Groups Guide]]

Sia at 19:14, 18 January 2026

2026-01-18T19:14:15Z

← Older revision		Revision as of 19:14, 18 January 2026
Line 1:		Line 1:
	~~<span id="In-a-Nutshell"></span>~~
	{{InANutshell\|		{{InANutshell\|
	<li>By default, bwCloud-OS VMs are only accessible via <strong>SSH (port 22)</strong> and <strong>ICMP</strong> (e.g., ''ping''); all other incoming traffic is blocked for security.</li>		<li>By default, bwCloud-OS VMs are only accessible via <strong>SSH (port 22)</strong> and <strong>ICMP</strong> (e.g., ''ping''); all other incoming traffic is blocked for security.</li>
Line 6:		Line 6:
	<li>If you suspect a <strong>security incident</strong>, stop the affected VMs and submit a [https://bw-support.scc.kit.edu/ support ticket] immediately.</li>		<li>If you suspect a <strong>security incident</strong>, stop the affected VMs and submit a [https://bw-support.scc.kit.edu/ support ticket] immediately.</li>
	}}		}}

	~~'''➡️ More information in the guide about''' '''[[Guide: Security Group\|Security Groups]].'''~~

	__TOC__		__TOC__
Line 50:		Line 48:
	#* <code>Egress</code> = outgoing connections		#* <code>Egress</code> = outgoing connections
	# Click '''Add'''. The rule will be created and added to the list immediately.		# Click '''Add'''. The rule will be created and added to the list immediately.

			----

			=== Example: Opening a Port only from certain IP Ranges ===
			'''➡️''' [[Guide: Security Group\|Security Groups Guide]]

	== Are some ports blocked in bwCloud-OS? ==		== Are some ports blocked in bwCloud-OS? ==

As1844 at 12:55, 16 January 2026

2026-01-16T12:55:50Z

← Older revision		Revision as of 12:55, 16 January 2026
Line 7:		Line 7:
	}}		}}

			'''➡️ More information in the guide about''' '''[[Guide: Security Group\|Security Groups]].'''

	__TOC__		__TOC__

Sia: /* What should I do if I suspect my VM has been compromised? */

2025-11-10T18:15:05Z

What should I do if I suspect my VM has been compromised?

← Older revision		Revision as of 18:15, 10 November 2025
Line 75:		Line 75:
	If you suspect that your VM has been compromised, please take the following steps '''immediately''':		If you suspect that your VM has been compromised, please take the following steps '''immediately''':

	# '''Log in''' to the '''[https://~~dashboard~~.bw-cloud.org/ Dashboard].'''		# '''Log in''' to the '''[https://portal.bw-cloud.org/ Dashboard].'''
	# '''Stop the affected instance(s).''' ''Do not delete them!'' This preserves data for further analysis.		# '''Stop the affected instance(s).''' ''Do not delete them!'' This preserves data for further analysis.
	# '''Submit a support ticket''' via the [https://bw-support.scc.kit.edu/ bwSupportPortal] with the following details:		# '''Submit a support ticket''' via the [https://bw-support.scc.kit.edu/ bwSupportPortal] with the following details:

Sia: /* Example: Opening Port 443 for HTTPS Access */

2025-11-10T18:14:40Z

Example: Opening Port 443 for HTTPS Access

← Older revision		Revision as of 18:14, 10 November 2025
Line 34:		Line 34:
	If you're running a web server that should be accessible via '''HTTPS''', you typically need to open '''port 443''' in a security group assigned to your instance.		If you're running a web server that should be accessible via '''HTTPS''', you typically need to open '''port 443''' in a security group assigned to your instance.

	'''Steps in the [https://~~dashboard~~.bw-cloud.org/ Dashboard]:'''		'''Steps in the [https://portal.bw-cloud.org/ Dashboard]:'''
	# In the left menu, go to '''Network → Security Groups'''. A list of all defined security groups will appear.		# In the left menu, go to '''Network → Security Groups'''. A list of all defined security groups will appear.
	#* '''Recommended:''' Consider creating a dedicated security group (e.g. named <code>https-access</code>), and assign it to your instance using '''Edit Security Groups''' in the instance menu before the next step.		#* '''Recommended:''' Consider creating a dedicated security group (e.g. named <code>https-access</code>), and assign it to your instance using '''Edit Security Groups''' in the instance menu before the next step.

Sia at 18:14, 10 November 2025

2025-11-10T18:14:05Z

← Older revision		Revision as of 18:14, 10 November 2025
Line 2:		Line 2:
	{{InANutshell\|		{{InANutshell\|
	<li>By default, bwCloud-OS VMs are only accessible via <strong>SSH (port 22)</strong> and <strong>ICMP</strong> (e.g., ''ping''); all other incoming traffic is blocked for security.</li>		<li>By default, bwCloud-OS VMs are only accessible via <strong>SSH (port 22)</strong> and <strong>ICMP</strong> (e.g., ''ping''); all other incoming traffic is blocked for security.</li>
	<li>To allow access on additional ports (e.g. HTTPS/443), you can add rules via the <strong>Security Groups</strong> in the [https://~~dashboard~~.bw-cloud.org/ Dashboard] — changes take effect immediately.</li>		<li>To allow access on additional ports (e.g. HTTPS/443), you can add rules via the <strong>Security Groups</strong> in the [https://portal.bw-cloud.org/ Dashboard] — changes take effect immediately.</li>
	<li>Some ports are <strong>centrally filtered</strong> in specific bwCloud-OS regions and cannot be opened individually; refer to this [[Blocked_and_Allowed_Ports\|overview]] for region-specific details.</li>		<li>Some ports are <strong>centrally filtered</strong> in specific bwCloud-OS regions and cannot be opened individually; refer to this [[Blocked_and_Allowed_Ports\|overview]] for region-specific details.</li>
	<li>If you suspect a <strong>security incident</strong>, stop the affected VMs and submit a [https://bw-support.scc.kit.edu/ support ticket] immediately.</li>		<li>If you suspect a <strong>security incident</strong>, stop the affected VMs and submit a [https://bw-support.scc.kit.edu/ support ticket] immediately.</li>