Security - Revision history

Sia at 12:00, 27 April 2026

2026-04-27T12:00:40Z

← Older revision		Revision as of 12:00, 27 April 2026
Line 3:		Line 3:
	<li>By default, bwCloud-OS VMs are only accessible via <strong>SSH (port 22)</strong> and <strong>ICMP</strong> (e.g., ''ping''); all other incoming traffic is blocked for security.</li>		<li>By default, bwCloud-OS VMs are only accessible via <strong>SSH (port 22)</strong> and <strong>ICMP</strong> (e.g., ''ping''); all other incoming traffic is blocked for security.</li>
	<li>To allow access on additional ports (e.g. HTTPS/443), you can add rules via the <strong>Security Groups</strong> in the [https://portal.bw-cloud.org/ Dashboard] — changes take effect immediately.</li>		<li>To allow access on additional ports (e.g. HTTPS/443), you can add rules via the <strong>Security Groups</strong> in the [https://portal.bw-cloud.org/ Dashboard] — changes take effect immediately.</li>
			<li>Following our <strong>security checklist</strong> below can help you harden your bwCloud-OS VM.</li>
			<!--
	<li>Some ports are <strong>centrally filtered</strong> in specific bwCloud-OS regions and cannot be opened individually; refer to this [[Blocked_and_Allowed_Ports\|overview]] for region-specific details.</li>		<li>Some ports are <strong>centrally filtered</strong> in specific bwCloud-OS regions and cannot be opened individually; refer to this [[Blocked_and_Allowed_Ports\|overview]] for region-specific details.</li>
			-->
	<li>If you suspect a <strong>security incident</strong>, stop the affected VMs and submit a [https://bw-support.scc.kit.edu/ support ticket] immediately.</li>		<li>If you suspect a <strong>security incident</strong>, stop the affected VMs and submit a [https://bw-support.scc.kit.edu/ support ticket] immediately.</li>
	}}		}}

Sia at 11:54, 27 April 2026

2026-04-27T11:54:52Z

@@ Line 61: / Line 61: @@
 For more details — including which ports are affected in each region — see the page [[Blocked and Allowed Ports]].
 = General Security Recommendations =
@@ Line 142: / Line 151: @@
 ** Remove outdated snapshots according to your retention plan.
 =Security Incidents =

Sia: /* Security Checklist */

2026-04-27T11:53:18Z

Security Checklist

← Older revision		Revision as of 11:53, 27 April 2026
Line 62:		Line 62:
	For more details — including which ports are affected in each region — see the page [[Blocked and Allowed Ports]].		For more details — including which ports are affected in each region — see the page [[Blocked and Allowed Ports]].

	= Security ~~Checklist~~ =		= General Security Recommendations =

	== Does bwCloud-OS provide a basic security checklist for virtual machines? ==		== Does bwCloud-OS provide a basic security checklist for virtual machines? ==

Sia: /* Optional: host firewall */

2026-04-27T11:49:05Z

Optional: host firewall

← Older revision		Revision as of 11:49, 27 April 2026
Line 97:		Line 97:
	'''Note:''' some ports may be centrally filtered in certain regions; see [[Blocked_and_Allowed_Ports\|Blocked and Allowed Ports]].		'''Note:''' some ports may be centrally filtered in certain regions; see [[Blocked_and_Allowed_Ports\|Blocked and Allowed Ports]].

	=== Optional: host firewall ===		=== Optional host firewall ===
	Security groups are the primary inbound filter in bwCloud-OS. A host firewall can provide an additional layer (defense-in-depth), e.g., to enforce local policies on the VM.		Security groups are the primary inbound filter in bwCloud-OS. A host firewall can provide an additional layer (defense-in-depth), e.g., to enforce local policies on the VM.

Sia at 11:46, 27 April 2026

2026-04-27T11:46:00Z

← Older revision		Revision as of 11:46, 27 April 2026
Line 116:		Line 116:
	</pre>		</pre>

	~~''Important:''~~ If you block SSH on the host firewall while only having SSH access, you may lock yourself out. Always ensure SSH remains permitted (and test from your client).		⚠️ If you block SSH on the host firewall while only having SSH access, you may lock yourself out. Always ensure SSH remains permitted (and test from your client).

	=== Document your configuration ===		=== Document your configuration ===

Sia: /* Optional host firewall (e.g., UFW on Ubuntu) */

2026-04-27T11:43:59Z

Optional host firewall (e.g., UFW on Ubuntu)

← Older revision		Revision as of 11:43, 27 April 2026
Line 97:		Line 97:
	'''Note:''' some ports may be centrally filtered in certain regions; see [[Blocked_and_Allowed_Ports\|Blocked and Allowed Ports]].		'''Note:''' some ports may be centrally filtered in certain regions; see [[Blocked_and_Allowed_Ports\|Blocked and Allowed Ports]].

	=== Optional host firewall ~~(e.g., UFW on Ubuntu)~~ ===		=== Optional: host firewall ===
	Security groups are the primary inbound filter in bwCloud-OS. A host firewall can provide an additional layer (defense-in-depth), e.g., to enforce local policies on the VM.		Security groups are the primary inbound filter in bwCloud-OS. A host firewall can provide an additional layer (defense-in-depth), e.g., to enforce local policies on the VM.

Sia: /* Allow only the minimal required ports in bwCloud-OS Security Groups */

2026-04-27T11:43:21Z

Allow only the minimal required ports in bwCloud-OS Security Groups

← Older revision		Revision as of 11:43, 27 April 2026
Line 95:		Line 95:
	* Restrict access by IP range (CIDR) wherever possible (avoid <code>0.0.0.0/0</code> unless truly required).		* Restrict access by IP range (CIDR) wherever possible (avoid <code>0.0.0.0/0</code> unless truly required).
	* For step-by-step instructions and examples, see: [[Security#Security-Rules\|How do I open additional ports for my instance?]]		* For step-by-step instructions and examples, see: [[Security#Security-Rules\|How do I open additional ports for my instance?]]
	* Note: some ports may be centrally filtered in certain regions; see [[Blocked_and_Allowed_Ports\|Blocked and Allowed Ports]].		'''Note:''' some ports may be centrally filtered in certain regions; see [[Blocked_and_Allowed_Ports\|Blocked and Allowed Ports]].

	=== Optional host firewall (e.g., UFW on Ubuntu) ===		=== Optional host firewall (e.g., UFW on Ubuntu) ===

Sia: /* Does bwCloud-OS provide a basic security checklist for virtual machines? */

2026-04-27T11:40:59Z

Does bwCloud-OS provide a basic security checklist for virtual machines?

← Older revision		Revision as of 11:40, 27 April 2026
Line 65:		Line 65:

	== Does bwCloud-OS provide a basic security checklist for virtual machines? ==		== Does bwCloud-OS provide a basic security checklist for virtual machines? ==

	~~The following checklist helps you harden your bwCloud-OS instance after creation.~~


	The following checklist helps you harden your bwCloud-OS instance after creation.		The following checklist helps you harden your bwCloud-OS instance after creation.

Sia at 11:40, 27 April 2026

2026-04-27T11:40:19Z

← Older revision		Revision as of 11:40, 27 April 2026
Line 71:		Line 71:
	The following checklist helps you harden your bwCloud-OS instance after creation.		The following checklist helps you harden your bwCloud-OS instance after creation.

	== Secure SSH access ==		=== Secure SSH access ===
	* Read and apply the recommendations in the [[Guide:_SSH\|SSH guide]].		* Read and apply the recommendations in the [[Guide:_SSH\|SSH guide]].

	== Keep the system updated ==		=== Keep the system updated ===
	Keeping your instance up to date is one of the most effective security measures: security updates fix known vulnerabilities that may otherwise be exploitable.		Keeping your instance up to date is one of the most effective security measures: security updates fix known vulnerabilities that may otherwise be exploitable.

Line 81:		Line 81:
	* '''Automatic updates:''' The system installs security updates automatically in the background. On Ubuntu/Debian this is commonly done via <code>unattended-upgrades</code>.		* '''Automatic updates:''' The system installs security updates automatically in the background. On Ubuntu/Debian this is commonly done via <code>unattended-upgrades</code>.

	=== Example (Ubuntu/Debian) ===		==== Example (Ubuntu/Debian) ====
	<pre>		<pre>
	# Manual updates (one-time)		# Manual updates (one-time)
Line 92:		Line 92:
	</pre>		</pre>

	== Allow only the minimal required ports in bwCloud-OS Security Groups ==		=== Allow only the minimal required ports in bwCloud-OS Security Groups ===
	Only open the ports you actually need. This reduces the attack surface and limits who can reach services on your VM.		Only open the ports you actually need. This reduces the attack surface and limits who can reach services on your VM.

Line 100:		Line 100:
	* Note: some ports may be centrally filtered in certain regions; see [[Blocked_and_Allowed_Ports\|Blocked and Allowed Ports]].		* Note: some ports may be centrally filtered in certain regions; see [[Blocked_and_Allowed_Ports\|Blocked and Allowed Ports]].

	== Optional host firewall (e.g., UFW on Ubuntu) ==		=== Optional host firewall (e.g., UFW on Ubuntu) ===
	Security groups are the primary inbound filter in bwCloud-OS. A host firewall can provide an additional layer (defense-in-depth), e.g., to enforce local policies on the VM.		Security groups are the primary inbound filter in bwCloud-OS. A host firewall can provide an additional layer (defense-in-depth), e.g., to enforce local policies on the VM.

	=== Example (Ubuntu with UFW) ===		==== Example (Ubuntu with UFW) ====
	<pre>		<pre>
	sudo apt -y install ufw		sudo apt -y install ufw
Line 121:		Line 121:
	''Important:'' If you block SSH on the host firewall while only having SSH access, you may lock yourself out. Always ensure SSH remains permitted (and test from your client).		''Important:'' If you block SSH on the host firewall while only having SSH access, you may lock yourself out. Always ensure SSH remains permitted (and test from your client).

	== Document your configuration ==		=== Document your configuration ===
	To operate and troubleshoot securely, keep a record of your instance configuration:		To operate and troubleshoot securely, keep a record of your instance configuration:

Line 129:		Line 129:
	* Where secrets are stored/managed (avoid putting secrets in shell history or plain text files).		* Where secrets are stored/managed (avoid putting secrets in shell history or plain text files).

	== Plan and test a backup strategy ==		=== Plan and test a backup strategy ===
	Backups are part of security (availability and recovery).		Backups are part of security (availability and recovery).

Line 137:		Line 137:
	* Regularly test restores (a backup that was never restored is an assumption, not a plan).		* Regularly test restores (a backup that was never restored is an assumption, not a plan).

	== Snapshots and images ==		=== Snapshots and images ===
	Snapshots capture the state of a VM or volume at a point in time (e.g., before risky changes). They can help with rollback, but they do not automatically replace a backup strategy.		Snapshots capture the state of a VM or volume at a point in time (e.g., before risky changes). They can help with rollback, but they do not automatically replace a backup strategy.

Sia: /* Security Checklist */

2026-04-27T11:37:16Z

Security Checklist

← Older revision		Revision as of 11:37, 27 April 2026
Line 63:		Line 63:

	= Security Checklist =		= Security Checklist =

			== Does bwCloud-OS provide a basic security checklist for virtual machines? ==

			The following checklist helps you harden your bwCloud-OS instance after creation.


	The following checklist helps you harden your bwCloud-OS instance after creation.		The following checklist helps you harden your bwCloud-OS instance after creation.

	== 1) Secure SSH access ==		== Secure SSH access ==
	* Read and apply the recommendations in the [[Guide:_SSH\|SSH guide]].		* Read and apply the recommendations in the [[Guide:_SSH\|SSH guide]].

	== 2) Keep the system updated ==		== Keep the system updated ==
	Keeping your instance up to date is one of the most effective security measures: security updates fix known vulnerabilities that may otherwise be exploitable.		Keeping your instance up to date is one of the most effective security measures: security updates fix known vulnerabilities that may otherwise be exploitable.

Line 87:		Line 92:
	</pre>		</pre>

	== 3) Allow only the minimal required ports in bwCloud-OS Security Groups ==		== Allow only the minimal required ports in bwCloud-OS Security Groups ==
	Only open the ports you actually need. This reduces the attack surface and limits who can reach services on your VM.		Only open the ports you actually need. This reduces the attack surface and limits who can reach services on your VM.

Line 95:		Line 100:
	* Note: some ports may be centrally filtered in certain regions; see [[Blocked_and_Allowed_Ports\|Blocked and Allowed Ports]].		* Note: some ports may be centrally filtered in certain regions; see [[Blocked_and_Allowed_Ports\|Blocked and Allowed Ports]].

	== 4) Optional host firewall (e.g., UFW on Ubuntu) ==		== Optional host firewall (e.g., UFW on Ubuntu) ==
	Security groups are the primary inbound filter in bwCloud-OS. A host firewall can provide an additional layer (defense-in-depth), e.g., to enforce local policies on the VM.		Security groups are the primary inbound filter in bwCloud-OS. A host firewall can provide an additional layer (defense-in-depth), e.g., to enforce local policies on the VM.

Line 116:		Line 121:
	''Important:'' If you block SSH on the host firewall while only having SSH access, you may lock yourself out. Always ensure SSH remains permitted (and test from your client).		''Important:'' If you block SSH on the host firewall while only having SSH access, you may lock yourself out. Always ensure SSH remains permitted (and test from your client).

	== 5) Document your configuration ==		== Document your configuration ==
	To operate and troubleshoot securely, keep a record of your instance configuration:		To operate and troubleshoot securely, keep a record of your instance configuration:

Line 124:		Line 129:
	* Where secrets are stored/managed (avoid putting secrets in shell history or plain text files).		* Where secrets are stored/managed (avoid putting secrets in shell history or plain text files).

	== 6) Plan and test a backup strategy ==		== Plan and test a backup strategy ==
	Backups are part of security (availability and recovery).		Backups are part of security (availability and recovery).

Line 132:		Line 137:
	* Regularly test restores (a backup that was never restored is an assumption, not a plan).		* Regularly test restores (a backup that was never restored is an assumption, not a plan).

	== 7) Snapshots and images ==		== Snapshots and images ==
	Snapshots capture the state of a VM or volume at a point in time (e.g., before risky changes). They can help with rollback, but they do not automatically replace a backup strategy.		Snapshots capture the state of a VM or volume at a point in time (e.g., before risky changes). They can help with rollback, but they do not automatically replace a backup strategy.