Security hardening

Tesria arrives set up for a private network. Before people can reach it from the internet, a few things need doing that the software cannot do for you: strong passwords, the stricter web server configuration, two-factor sign-in for the people who run it. This page is that list, with why each item matters.

On a private network, the accounts and operations items still apply.

Configuration

• Task item checkbox for DOMAIN is a real name you control, and ACME_EMAIL is an address someone reads. See HTTPS and domains.

  DOMAIN is a real name you control, and ACME_EMAIL is an address someone reads. See HTTPS and domains.

• Task item checkbox for CADDYFILE=deploy/Caddyfile.public is set. The standard configuration makes a certificate for any name a stranger connects with.

  CADDYFILE=deploy/Caddyfile.public is set. The standard configuration makes a certificate for any name a stranger connects with.

• Task item checkbox for POSTGRES_PASSWORD, APP_DB_PASSWORD, BACKUP_ENCRYPTION_KEY and COLLAB_SHARED_SECRET are long, random and all different. APP_DB_PASSWORD is set; Tesria will not start without it.

  POSTGRES_PASSWORD, APP_DB_PASSWORD, BACKUP_ENCRYPTION_KEY and COLLAB_SHARED_SECRET are long, random and all different. APP_DB_PASSWORD is set; Tesria will not start without it.

• Task item checkbox for Only ports 80 and 443 are open to the outside. Nothing publishes Tesria’s own port (8080), the database (5432) or the live editing service (8090).

  Only ports 80 and 443 are open to the outside. Nothing publishes Tesria’s own port (8080), the database (5432) or the live editing service (8090).

• Task item checkbox for If a proxy of your own sits in front, PROXY_TRUSTED_NETWORKS names exactly that proxy.

  If a proxy of your own sits in front, PROXY_TRUSTED_NETWORKS names exactly that proxy.

• Task item checkbox for You have decided whether pages may show pictures from any website. If what your readers read is private, limit pictures in Admin, Settings (Admin is in the top bar; in a narrower window it is under More, and on a phone in the ☰ menu), under Images.

  You have decided whether pages may show pictures from any website. If what your readers read is private, limit pictures in Admin, Settings (Admin is in the top bar; in a narrower window it is under More, and on a phone in the ☰ menu), under Images.

• Task item checkbox for If single sign-on is on, OIDC_REQUIRE_HTTPS_METADATA is left out or true.

  If single sign-on is on, OIDC_REQUIRE_HTTPS_METADATA is left out or true.

Accounts

• Task item checkbox for The owner has two-factor sign-in on and has saved their recovery codes. Nobody else can reset the owner, so losing both locks the owner out. See Two-factor and recovery codes.

  The owner has two-factor sign-in on and has saved their recovery codes. Nobody else can reset the owner, so losing both locks the owner out. See Two-factor and recovery codes.

• Task item checkbox for Every administrator has two-factor on, and Require two-factor for administrators is on (Admin, Security, Kill switches).

  Every administrator has two-factor on, and Require two-factor for administrators is on (Admin, Security, Kill switches).

• Task item checkbox for Each role has only what it needs: review Admin, Roles.

  Each role has only what it needs: review Admin, Roles.

• Task item checkbox for Allow public registration is off, so new accounts need an invite, unless you mean to run an open community.

  Allow public registration is off, so new accounts need an invite, unless you mean to run an open community.

• Task item checkbox for Allow public spaces stays off until you mean to publish a space to people who are not signed in.

  Allow public spaces stays off until you mean to publish a space to people who are not signed in.

Operations

• Task item checkbox for Backups run, a restore has been rehearsed, and there is at least one offsite copy.

  Backups run, a restore has been rehearsed, and there is at least one offsite copy.

• Task item checkbox for The passphrases in .env are kept somewhere other than the server.

  The passphrases in .env are kept somewhere other than the server.

• Task item checkbox for Email works, so alerts reach administrators: Send test email to me succeeds. See Email (SMTP).

  Email works, so alerts reach administrators: Send test email to me succeeds. See Email (SMTP).

• Task item checkbox for Tesria’s log, which carries a copy of the audit log, is sent somewhere durable.

  Tesria’s log, which carries a copy of the audit log, is sent somewhere durable.

• Task item checkbox for scripts/verify-audit-chain.sh runs on a schedule and someone watches its result. See Health checks and monitoring.

  scripts/verify-audit-chain.sh runs on a schedule and someone watches its result. See Health checks and monitoring.

• Task item checkbox for Someone watches for new releases and upgrades promptly. See Upgrading.

  Someone watches for new releases and upgrades promptly. See Upgrading.

What Tesria does for you

Once those are done, Tesria covers a good deal by itself: limits on sign-in attempts from one address and lockouts for one account; alerts for patterns such as password spraying or mass deletion; a blocklist for addresses; strict browser security headers; attachments that cannot run scripts as the site; webhooks that cannot reach the server’s own network; and an audit log the running application cannot alter. The Security section explains each, and what it does not cover.