From e1146ed4fe9c2951083ae730b293f8da310a736d Mon Sep 17 00:00:00 2001 From: iclaoudezin Date: Wed, 30 Sep 2026 12:43:45 +0000 Subject: [PATCH] Docs: README security defaults and links to the privilege-separation files Co-Authored-By: Claude Sonnet 5.5 --- README.md | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index fa4c7aa..63db79a 100644 --- a/README.md +++ b/README.md @@ -22,6 +22,14 @@ After the first start: sign in, open **PKI Configuration** → **Initialize PKI* No default user is created. Seed the initial admin with `OVPMON_INITIAL_ADMIN_USER` / `OVPMON_INITIAL_ADMIN_PASSWORD` on first start (empty `users` table only), then remove them. Change the username and password and enable 2FA in **Account**. +## Security defaults + +- No built-in account; the username can be changed in **Account** (API `POST /api/auth/change-username`). +- All API routes require a JWT; 2FA-pending tokens are accepted only by `/api/auth/verify-2fa`. +- Server/PKI settings are validated before they reach `server.conf` (ports, networks, routes, DNS, host names, script paths, DN fields); scripts run only from `/etc/openvpn/scripts/`. +- Native deployments: APIs run as user `ovpmon`; a root helper installs the validated `server.conf`, publishes the CRL (`crl_verify`) and controls `openvpn` through `doas` (fixed commands). +- CORS is same-origin only unless `OVPMON_CORS_ORIGINS` is set; TLS on the panel port; brute-force limits on login (Nginx + app, fail2ban jail in the deployment guide). + ## Configuration `config.ini` per component; overridden by `OVPMON_{SECTION}_{KEY}` environment variables. @@ -40,7 +48,7 @@ No default user is created. Seed the initial admin with `OVPMON_INITIAL_ADMIN_US - Index: [DOCS/General/Index.md](DOCS/General/Index.md) - Deployment: [Docker](DOCS/General/Deployment_Docker.md) · [System services](DOCS/General/Deployment_Native.md) · [Nginx](DOCS/General/Nginx_Configuration.md) · [Service management](DOCS/General/Service_Management.md) -- Security model: [Security Architecture](DOCS/General/Security_Architecture.md) +- Security model: [Security Architecture](DOCS/General/Security_Architecture.md) · root helper and doas rules: [`DOCS/General/privilege-separation/`](DOCS/General/privilege-separation/) - APIs: [Monitoring](DOCS/Core_Monitoring/API_Reference.md) · [Profiler](DOCS/Profiler_Management/API_Reference.md) ## Changes and results @@ -50,7 +58,7 @@ No default user is created. Seed the initial admin with `OVPMON_INITIAL_ADMIN_US | 2026-09-30 | Security hardening: path traversal, 2FA token bypass, CORS, log leak, HTTPS, SSH, fail2ban | [Security hardening](DOCS/Changes/2026-09-30_Security_Hardening.md) | | 2026-09-30 | Admin username change (API + UI), no built-in default admin | [Admin username change](DOCS/Changes/2026-09-30_Admin_Username_Change.md) | | 2026-09-30 | Validation of server/PKI settings (config injection into the root-written OpenVPN config) | [Settings validation](DOCS/Changes/2026-09-30_Settings_Validation.md) | -| 2026-09-30 | API services run as an unprivileged user; root helper validates and installs the OpenVPN config | [Privilege separation](DOCS/Changes/2026-09-30_Privilege_Separation.md) | +| 2026-09-30 | API services run as an unprivileged user; root helper validates and installs the OpenVPN config, publishes the CRL | [Privilege separation](DOCS/Changes/2026-09-30_Privilege_Separation.md) (includes CRL publishing for `crl_verify`) | | 2026-09-30 | Route OpenVPN clients through a Hysteria2 tunnel to an exit node | [Egress via Hysteria2](DOCS/Changes/2026-09-30_Egress_via_Hysteria2.md) | ## Notes