9. Security hardening of the server

What to lock down on the Lawliet server before real data goes in, and what to keep checking afterwards. Work through 9.1 and use the sections after it for the detail.

9.1 Checklist#

9.2 Network ports#

Inbound to the Lawliet server#

If the installer moved a port because the default was taken, use the port it printed (sudo ./lawliet status shows the console URL).

Never reachable from outside the server: PostgreSQL, Redis and ClickHouse are not published to the host. In HTTPS mode the backend and the console are reachable only through nginx, and nginx serves /docs, /redoc, /openapi.json and /metrics only to loopback and private address ranges.

Nothing connects to an agent. No inbound rule is needed on any monitored host.

Outbound from the Lawliet server#

None is needed for the platform to run. Each row is used only when an operator configures the feature.

Licensing never needs any outbound connection.

Agents#

9.3 The host firewall#

Enforce the inbound rules on a network firewall in front of the server. On the server itself, a host firewall such as ufw is useful for everything else, but Docker publishes container ports through its own iptables rules, which bypass ufw on many distributions. Do not rely on ufw alone for 443, 80, 5514, 3000 or 8000.

Example for the host's own services (SSH from the admin network only):

sudo ufw default deny incoming
sudo ufw allow from <admin-network> to any port 22 proto tcp
sudo ufw enable

9.4 Shell access to the server#

Root on the server, and membership of the docker group (which is equivalent to root), can:

• read every secret in .env and every backup;
• run ./lawliet passwd and take over the administrator account;
• install a licence, build an offline agent package with an enrolment code, change the certificate or turn encryption off - all without console four-eyes.

So:

1. Give shell access only to the people who would hold the Super administrator account.
2. Use personal accounts with sudo; no shared root password; SSH keys, not passwords.
3. Do not add operator accounts to the docker group.
4. Log sudo use to your central log collection.
5. Review the audit trail for CLI actions that are recorded there: doctor_fix, offline agent packages made through the CLI, and TLS changes (who ran them and when, as the host saw it).

9.5 Files that hold secrets#

lawliet-support-*.txt and lawliet-diag-*.tar.gz are redacted, but still describe your deployment: send them only to support and delete them afterwards.

9.6 Console accounts and four-eyes#

1. One named account per person. No shared accounts.
2. Two-factor for everyone. Keep REQUIRE_TWO_FACTOR=true (the default).
3. A second approver on day one (Installation 2.9, step 5).
4. Seal the install account. With an LSO and an RSO in place, store the Super administrator's password and recovery codes offline for recovery only.
5. Least privilege. Analysts as Analyst, read-only staff as Viewer or Auditor. Use per-user denials rather than broad roles.
6. Dual control on. Settings > Access control: Dual control is on ticked, Super administrators act alone unticked, a reason required.
7. Review bypasses. In Settings > Audit trail, look for dual_control_bypassed events. After the first day there should be none with reason no_second_approver.
8. API keys. Create them only for integrations that need them, with the narrowest scope, and revoke unused ones (Settings > API keys).
9. Disable accounts of leavers the same day (Settings > Users).

Procedures: Users, roles and approvals.

9.7 TLS#

• Use a certificate from your CA, naming every address in use. Browsers then do not warn and agents need no certificate file.
• Keep TLS on. If it was ever turned off, tls on offers to sign everyone out, revoke API keys used while off and rotate the enrolment secret: answer yes.
• Reinstall every agent still on plain HTTP.
• Watch the expiry: the console's Certificate card and the notification bell warn at 30 and 7 days; sudo ./lawliet doctor warns at 30.

nginx serves TLS 1.2 and 1.3 only and sends HSTS while TLS is on.

9.8 Settings to keep#

The installer writes these. Do not change them on a production server.

After editing .env, apply with sudo ./lawliet start (a restart does not re-read it).

Retention of collected data#

Set them to what your regulations require, and watch disk use.

9.9 Keep it healthy#

Monitor /health and /health/ready from your monitoring system (Doctor, diag and support 7.4).

Syslog sources#

Syslog carries no authentication. Restrict every syslog log source to the networks of its senders (its allowed networks setting), and open 5514 only from those networks.