git.squeep.com Git - akkoma/blob - docs/configuration/hardening.md

   1 # Hardening your instance
   2 Here are some suggestions which improve the security of parts of your Pleroma instance.
   3
   4 ## Configuration file
   5
   6 These changes should go into `prod.secret.exs` or `dev.secret.exs`, depending on your `MIX_ENV` value.
   7
   8 ### `http`
   9
  10 > Recommended value: `[ip: {127, 0, 0, 1}]`
  11
  12 This sets the Pleroma application server to only listen to the localhost interface. This way, you can only reach your server over the Internet by going through the reverse proxy. By default, Pleroma listens on all interfaces.
  13
  14 ### `secure_cookie_flag`
  15
  16 > Recommended value: `true`
  17
  18 This sets the `secure` flag on Pleroma’s session cookie. This makes sure, that the cookie is only accepted over encrypted HTTPs connections. This implicitly renames the cookie from `pleroma_key` to `__Host-pleroma-key` which enforces some restrictions. (see [cookie prefixes](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#Cookie_prefixes))
  19
  20 ### `:http_security`
  21
  22 > Recommended value: `true`
  23
  24 This will send additional HTTP security headers to the clients, including:
  25
  26 * `X-XSS-Protection: "1; mode=block"`
  27 * `X-Permitted-Cross-Domain-Policies: "none"`
  28 * `X-Frame-Options: "DENY"`
  29 * `X-Content-Type-Options: "nosniff"`
  30 * `X-Download-Options: "noopen"`
  31
  32 A content security policy (CSP) will also be set:
  33
  34 ```csp
  35 content-security-policy:
  36   default-src 'none';
  37   base-uri 'self';
  38   frame-ancestors 'none';
  39   img-src 'self' data: blob: https:;
  40   media-src 'self' https:;
  41   style-src 'self' 'unsafe-inline';
  42   font-src 'self';
  43   script-src 'self';
  44   connect-src 'self' wss://example.tld;
  45   manifest-src 'self';
  46   upgrade-insecure-requests;
  47 ```
  48
  49 #### `sts`
  50
  51 > Recommended value: `true`
  52
  53 An additional “Strict transport security” header will be sent with the configured `sts_max_age` parameter. This tells the browser, that the domain should only be accessed over a secure HTTPs connection.
  54
  55 #### `ct_max_age`
  56
  57 An additional “Expect-CT” header will be sent with the configured `ct_max_age` parameter. This enforces the use of TLS certificates that are published in the certificate transparency log. (see [Expect-CT](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT))
  58
  59 #### `referrer_policy`
  60
  61 > Recommended value: `same-origin`
  62
  63 If you click on a link, your browser’s request to the other site will include from where it is coming from. The “Referrer policy” header tells the browser how and if it should send this information. (see [Referrer policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy))
  64
  65 ## systemd
  66
  67 A systemd unit example is provided at `installation/pleroma.service`.
  68
  69 ### PrivateTmp
  70
  71 > Recommended value: `true`
  72
  73 Use private `/tmp` and `/var/tmp` folders inside a new file system namespace, which are discarded after the process stops.
  74
  75 ### ProtectHome
  76
  77 > Recommended value: `true`
  78
  79 The `/home`, `/root`, and `/run/user` folders can not be accessed by this service anymore. If your Pleroma user has its home folder in one of the restricted places, or use one of these folders as its working directory, you have to set this to `false`.
  80
  81 ### ProtectSystem
  82
  83 > Recommended value: `full`
  84
  85 Mount `/usr`, `/boot`, and `/etc` as read-only for processes invoked by this service.
  86
  87 ### PrivateDevices
  88
  89 > Recommended value: `true`
  90
  91 Sets up a new `/dev` mount for the process and only adds API pseudo devices like `/dev/null`, `/dev/zero` or `/dev/random` but not physical devices. This may not work on devices like the Raspberry Pi, where you need to set this to `false`.
  92
  93 ### NoNewPrivileges
  94
  95 > Recommended value: `true`
  96
  97 Ensures that the service process and all its children can never gain new privileges through `execve()`.
  98
  99 ### CapabilityBoundingSet
 100
 101 > Recommended value: `~CAP_SYS_ADMIN`
 102
 103 Drops the sysadmin capability from the daemon.