vh/NetAlertX
1
0
Fork 0
mirror of https://github.com/jokob-sk/NetAlertX.git synced 2025-12-06 17:15:38 -08:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity
Files
37010818889a7e1cd957e5beb7e75d2fa225665f
NetAlertX/SECURITY_FEATURES/index.html

4301 lines
71 KiB
HTML
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

<!doctype html>
<html lang="en" class="no-js">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="description" content="The main documentation resource for NetAlertX - a network scanner and presence detector">
<link rel="canonical" href="https://jokob-sk.github.io/NetAlertX/SECURITY_FEATURES/">
<link rel="prev" href="../BACKUPS/">
<link rel="next" href="../SECURITY/">
<link rel="icon" href="../img/netalertx_docs.png">
<meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.0">
<title>Security Features - NetAlertX Docs</title>
<link rel="stylesheet" href="../assets/stylesheets/main.618322db.min.css">
<link rel="stylesheet" href="../assets/stylesheets/palette.ab4e12ef.min.css">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback">
<style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style>
<script>__md_scope=new URL("..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script>
<!-- Google Tag Manager -->
<!-- Google tag (gtag.js) -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-KCRSGLP8J2"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'G-KCRSGLP8J2');
</script>
<!-- End Google Tag Manager -->
</head>
<body dir="ltr" data-md-color-scheme="slate" data-md-color-primary="indigo" data-md-color-accent="deep-purple">
<input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
<input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
<label class="md-overlay" for="__drawer"></label>
<div data-md-component="skip">
<a href="#netalertx-security-a-layered-defense" class="md-skip">
Skip to content
</a>
</div>
<div data-md-component="announce">
</div>
<!-- Google Tag Manager (noscript) -->
<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-KCRSGLP8J2"
height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
<!-- End Google Tag Manager (noscript) -->
<header class="md-header" data-md-component="header">
<nav class="md-header__inner md-grid" aria-label="Header">
<a href=".." title="NetAlertX Docs" class="md-header__button md-logo" aria-label="NetAlertX Docs" data-md-component="logo">
<img src="../img/netalertx_docs.png" alt="logo">
</a>
<label class="md-header__button md-icon" for="__drawer">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg>
</label>
<div class="md-header__title" data-md-component="header-title">
<div class="md-header__ellipsis">
<div class="md-header__topic">
<span class="md-ellipsis">
NetAlertX Docs
</span>
</div>
<div class="md-header__topic" data-md-component="header-topic">
<span class="md-ellipsis">
Security Features
</span>
</div>
</div>
</div>
<form class="md-header__option" data-md-component="palette">
<input class="md-option" data-md-color-media="" data-md-color-scheme="slate" data-md-color-primary="indigo" data-md-color-accent="deep-purple" aria-label="Switch to light mode" type="radio" name="__palette" id="__palette_0">
<label class="md-header__button md-icon" title="Switch to light mode" for="__palette_1" hidden>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 2a7 7 0 0 0-7 7c0 2.38 1.19 4.47 3 5.74V17a1 1 0 0 0 1 1h6a1 1 0 0 0 1-1v-2.26c1.81-1.27 3-3.36 3-5.74a7 7 0 0 0-7-7M9 21a1 1 0 0 0 1 1h4a1 1 0 0 0 1-1v-1H9z"/></svg>
</label>
<input class="md-option" data-md-color-media="" data-md-color-scheme="default" data-md-color-primary="black" data-md-color-accent="deep-purple" aria-label="Switch to dark mode" type="radio" name="__palette" id="__palette_1">
<label class="md-header__button md-icon" title="Switch to dark mode" for="__palette_0" hidden>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 2a7 7 0 0 1 7 7c0 2.38-1.19 4.47-3 5.74V17a1 1 0 0 1-1 1H9a1 1 0 0 1-1-1v-2.26C6.19 13.47 5 11.38 5 9a7 7 0 0 1 7-7M9 21v-1h6v1a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1m3-17a5 5 0 0 0-5 5c0 2.05 1.23 3.81 3 4.58V16h4v-2.42c1.77-.77 3-2.53 3-4.58a5 5 0 0 0-5-5"/></svg>
</label>
</form>
<script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script>
<label class="md-header__button md-icon" for="__search">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg>
</label>
<div class="md-search" data-md-component="search" role="dialog">
<label class="md-search__overlay" for="__search"></label>
<div class="md-search__inner" role="search">
<form class="md-search__form" name="search">
<input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" required>
<label class="md-search__icon md-icon" for="__search">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg>
</label>
<nav class="md-search__options" aria-label="Search">
<a href="javascript:void(0)" class="md-search__icon md-icon" title="Share" aria-label="Share" data-clipboard data-clipboard-text="" data-md-component="search-share" tabindex="-1">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M18 16.08c-.76 0-1.44.3-1.96.77L8.91 12.7c.05-.23.09-.46.09-.7s-.04-.47-.09-.7l7.05-4.11c.54.5 1.25.81 2.04.81a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3c0 .24.04.47.09.7L8.04 9.81C7.5 9.31 6.79 9 6 9a3 3 0 0 0-3 3 3 3 0 0 0 3 3c.79 0 1.5-.31 2.04-.81l7.12 4.15c-.05.21-.08.43-.08.66 0 1.61 1.31 2.91 2.92 2.91s2.92-1.3 2.92-2.91A2.92 2.92 0 0 0 18 16.08"/></svg>
</a>
<button type="reset" class="md-search__icon md-icon" title="Clear" aria-label="Clear" tabindex="-1">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg>
</button>
</nav>
<div class="md-search__suggest" data-md-component="search-suggest"></div>
</form>
<div class="md-search__output">
<div class="md-search__scrollwrap" tabindex="0" data-md-scrollfix>
<div class="md-search-result" data-md-component="search-result">
<div class="md-search-result__meta">
Initializing search
</div>
<ol class="md-search-result__list" role="presentation"></ol>
</div>
</div>
</div>
</div>
</div>
<div class="md-header__source">
<a href="https://github.com/jokob-sk/NetAlertX/" title="Go to repository" class="md-source" data-md-component="source">
<div class="md-source__icon md-icon">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!--! Font Awesome Free 7.1.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2025 Fonticons, Inc.--><path d="M439.6 236.1 244 40.5c-5.4-5.5-12.8-8.5-20.4-8.5s-15 3-20.4 8.4L162.5 81l51.5 51.5c27.1-9.1 52.7 16.8 43.4 43.7l49.7 49.7c34.2-11.8 61.2 31 35.5 56.7-26.5 26.5-70.2-2.9-56-37.3L240.3 199v121.9c25.3 12.5 22.3 41.8 9.1 55-6.4 6.4-15.2 10.1-24.3 10.1s-17.8-3.6-24.3-10.1c-17.6-17.6-11.1-46.9 11.2-56v-123c-20.8-8.5-24.6-30.7-18.6-45L142.6 101 8.5 235.1C3 240.6 0 247.9 0 255.5s3 15 8.5 20.4l195.6 195.7c5.4 5.4 12.7 8.4 20.4 8.4s15-3 20.4-8.4l194.7-194.7c5.4-5.4 8.4-12.8 8.4-20.4s-3-15-8.4-20.4"/></svg>
</div>
<div class="md-source__repository">
GitHub
</div>
</a>
</div>
</nav>
</header>
<div class="md-container" data-md-component="container">
<nav class="md-tabs" aria-label="Tabs" data-md-component="tabs">
<div class="md-grid">
<ul class="md-tabs__list">
<li class="md-tabs__item">
<a href=".." class="md-tabs__link">
Home
</a>
</li>
<li class="md-tabs__item">
<a href="../INSTALLATION/" class="md-tabs__link">
Installation
</a>
</li>
<li class="md-tabs__item md-tabs__item--active">
<a href="../SUBNETS/" class="md-tabs__link">
Setup
</a>
</li>
<li class="md-tabs__item">
<a href="../DEVICE_MANAGEMENT/" class="md-tabs__link">
Device guides
</a>
</li>
<li class="md-tabs__item">
<a href="../DEBUG_TIPS/" class="md-tabs__link">
Troubleshooting
</a>
</li>
<li class="md-tabs__item">
<a href="../DEV_ENV_SETUP/" class="md-tabs__link">
Development
</a>
</li>
</ul>
</div>
</nav>
<main class="md-main" data-md-component="main">
<div class="md-main__inner md-grid">
<div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
<div class="md-sidebar__scrollwrap">
<div class="md-sidebar__inner">
<nav class="md-nav md-nav--primary md-nav--lifted" aria-label="Navigation" data-md-level="0">
<label class="md-nav__title" for="__drawer">
<a href=".." title="NetAlertX Docs" class="md-nav__button md-logo" aria-label="NetAlertX Docs" data-md-component="logo">
<img src="../img/netalertx_docs.png" alt="logo">
</a>
NetAlertX Docs
</label>
<div class="md-nav__source">
<a href="https://github.com/jokob-sk/NetAlertX/" title="Go to repository" class="md-source" data-md-component="source">
<div class="md-source__icon md-icon">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!--! Font Awesome Free 7.1.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2025 Fonticons, Inc.--><path d="M439.6 236.1 244 40.5c-5.4-5.5-12.8-8.5-20.4-8.5s-15 3-20.4 8.4L162.5 81l51.5 51.5c27.1-9.1 52.7 16.8 43.4 43.7l49.7 49.7c34.2-11.8 61.2 31 35.5 56.7-26.5 26.5-70.2-2.9-56-37.3L240.3 199v121.9c25.3 12.5 22.3 41.8 9.1 55-6.4 6.4-15.2 10.1-24.3 10.1s-17.8-3.6-24.3-10.1c-17.6-17.6-11.1-46.9 11.2-56v-123c-20.8-8.5-24.6-30.7-18.6-45L142.6 101 8.5 235.1C3 240.6 0 247.9 0 255.5s3 15 8.5 20.4l195.6 195.7c5.4 5.4 12.7 8.4 20.4 8.4s15-3 20.4-8.4l194.7-194.7c5.4-5.4 8.4-12.8 8.4-20.4s-3-15-8.4-20.4"/></svg>
</div>
<div class="md-source__repository">
GitHub
</div>
</a>
</div>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href=".." class="md-nav__link">
<span class="md-ellipsis">
Home
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2" >
<label class="md-nav__link" for="__nav_2" id="__nav_2_label" tabindex="0">
<span class="md-ellipsis">
Installation
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_2_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_2">
<span class="md-nav__icon md-icon"></span>
Installation
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../INSTALLATION/" class="md-nav__link">
<span class="md-ellipsis">
Installation options
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../INITIAL_SETUP/" class="md-nav__link">
<span class="md-ellipsis">
Quick setup
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2_3" >
<label class="md-nav__link" for="__nav_2_3" id="__nav_2_3_label" tabindex="0">
<span class="md-ellipsis">
Docker
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_3_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_2_3">
<span class="md-nav__icon md-icon"></span>
Docker
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../DOCKER_INSTALLATION/" class="md-nav__link">
<span class="md-ellipsis">
Docker Guide
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../DOCKER_COMPOSE/" class="md-nav__link">
<span class="md-ellipsis">
Docker Compose
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../FILE_PERMISSIONS/" class="md-nav__link">
<span class="md-ellipsis">
Docker File Permissions
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../UPDATES/" class="md-nav__link">
<span class="md-ellipsis">
Docker Updates
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../DOCKER_MAINTENANCE/" class="md-nav__link">
<span class="md-ellipsis">
Docker Maintenance
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2_4" >
<label class="md-nav__link" for="__nav_2_4" id="__nav_2_4_label" tabindex="0">
<span class="md-ellipsis">
Other
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_4_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_2_4">
<span class="md-nav__icon md-icon"></span>
Other
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../SYNOLOGY_GUIDE/" class="md-nav__link">
<span class="md-ellipsis">
Synology Guide
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../DOCKER_PORTAINER/" class="md-nav__link">
<span class="md-ellipsis">
Portainer Stacks
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../COMMUNITY_GUIDES/" class="md-nav__link">
<span class="md-ellipsis">
Community Guides
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../HW_INSTALL/" class="md-nav__link">
<span class="md-ellipsis">
Bare-metal (Experimental)
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../MIGRATION/" class="md-nav__link">
<span class="md-ellipsis">
Migration Guide
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2_5" >
<label class="md-nav__link" for="__nav_2_5" id="__nav_2_5_label" tabindex="0">
<span class="md-ellipsis">
Help
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_5_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_2_5">
<span class="md-nav__icon md-icon"></span>
Help
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../COMMON_ISSUES/" class="md-nav__link">
<span class="md-ellipsis">
Common issues
</span>
</a>
</li>
</ul>
</nav>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3" checked>
<label class="md-nav__link" for="__nav_3" id="__nav_3_label" tabindex="">
<span class="md-ellipsis">
Setup
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_3_label" aria-expanded="true">
<label class="md-nav__title" for="__nav_3">
<span class="md-nav__icon md-icon"></span>
Setup
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item md-nav__item--active md-nav__item--section md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3_1" checked>
<label class="md-nav__link" for="__nav_3_1" id="__nav_3_1_label" tabindex="">
<span class="md-ellipsis">
Getting started
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_1_label" aria-expanded="true">
<label class="md-nav__title" for="__nav_3_1">
<span class="md-nav__icon md-icon"></span>
Getting started
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../SUBNETS/" class="md-nav__link">
<span class="md-ellipsis">
Subnets
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../PLUGINS/" class="md-nav__link">
<span class="md-ellipsis">
Enable Plugins
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../PIHOLE_GUIDE/" class="md-nav__link">
<span class="md-ellipsis">
Pi-hole Guide
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../HOME_ASSISTANT/" class="md-nav__link">
<span class="md-ellipsis">
Home Assistant
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../SMTP/" class="md-nav__link">
<span class="md-ellipsis">
Emails
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../BACKUPS/" class="md-nav__link">
<span class="md-ellipsis">
Backups
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--active">
<input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
<label class="md-nav__link md-nav__link--active" for="__toc">
<span class="md-ellipsis">
Security Features
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<a href="./" class="md-nav__link md-nav__link--active">
<span class="md-ellipsis">
Security Features
</span>
</a>
<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
<label class="md-nav__title" for="__toc">
<span class="md-nav__icon md-icon"></span>
Table of contents
</label>
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
<li class="md-nav__item">
<a href="#feature-1-the-digital-concrete-filesystem" class="md-nav__link">
<span class="md-ellipsis">
Feature 1: The "Digital Concrete" Filesystem
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#feature-2-surgical-keycard-only-access" class="md-nav__link">
<span class="md-ellipsis">
Feature 2: Surgical, "Keycard-Only" Access
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#feature-3-attack-surface-amputation" class="md-nav__link">
<span class="md-ellipsis">
Feature 3: Attack Surface "Amputation"
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#feature-4-self-cleaning-writable-areas" class="md-nav__link">
<span class="md-ellipsis">
Feature 4: "Self-Cleaning" Writable Areas
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#feature-5-built-in-resource-guardrails" class="md-nav__link">
<span class="md-ellipsis">
Feature 5: Built-in Resource Guardrails
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#feature-6-the-pre-flight-self-check" class="md-nav__link">
<span class="md-ellipsis">
Feature 6: The "Pre-Flight" Self-Check
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#conclusion-security-by-default" class="md-nav__link">
<span class="md-ellipsis">
Conclusion: Security by Default
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="../SECURITY/" class="md-nav__link">
<span class="md-ellipsis">
Security Considerations
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--section md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3_2" >
<label class="md-nav__link" for="__nav_3_2" id="__nav_3_2_label" tabindex="">
<span class="md-ellipsis">
Advanced guides
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_2_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_3_2">
<span class="md-nav__icon md-icon"></span>
Advanced guides
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../REMOTE_NETWORKS/" class="md-nav__link">
<span class="md-ellipsis">
Remote Networks
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../NOTIFICATIONS/" class="md-nav__link">
<span class="md-ellipsis">
Notifications Guide
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../NAME_RESOLUTION/" class="md-nav__link">
<span class="md-ellipsis">
Name Resolution
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../AUTHELIA/" class="md-nav__link">
<span class="md-ellipsis">
Authelia
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../PERFORMANCE/" class="md-nav__link">
<span class="md-ellipsis">
Performance
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../REVERSE_DNS/" class="md-nav__link">
<span class="md-ellipsis">
Reverse DNS
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../REVERSE_PROXY/" class="md-nav__link">
<span class="md-ellipsis">
Reverse Proxy
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../WEBHOOK_N8N/" class="md-nav__link">
<span class="md-ellipsis">
Webhooks (n8n)
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../WORKFLOWS/" class="md-nav__link">
<span class="md-ellipsis">
Workflows
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../WORKFLOW_EXAMPLES/" class="md-nav__link">
<span class="md-ellipsis">
Workflow Examples
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../DOCKER_SWARM/" class="md-nav__link">
<span class="md-ellipsis">
Docker Swarm
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--section md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3_3" >
<label class="md-nav__link" for="__nav_3_3" id="__nav_3_3_label" tabindex="">
<span class="md-ellipsis">
Help
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_3_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_3_3">
<span class="md-nav__icon md-icon"></span>
Help
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../COMMON_ISSUES/" class="md-nav__link">
<span class="md-ellipsis">
Common issues
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../RANDOM_MAC/" class="md-nav__link">
<span class="md-ellipsis">
Random MAC
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../FIX_OFFLINE_DETECTION/" class="md-nav__link">
<span class="md-ellipsis">
Incorrect Offline Detection
</span>
</a>
</li>
</ul>
</nav>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4" >
<label class="md-nav__link" for="__nav_4" id="__nav_4_label" tabindex="0">
<span class="md-ellipsis">
Device guides
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_4_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_4">
<span class="md-nav__icon md-icon"></span>
Device guides
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4_1" >
<label class="md-nav__link" for="__nav_4_1" id="__nav_4_1_label" tabindex="0">
<span class="md-ellipsis">
Editing Devices
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_4_1_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_4_1">
<span class="md-nav__icon md-icon"></span>
Editing Devices
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../DEVICE_MANAGEMENT/" class="md-nav__link">
<span class="md-ellipsis">
Management
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../DEVICES_BULK_EDITING/" class="md-nav__link">
<span class="md-ellipsis">
Bulk Editing
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../CUSTOM_PROPERTIES/" class="md-nav__link">
<span class="md-ellipsis">
Custom Properties
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../DEVICE_DISPLAY_SETTINGS/" class="md-nav__link">
<span class="md-ellipsis">
Device Display Settings
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../SESSION_INFO/" class="md-nav__link">
<span class="md-ellipsis">
Session Info
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4_2" >
<label class="md-nav__link" for="__nav_4_2" id="__nav_4_2_label" tabindex="0">
<span class="md-ellipsis">
Icons and Topology
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_4_2_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_4_2">
<span class="md-nav__icon md-icon"></span>
Icons and Topology
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../ICONS/" class="md-nav__link">
<span class="md-ellipsis">
Icons
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../NETWORK_TREE/" class="md-nav__link">
<span class="md-ellipsis">
Network Topology
</span>
</a>
</li>
</ul>
</nav>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5" >
<label class="md-nav__link" for="__nav_5" id="__nav_5_label" tabindex="0">
<span class="md-ellipsis">
Troubleshooting
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_5">
<span class="md-nav__icon md-icon"></span>
Troubleshooting
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../DEBUG_TIPS/" class="md-nav__link">
<span class="md-ellipsis">
General Tips
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../COMMON_ISSUES/" class="md-nav__link">
<span class="md-ellipsis">
Common issues
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../LOGGING/" class="md-nav__link">
<span class="md-ellipsis">
Inspecting Logs
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../DEBUG_API_SERVER/" class="md-nav__link">
<span class="md-ellipsis">
API Server Issues
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../DEBUG_INVALID_JSON/" class="md-nav__link">
<span class="md-ellipsis">
Invalid JSON Issues
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../DEBUG_PHP/" class="md-nav__link">
<span class="md-ellipsis">
PHP Issues
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../DEBUG_PLUGINS/" class="md-nav__link">
<span class="md-ellipsis">
Plugin Issues
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../WEB_UI_PORT_DEBUG/" class="md-nav__link">
<span class="md-ellipsis">
Web UI Port Issues
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../WORKFLOWS_DEBUGGING/" class="md-nav__link">
<span class="md-ellipsis">
Workflows Issues
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6" >
<label class="md-nav__link" for="__nav_6" id="__nav_6_label" tabindex="0">
<span class="md-ellipsis">
Development
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_6">
<span class="md-nav__icon md-icon"></span>
Development
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6_1" >
<label class="md-nav__link" for="__nav_6_1" id="__nav_6_1_label" tabindex="0">
<span class="md-ellipsis">
Plugin and app development
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_6_1_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_6_1">
<span class="md-nav__icon md-icon"></span>
Plugin and app development
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../DEV_ENV_SETUP/" class="md-nav__link">
<span class="md-ellipsis">
Environment Setup
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../BUILDS/" class="md-nav__link">
<span class="md-ellipsis">
Builds
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../DEV_DEVCONTAINER/" class="md-nav__link">
<span class="md-ellipsis">
Devcontainer
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../PLUGINS_DEV/" class="md-nav__link">
<span class="md-ellipsis">
Custom Plugins
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../PLUGINS_DEV_CONFIG/" class="md-nav__link">
<span class="md-ellipsis">
Plugin Config
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../FRONTEND_DEVELOPMENT/" class="md-nav__link">
<span class="md-ellipsis">
Frontend Development
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../DATABASE/" class="md-nav__link">
<span class="md-ellipsis">
Database
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../SETTINGS_SYSTEM/" class="md-nav__link">
<span class="md-ellipsis">
Settings
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../VERSIONS/" class="md-nav__link">
<span class="md-ellipsis">
Versions
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../DEVICE_HEURISTICS/" class="md-nav__link">
<span class="md-ellipsis">
Icon and Type guessing
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6_2" >
<label class="md-nav__link" for="__nav_6_2" id="__nav_6_2_label" tabindex="0">
<span class="md-ellipsis">
API
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_6_2_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_6_2">
<span class="md-nav__icon md-icon"></span>
API
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../API/" class="md-nav__link">
<span class="md-ellipsis">
Overview
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../API_DEVICES/" class="md-nav__link">
<span class="md-ellipsis">
Devices Collection
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../API_DEVICE/" class="md-nav__link">
<span class="md-ellipsis">
Device
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../API_SESSIONS/" class="md-nav__link">
<span class="md-ellipsis">
Sessions
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../API_SETTINGS/" class="md-nav__link">
<span class="md-ellipsis">
Settings
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../API_EVENTS/" class="md-nav__link">
<span class="md-ellipsis">
Events
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../API_MESSAGING_IN_APP/" class="md-nav__link">
<span class="md-ellipsis">
Messaging in-app
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../API_METRICS/" class="md-nav__link">
<span class="md-ellipsis">
Metrics
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../API_NETTOOLS/" class="md-nav__link">
<span class="md-ellipsis">
Net Tools
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../API_ONLINEHISTORY/" class="md-nav__link">
<span class="md-ellipsis">
Online History
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../API_SYNC/" class="md-nav__link">
<span class="md-ellipsis">
Sync
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../API_GRAPHQL/" class="md-nav__link">
<span class="md-ellipsis">
GraphQL
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../API_DBQUERY/" class="md-nav__link">
<span class="md-ellipsis">
DB query
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../API_TESTS/" class="md-nav__link">
<span class="md-ellipsis">
Tests
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../API_OLD/" class="md-nav__link">
<span class="md-ellipsis">
SUPERSEDED OLD API Overview
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6_3" >
<label class="md-nav__link" for="__nav_6_3" id="__nav_6_3_label" tabindex="0">
<span class="md-ellipsis">
Integrations
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_6_3_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_6_3">
<span class="md-nav__icon md-icon"></span>
Integrations
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../WEBHOOK_SECRET/" class="md-nav__link">
<span class="md-ellipsis">
Webhook Secret
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../HELPER_SCRIPTS/" class="md-nav__link">
<span class="md-ellipsis">
Helper scripts
</span>
</a>
</li>
</ul>
</nav>
</li>
</ul>
</nav>
</li>
</ul>
</nav>
</div>
</div>
</div>
<div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" >
<div class="md-sidebar__scrollwrap">
<div class="md-sidebar__inner">
<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
<label class="md-nav__title" for="__toc">
<span class="md-nav__icon md-icon"></span>
Table of contents
</label>
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
<li class="md-nav__item">
<a href="#feature-1-the-digital-concrete-filesystem" class="md-nav__link">
<span class="md-ellipsis">
Feature 1: The "Digital Concrete" Filesystem
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#feature-2-surgical-keycard-only-access" class="md-nav__link">
<span class="md-ellipsis">
Feature 2: Surgical, "Keycard-Only" Access
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#feature-3-attack-surface-amputation" class="md-nav__link">
<span class="md-ellipsis">
Feature 3: Attack Surface "Amputation"
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#feature-4-self-cleaning-writable-areas" class="md-nav__link">
<span class="md-ellipsis">
Feature 4: "Self-Cleaning" Writable Areas
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#feature-5-built-in-resource-guardrails" class="md-nav__link">
<span class="md-ellipsis">
Feature 5: Built-in Resource Guardrails
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#feature-6-the-pre-flight-self-check" class="md-nav__link">
<span class="md-ellipsis">
Feature 6: The "Pre-Flight" Self-Check
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#conclusion-security-by-default" class="md-nav__link">
<span class="md-ellipsis">
Conclusion: Security by Default
</span>
</a>
</li>
</ul>
</nav>
</div>
</div>
</div>
<div class="md-content" data-md-component="content">
<article class="md-content__inner md-typeset">
<a href="https://github.com/jokob-sk/NetAlertX/blob/main/docs/SECURITY_FEATURES.md" title="Edit this page" class="md-content__button md-icon" rel="edit">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg>
</a>
<a href="https://github.com/jokob-sk/NetAlertX/raw/main/docs/SECURITY_FEATURES.md" title="View source of this page" class="md-content__button md-icon">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M17 18c.56 0 1 .44 1 1s-.44 1-1 1-1-.44-1-1 .44-1 1-1m0-3c-2.73 0-5.06 1.66-6 4 .94 2.34 3.27 4 6 4s5.06-1.66 6-4c-.94-2.34-3.27-4-6-4m0 6.5a2.5 2.5 0 0 1-2.5-2.5 2.5 2.5 0 0 1 2.5-2.5 2.5 2.5 0 0 1 2.5 2.5 2.5 2.5 0 0 1-2.5 2.5M9.27 20H6V4h7v5h5v4.07c.7.08 1.36.25 2 .49V8l-6-6H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h4.5a8.2 8.2 0 0 1-1.23-2"/></svg>
</a>
<h1 id="netalertx-security-a-layered-defense">NetAlertX Security: A Layered Defense</h1>
<p>Your network security monitor has the "keys to the kingdom," making it a prime target for attackers. If it gets compromised, the game is over.</p>
<p>NetAlertX is engineered from the ground up to prevent this. It's not just an app; it's a purpose-built <strong>security appliance.</strong> Its core design is built on a <strong>zero-trust</strong> philosophy, which is a modern way of saying we <strong>assume a breach will happen</strong> and plan for it. This isn't a single "lock on the door"; it's a <strong>"defense-in-depth"</strong> strategy, more like a medieval castle with a moat, high walls, and guards at every door.</p>
<p>Here’s a breakdown of the defensive layers you get, right out of the box using the default configuration.</p>
<h2 id="feature-1-the-digital-concrete-filesystem">Feature 1: The "Digital Concrete" Filesystem</h2>
<p><strong>Methodology:</strong> The core application and its system files are treated as immutable. Once built, the app's code is "set in concrete," preventing attackers from modifying it or planting malware.</p>
<ul>
<li>
<p><strong>Immutable Filesystem:</strong> At runtime, the container's entire filesystem is set to <code>read_only: true</code>. The application code, system libraries, and all other files are literally frozen. This single control neutralizes a massive range of common attacks.</p>
</li>
<li>
<p><strong>"Ownership-as-a-Lock" Pattern:</strong> During the build, all system files are assigned to a special <code>readonly</code> user. This user has no login shell and no power to write to <em>any</em> files, even its own. It’s a clever, defense-in-depth locking mechanism.</p>
</li>
<li>
<p><strong>Data Segregation:</strong> All user-specific data (like configurations and the device database) is stored completely outside the container in Docker volumes. The application is disposable; the data is persistent.</p>
</li>
</ul>
<p><strong>What's this mean to you:</strong> Even if an attacker gets in, they <strong>cannot modify the application code or plant malware.</strong> It's like the app is set in digital concrete.</p>
<h2 id="feature-2-surgical-keycard-only-access">Feature 2: Surgical, "Keycard-Only" Access</h2>
<p><strong>Methodology:</strong> The principle of least privilege is strictly enforced. Every process gets only the absolute minimum set of permissions needed for its specific job.</p>
<ul>
<li>
<p><strong>Non-Privileged Execution:</strong> The entire NetAlertX stack runs as a dedicated, low-power, non-root user (<code>netalertx</code>). No "god mode" privileges are available to the application.</p>
</li>
<li>
<p><strong>Kernel-Level Capability Revocation:</strong> The container is launched with <code>cap_drop: - ALL</code>, which tells the Linux kernel to revoke <em>all</em> "root-like" special powers.</p>
</li>
<li>
<p><strong>Binary-Specific Privileges (setcap):</strong> This is the "keycard" metaphor in action. After revoking all powers, the system uses <code>setcap</code> to grant specific, necessary permissions <em>only</em> to the binaries that absolutely require them (like <code>nmap</code> and <code>arp-scan</code>). This means that even if an attacker compromises the web server, they can't start scanning the network. The web server's "keycard" doesn't open the "scanning" door.</p>
</li>
</ul>
<p><strong>What's this mean to you:</strong> A security breach is <strong>firewalled.</strong> An attacker who gets into the web UI <strong>does not have the "keycard"</strong> to start scanning your network or take over the system. The breach is contained.</p>
<h2 id="feature-3-attack-surface-amputation">Feature 3: Attack Surface "Amputation"</h2>
<p><strong>Methodology:</strong> The potential attack surface is aggressively minimized by removing every non-essential tool an attacker would want to use.</p>
<ul>
<li>
<p><strong>Package Manager Removal:</strong> The <code>hardened</code> build stage explicitly deletes the Alpine package manager (<code>apk del apk-tools</code>). This makes it impossible for an attacker to simply <code>apk add</code> their malicious toolkit.</p>
</li>
<li>
<p><strong><code>sudo</code> Neutralization:</strong> All <code>sudo</code> configurations are removed, and the <code>/usr/bin/sudo</code> command is replaced with a non-functional shim. Any attempt to escalate privileges this way will fail.</p>
</li>
<li>
<p><strong>Build Toolchain Elimination:</strong> The <code>Dockerfile</code> uses a multi-stage build. The initial "builder" stage, which contains all the powerful compilers (<code>gcc</code>) and development tools, is completely discarded. The final production image is lean and contains no build tools.</p>
</li>
<li>
<p><strong>Minimal User &amp; Group Files:</strong> The <code>hardened</code> stage scrubs the system's <code>passwd</code> and <code>group</code> files, removing all default system users to minimize potential avenues for privilege escalation.</p>
</li>
</ul>
<p><strong>What's this mean to you:</strong> An attacker who breaks in finds themselves in an <strong>empty room with no tools.</strong> They have no <code>sudo</code> to get more power, no package manager to download weapons, and no compilers to build new ones.</p>
<h2 id="feature-4-self-cleaning-writable-areas">Feature 4: "Self-Cleaning" Writable Areas</h2>
<p><strong>Methodology:</strong> All writable locations are treated as untrusted, temporary, and non-executable by default.</p>
<ul>
<li>
<p><strong>In-Memory Volatile Storage:</strong> The <code>docker-compose.yml</code> configuration maps all temporary directories (e.g., <code>/tmp/log</code>, <code>/tmp/api</code>, <code>/tmp</code>) to in-memory <code>tmpfs</code> filesystems. They do not exist on the host's disk.</p>
</li>
<li>
<p><strong>Volatile Data:</strong> Because these locations exist only in RAM, their contents are <strong>instantly and irrevocably erased</strong> when the container is stopped. This provides a "self-cleaning" mechanism that purges any attacker-dropped files or payloads on every single restart.</p>
</li>
<li>
<p><strong>Secure Mount Flags:</strong> These in-memory mounts are configured with the <code>noexec</code> flag. This is a critical security control: it <strong>prohibits the execution of any binary or script</strong> from a location that is writable.</p>
</li>
</ul>
<p><strong>What's this mean to you:</strong> Any malicious file an attacker <em>does</em> manage to drop is <strong>written in invisible, non-permanent ink.</strong> The file is written to RAM, not disk, so it <strong>vaporizes the instant you restart</strong> the container. Even worse for them, the <code>noexec</code> flag means they <strong>can't even run the file</strong> in the first place.</p>
<h2 id="feature-5-built-in-resource-guardrails">Feature 5: Built-in Resource Guardrails</h2>
<p><strong>Methodology:</strong> The container is constrained by resource limits to function as a "good citizen" on the host system. This prevents a compromised or runaway process from consuming excessive resources, a common vector for Denial of Service (DoS) attacks.</p>
<ul>
<li>
<p><strong>Process Limiting:</strong> The <code>docker-compose.yml</code> defines a <code>pids_limit: 512</code>. This directly mitigates "fork bomb" attacks, where a process attempts to crash the host by recursively spawning thousands of new processes.</p>
</li>
<li>
<p><strong>Memory &amp; CPU Limits:</strong> The configuration file defines strict resource limits to prevent any single process from exhausting the host's available system resources.</p>
</li>
</ul>
<p><strong>What's this mean to you:</strong> NetAlertX is a "good neighbor" and <strong>can't be used to crash your host machine.</strong> Even if a process is compromised, it's in a digital straitjacket and <strong>cannot</strong> pull a "denial of service" attack by hogging all your CPU or memory.</p>
<h2 id="feature-6-the-pre-flight-self-check">Feature 6: The "Pre-Flight" Self-Check</h2>
<p><strong>Methodology:</strong> Before any services start, NetAlertX runs a comprehensive "pre-flight" check to ensure its own security and configuration are sound. It's like a built-in auditor who verifies its own defenses.</p>
<ul>
<li>
<p><strong>Active Self-Diagnosis:</strong> On every single boot, NetAlertX runs a series of startup pre-checks—and it's fast. The entire self-check process typically completes in less than a second, letting you get to the web UI in about three seconds from startup.</p>
</li>
<li>
<p><strong>Validates Its Own Security:</strong> These checks actively inspect the other security features. For example, <code>check-0-permissions.sh</code> validates that all the "Digital Concrete" files are locked down and all the "Self-Cleaning" areas are writable, just as they should be. It also checks that the correct <code>netalertx</code> user is running the show, not <code>root</code>.</p>
</li>
<li>
<p><strong>Catches Misconfigurations:</strong> This system acts as a "safety inspector" that catches misconfigurations <em>before</em> they can become security holes. If you've made a mistake in your configuration (like a bad folder permission or incorrect network mode), NetAlertX will tell you in the logs <em>why</em> it can't start, rather than just failing silently.</p>
</li>
</ul>
<p><strong>What's this mean to you:</strong> The system is <strong>self-aware and checks its own work.</strong> You get instant feedback if a setting is wrong, and you get peace of mind on every single boot knowing all these security layers are <strong>active and verified,</strong> all in about one second.</p>
<h2 id="conclusion-security-by-default">Conclusion: Security by Default</h2>
<p>No single security control is a silver bullet. The robust security posture of NetAlertX is achieved through <strong>defense in depth</strong>, layering these methodologies.</p>
<p>An adversary must not only gain initial access but must also find a way to write a payload to a non-executable, in-memory location, without access to any standard system tools, <code>sudo</code>, or a package manager. And they must do this while operating as an unprivileged user in a resource-limited environment where the application code is immutable and <em>actively checks its own integrity on every boot</em>.</p>
</article>
</div>
<script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script>
</div>
<button type="button" class="md-top md-icon" data-md-component="top" hidden>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8z"/></svg>
Back to top
</button>
</main>
<footer class="md-footer">
<nav class="md-footer__inner md-grid" aria-label="Footer" >
<a href="../BACKUPS/" class="md-footer__link md-footer__link--prev" aria-label="Previous: Backups">
<div class="md-footer__button md-icon">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg>
</div>
<div class="md-footer__title">
<span class="md-footer__direction">
Previous
</span>
<div class="md-ellipsis">
Backups
</div>
</div>
</a>
<a href="../SECURITY/" class="md-footer__link md-footer__link--next" aria-label="Next: Security Considerations">
<div class="md-footer__title">
<span class="md-footer__direction">
Next
</span>
<div class="md-ellipsis">
Security Considerations
</div>
</div>
<div class="md-footer__button md-icon">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11z"/></svg>
</div>
</a>
</nav>
<div class="md-footer-meta md-typeset">
<div class="md-footer-meta__inner md-grid">
<div class="md-copyright">
Made with
<a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
Material for MkDocs
</a>
</div>
</div>
</div>
</footer>
</div>
<div class="md-dialog" data-md-component="dialog">
<div class="md-dialog__inner md-typeset"></div>
</div>
<script id="__config" type="application/json">{"annotate": null, "base": "..", "features": ["announce.dismiss", "content.action.edit", "content.action.view", "content.code.annotate", "content.code.copy", "content.tooltips", "navigation.footer", "navigation.indexes", "navigation.sections", "navigation.tabs", "navigation.top", "navigation.tracking", "search.highlight", "search.share", "search.suggest", "toc.follow"], "search": "../assets/javascripts/workers/search.7a47a382.min.js", "tags": null, "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}, "version": null}</script>
<script src="../assets/javascripts/bundle.e71a0d61.min.js"></script>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink