VuongKB/infrastructure/ana-colo-security-issues.md

created, id, keywords, links, modified, summary, tags, title

created	id	keywords	links	modified	summary	tags	title
2026-04-16T00:45:34+00:00	fd7ea587-115c-4dfd-85d6-64a71da67f98	DNS amplification hardcoded secrets plaintext credentials no firewall no health checks no resource limits no monitoring traefik debug portainer outdated rustdesk outdated UTM stale		2026-04-16T00:45:34+00:00	All 23 security and quality issues found during the ana-colo infrastructure survey on 2026-04-15, organized by severity with remediation notes.	infrastructure ana-colo security issues remediation	Ana Colo — Security and Quality Issues

Ana Colo — Security and Quality Issues

Survey date: 2026-04-15 Total findings: 23 (3 critical, 7 medium, 13 low)

---

🔴 Critical

1. DNS exposed to the internet (FortiGate policy 61)

• Policy: wan1 → internal DNS ALLOW ALL
• Risk: DNS amplification attack vector — anyone on the internet can query the internal DNS resolver
• Fix: Restrict DNS source to internal zones and known VPN subnets only

2. Hardcoded secrets in Docker compose files

• Affected files:
  • synapse/compose.yaml — Postgres password
  • seafile/compose.yaml — MySQL root password (also duplicated in .env)
  • gitea/compose.yaml — DB password
• Risk: Secrets committed to git, visible to anyone with compose file access
• Fix: Move all secrets to .env files with 600 permissions; never commit secrets to version control

3. Plaintext secrets in config files

• Affected files:
  • synapse/homeserver.yaml — DB password, registration secret, macaroon key, form secret, appservice tokens
  • mattermost/config.json — SendGrid API key, SMTP password, encryption keys, salts
  • mailrise/mailrise.conf — SendGrid API key, Mattermost webhook tokens
• Risk: Credentials stored in version-controllable files, exposed to anyone with read access
• Fix: Externalize to .env or a secrets manager; add config files to .gitignore

---

🟡 Medium

4. Disabled but present ollama VIP + open policy

• Details: VIP "ollama-in" is disabled (good) but firewall policy 31 still allows :11434 from WAN
• Fix: Remove both the VIP and the policy

5. WebDAV without TLS

• Details: Port 8444 to NAS — raw TCP; NAS may not serve TLS
• Fix: Route through Traefik for TLS termination, or verify NAS is serving TLS

6. No health checks on most services

• Details: 13 of 20 containers have no health checks configured
• Fix: Add healthcheck directives to all compose files

7. No resource limits on any container

• Details: 20 containers sharing 16GB RAM with no memory or CPU limits
• Fix: Add deploy.resources.limits to all compose files

8. No monitoring stack

• Details: No Prometheus, Grafana, Loki, or log aggregation deployed
• Fix: Deploy monitoring (separate task)

9. No backup automation visible

• Details: Restic server exists but no client backup jobs found
• Fix: Define and deploy backup schedules for all critical data

10. FortiGate UTM features stale

• Details: Virus DB: 2018, IPS DB: 2015
• Fix: Update subscriptions or confirm this is intentional

---

🟢 Low

11. Traefik debug logging in production

• Details: --log.level=DEBUG is running in production
• Fix: Set to INFO or WARN

12. Traefik dashboard unprotected on :8380

• Fix: Add basic auth or restrict to internal sources

13. Stale commented-out configs in traefik.yml

• Details: Old Route53 DNS challenge, multiple cert resolvers
• Fix: Clean up

14. Portainer CE 3 years old + agent 2 years old

• Fix: Update images or remove (Dockge is the replacement)

15. RustDesk image 13 months old

• Fix: Update image

16. IT Tools image 13 months old

• Fix: Update image

17. Dockge backup uses untagged custom image (9392b1d81976)

• Fix: Tag the image or document its source

18. Firewall policy named "DELETE"

• Details: Policy 50: internal → mgmt ALLOW ALL
• Fix: Remove or rename

19. Redundant firewall policies

• Details: Policies 1 and 6 both do internal → wan1 ALLOW ALL
• Fix: Consolidate into a single policy

20. wan2 has no IP (DHCP failed/disabled)

• Fix: Configure the interface or disable it

21. Inconsistent restart policies across stacks

• Details: Some use unless-stopped, some have none
• Fix: Standardize to unless-stopped

22. No logging configuration on any container

• Fix: Add logging driver options (max-size, max-file)

23. Several services exposed on direct ports instead of through Traefik

• Affected: SillyTavern :8100, Open WebUI :3100, Dockge :5001, Portainer :9000/:9001, IT Tools :8780, Mailrise :8025
• Note: Some may be intentional (admin tools). Document the reason for each or add Traefik routing.