frappe / frappe/agent

frappe ssh authorized_keys removed & UFW

Open
#125 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
125
Forks
147
Avg merge
17h 20m
Merged PRs (30d)
17

Description

It appears there must be a scheduled job on servers to remove the frappe user `authorized_keys` in favour of using the root user for all management via ssh and ansible.

This is not a great security policy in general and is dangerous if people are unaware and install their keys under the frappe user for emergency purposes.

You could install your own user on each server, but in a large deployment this is not feasible.

I also suggest you deploy UFW on every server to match the AWS security group, with a `ufw limit ...` rule for rate limiting ssh and for defence in depth.

```sh
ufw limit OpenSSH
ufw allow “Nginx Full”
ufw allow from 10.1.0.0/16 comment "internal vpc"
ufw allow from 172.17.0.0/16 comment "internal docker"
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Begin by reviewing the server-management path for the frappe user's authorized_keys and the SSH/Ansible setup. Then determine whether UFW deployment belongs in this repository, clarify the intended access policy and rule coverage, and define tests or deployment checks that would demonstrate the policy is applied safely.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
infrastructure, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.