frappe ssh authorized_keys removed & UFW
- Dominant language
- Python
- Stars
- 125
- Forks
- 147
- Avg merge
- 17h 20m
- Merged PRs (30d)
- 17
Description
It appears there must be a scheduled job on servers to remove the frappe user `authorized_keys` in favour of using the root user for all management via ssh and ansible.
This is not a great security policy in general and is dangerous if people are unaware and install their keys under the frappe user for emergency purposes.
You could install your own user on each server, but in a large deployment this is not feasible.
I also suggest you deploy UFW on every server to match the AWS security group, with a `ufw limit ...` rule for rate limiting ssh and for defence in depth.
```sh
ufw limit OpenSSH
ufw allow “Nginx Full”
ufw allow from 10.1.0.0/16 comment "internal vpc"
ufw allow from 172.17.0.0/16 comment "internal docker"
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Begin by reviewing the server-management path for the frappe user's authorized_keys and the SSH/Ansible setup. Then determine whether UFW deployment belongs in this repository, clarify the intended access policy and rule coverage, and define tests or deployment checks that would demonstrate the policy is applied safely.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- infrastructure, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100