📻 ECTLogger

View on GitHub

Security Policy

Overview

The ECT Net Logger application implements comprehensive security measures to protect against common vulnerabilities and ensure safe operation in production environments.

Security Features

1. Input Validation & Sanitization

Pydantic Schema Validation

Field-Specific Protections:

XSS Protection:

SQL Injection Prevention:

2. Authentication & Authorization

JWT Token Security:

OAuth2 Integration:

Magic Link Email:

Role-Based Access Control (RBAC):

WebSocket Authentication:

3. Rate Limiting

SlowAPI Integration:

Apply Custom Limits:

from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)

@router.post("/sensitive-endpoint")
@limiter.limit("10/minute")  # More restrictive for sensitive ops
async def sensitive_operation():
    pass

4. Security Headers

HTTP Security Headers:

5. Database Security

Connection Security:

Data Protection:

Query Safety:

6. CORS Configuration

Controlled Origin Access:

Production Configuration:

FRONTEND_URL=https://your-domain.com

7. Email Security

SMTP with TLS:

Template Sanitization:

8. Fail2Ban Integration (Optional)

ECTLogger supports optional Fail2Ban integration for automatic IP banning after repeated failed login attempts.

Features:

Quick Setup:

# During installation, select "Yes" when prompted for Fail2Ban setup
# Or manually set up later:
sudo cp fail2ban/filter.d/ectlogger.conf /etc/fail2ban/filter.d/
sudo cp fail2ban/jail.d/ectlogger.conf /etc/fail2ban/jail.d/
sudo systemctl restart fail2ban

Admin Commands:

# Check jail status
sudo fail2ban-client status ectlogger

# Manually unban an IP
sudo fail2ban-client set ectlogger unbanip 192.168.1.100

For complete Fail2Ban setup instructions, see FAIL2BAN.md.

Vulnerability Reporting

If you discover a security vulnerability, please report it to:

  1. DO NOT create a public GitHub issue
  2. Email: [security contact email - to be configured]
  3. Include:
    • Description of vulnerability
    • Steps to reproduce
    • Potential impact
    • Suggested fix (if any)

Security Best Practices for Deployment

Environment Variables

# Generate strong secret key
SECRET_KEY=$(openssl rand -hex 32)

# Use strong database passwords
DATABASE_URL=postgresql://user:STRONG_PASSWORD@localhost/ectlogger

# Configure email with app-specific password
SMTP_PASSWORD=app_specific_password_not_main_password

HTTPS Configuration (nginx example)

server {
    listen 443 ssl http2;
    server_name your-domain.com;
    
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    
    location / {
        proxy_pass http://localhost:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    
    location /ws/ {
        proxy_pass http://localhost:8000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Database Security

# Use connection pooling limits
DATABASE_URL=postgresql://user:pass@localhost/db?pool_size=20&max_overflow=10

# Enable SSL for PostgreSQL connections
DATABASE_URL=postgresql://user:pass@localhost/db?sslmode=require

# Restrict database user permissions
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO ectlogger_user;

Firewall Configuration

# Allow only necessary ports
ufw allow 22/tcp   # SSH
ufw allow 80/tcp   # HTTP (redirect to HTTPS)
ufw allow 443/tcp  # HTTPS
ufw enable

# Block all other incoming by default
ufw default deny incoming
ufw default allow outgoing

Regular Updates

# Keep dependencies updated
pip install --upgrade -r requirements.txt
npm update

# Monitor for security advisories
pip-audit
npm audit

Security Checklist for Production

Known Limitations

  1. WebSocket Token Passing: Token sent as query parameter (visible in logs). Consider upgrading to header-based authentication or initial message authentication.

  2. Rate Limiting Scope: Current rate limiting is per-IP. Consider adding per-user rate limits for authenticated endpoints.

  3. Session Management: JWT tokens valid until expiration. No token revocation mechanism implemented. Consider adding token blacklist for logout/ban functionality.

  4. Audit Logging: Basic logging implemented. Consider adding comprehensive audit trail for sensitive operations.

Security Testing

Run Security Tests

# Check for known vulnerabilities in dependencies
cd backend
pip install safety
safety check

cd ../frontend
npm audit

# Run OWASP ZAP or similar security scanner
# Test with tools like:
# - Burp Suite
# - OWASP ZAP
# - sqlmap (should find no SQL injection)
# - XSS test payloads (should be sanitized)

Example Test Cases

# Test XSS prevention
payload = "<script>alert('xss')</script>"
# Should be escaped to: &lt;script&gt;alert('xss')&lt;/script&gt;

# Test SQL injection prevention
payload = "'; DROP TABLE users; --"
# Should be safely handled by ORM

# Test path traversal
payload = "../../etc/passwd"
# Should be rejected by validation

# Test oversized input
payload = "A" * 10000  # Should be rejected (max length exceeded)

Compliance Notes

This application implements security controls aligned with:

For compliance with specific regulations (GDPR, HIPAA, etc.), additional controls may be required.

License

Security features are part of the ECT Net Logger project licensed under MIT License. See LICENSE file for details.