protection de l'application contre les attaques numériques
This commit is contained in:
innotex
378
SECURITY_DEPLOYMENT.md
Normal file
378
SECURITY_DEPLOYMENT.md
Normal file
@@ -0,0 +1,378 @@
|
||||
# ==========================================
|
||||
# GUIDE DE DÉPLOIEMENT SÉCURISÉ
|
||||
# InnotexBoard - Production Ready
|
||||
# ==========================================
|
||||
|
||||
## 🔐 CHECKLIST DE SÉCURITÉ AVANT DÉPLOIEMENT
|
||||
|
||||
### 1. SECRETS ET CONFIGURATION
|
||||
|
||||
```bash
|
||||
# Générer un SECRET_KEY fort
|
||||
python3 -c "import secrets; print(secrets.token_urlsafe(64))"
|
||||
|
||||
# Copier et configurer .env
|
||||
cp .env.example .env
|
||||
nano .env
|
||||
|
||||
# Vérifier les permissions
|
||||
chmod 600 .env
|
||||
chown root:root .env
|
||||
```
|
||||
|
||||
**OBLIGATOIRE:**
|
||||
- ✅ Changer SECRET_KEY
|
||||
- ✅ Définir DEBUG=False
|
||||
- ✅ Configurer ALLOWED_ORIGINS avec votre domaine
|
||||
- ✅ Configurer ALLOWED_HOSTS
|
||||
- ✅ Réduire ACCESS_TOKEN_EXPIRE_MINUTES à 60 max
|
||||
|
||||
|
||||
### 2. CERTIFICATS SSL/TLS (Let's Encrypt)
|
||||
|
||||
```bash
|
||||
# Installer Certbot
|
||||
sudo apt update
|
||||
sudo apt install certbot python3-certbot-nginx -y
|
||||
|
||||
# Obtenir un certificat SSL GRATUIT
|
||||
sudo certbot --nginx -d votre-domaine.com -d www.votre-domaine.com
|
||||
|
||||
# Vérifier le renouvellement automatique
|
||||
sudo certbot renew --dry-run
|
||||
|
||||
# Générer des paramètres Diffie-Hellman (prend 5-10 min)
|
||||
sudo openssl dhparam -out /etc/nginx/dhparam.pem 4096
|
||||
```
|
||||
|
||||
|
||||
### 3. FIREWALL (UFW)
|
||||
|
||||
```bash
|
||||
# Installer et activer le firewall
|
||||
sudo apt install ufw -y
|
||||
|
||||
# Politique par défaut: bloquer tout
|
||||
sudo ufw default deny incoming
|
||||
sudo ufw default allow outgoing
|
||||
|
||||
# Autoriser SSH (IMPORTANT: avant d'activer UFW!)
|
||||
sudo ufw allow 22/tcp
|
||||
|
||||
# Autoriser HTTP/HTTPS
|
||||
sudo ufw allow 80/tcp
|
||||
sudo ufw allow 443/tcp
|
||||
|
||||
# Activer le firewall
|
||||
sudo ufw enable
|
||||
|
||||
# Vérifier le statut
|
||||
sudo ufw status verbose
|
||||
```
|
||||
|
||||
|
||||
### 4. FAIL2BAN - Protection contre Brute Force
|
||||
|
||||
```bash
|
||||
# Installer Fail2Ban
|
||||
sudo apt install fail2ban -y
|
||||
|
||||
# Créer une configuration pour InnotexBoard
|
||||
sudo nano /etc/fail2ban/jail.local
|
||||
```
|
||||
|
||||
Contenu de `/etc/fail2ban/jail.local`:
|
||||
```ini
|
||||
[DEFAULT]
|
||||
bantime = 3600
|
||||
findtime = 600
|
||||
maxretry = 5
|
||||
destemail = admin@votre-domaine.com
|
||||
sendername = Fail2Ban
|
||||
|
||||
[sshd]
|
||||
enabled = true
|
||||
port = 22
|
||||
|
||||
[nginx-http-auth]
|
||||
enabled = true
|
||||
port = http,https
|
||||
|
||||
[innotexboard-auth]
|
||||
enabled = true
|
||||
port = http,https
|
||||
filter = innotexboard-auth
|
||||
logpath = /var/log/innotexboard/security.log
|
||||
maxretry = 3
|
||||
bantime = 7200
|
||||
```
|
||||
|
||||
Créer le filtre `/etc/fail2ban/filter.d/innotexboard-auth.conf`:
|
||||
```ini
|
||||
[Definition]
|
||||
failregex = ^.*Failed login for '.*' from <HOST>.*$
|
||||
^.*Failed authentication from <HOST>.*$
|
||||
^.*Rate limit exceeded for .* from <HOST>.*$
|
||||
ignoreregex =
|
||||
```
|
||||
|
||||
```bash
|
||||
# Redémarrer Fail2Ban
|
||||
sudo systemctl restart fail2ban
|
||||
sudo systemctl enable fail2ban
|
||||
|
||||
# Vérifier le statut
|
||||
sudo fail2ban-client status
|
||||
sudo fail2ban-client status innotexboard-auth
|
||||
```
|
||||
|
||||
|
||||
### 5. LOGS DE SÉCURITÉ
|
||||
|
||||
```bash
|
||||
# Créer le répertoire des logs
|
||||
sudo mkdir -p /var/log/innotexboard
|
||||
sudo chown -R $USER:$USER /var/log/innotexboard
|
||||
sudo chmod 750 /var/log/innotexboard
|
||||
|
||||
# Configurer la rotation des logs
|
||||
sudo nano /etc/logrotate.d/innotexboard
|
||||
```
|
||||
|
||||
Contenu de `/etc/logrotate.d/innotexboard`:
|
||||
```
|
||||
/var/log/innotexboard/*.log {
|
||||
daily
|
||||
rotate 90
|
||||
compress
|
||||
delaycompress
|
||||
notifempty
|
||||
create 0640 www-data www-data
|
||||
sharedscripts
|
||||
postrotate
|
||||
systemctl reload nginx > /dev/null 2>&1
|
||||
endscript
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
### 6. NGINX - Configuration Production
|
||||
|
||||
```bash
|
||||
# Copier la configuration SSL
|
||||
sudo cp nginx-ssl.conf /etc/nginx/sites-available/innotexboard
|
||||
|
||||
# IMPORTANT: Éditer le fichier avec votre domaine
|
||||
sudo nano /etc/nginx/sites-available/innotexboard
|
||||
# Remplacer "votre-domaine.com" par votre vrai domaine
|
||||
|
||||
# Activer le site
|
||||
sudo ln -s /etc/nginx/sites-available/innotexboard /etc/nginx/sites-enabled/
|
||||
|
||||
# Désactiver le site par défaut
|
||||
sudo rm /etc/nginx/sites-enabled/default
|
||||
|
||||
# Tester la configuration
|
||||
sudo nginx -t
|
||||
|
||||
# Redémarrer Nginx
|
||||
sudo systemctl restart nginx
|
||||
sudo systemctl enable nginx
|
||||
```
|
||||
|
||||
|
||||
### 7. DOCKER - Sécurisation
|
||||
|
||||
```bash
|
||||
# Limiter l'accès au socket Docker
|
||||
sudo groupadd docker
|
||||
sudo usermod -aG docker $USER
|
||||
sudo chmod 660 /var/run/docker.sock
|
||||
|
||||
# Redémarrer pour appliquer les changements
|
||||
newgrp docker
|
||||
|
||||
# Configuration Docker daemon pour plus de sécurité
|
||||
sudo nano /etc/docker/daemon.json
|
||||
```
|
||||
|
||||
Contenu de `/etc/docker/daemon.json`:
|
||||
```json
|
||||
{
|
||||
"log-driver": "json-file",
|
||||
"log-opts": {
|
||||
"max-size": "10m",
|
||||
"max-file": "3"
|
||||
},
|
||||
"live-restore": true,
|
||||
"userland-proxy": false,
|
||||
"no-new-privileges": true
|
||||
}
|
||||
```
|
||||
|
||||
```bash
|
||||
# Redémarrer Docker
|
||||
sudo systemctl restart docker
|
||||
```
|
||||
|
||||
|
||||
### 8. DÉPLOIEMENT AVEC DOCKER COMPOSE
|
||||
|
||||
```bash
|
||||
# Installer les dépendances Python
|
||||
cd /home/innotex/Documents/Projet/innotexboard/backend
|
||||
pip install -r requirements.txt
|
||||
|
||||
# Builder et démarrer les conteneurs
|
||||
cd /home/innotex/Documents/Projet/innotexboard
|
||||
docker-compose -f docker-compose.yml up -d --build
|
||||
|
||||
# Vérifier les logs
|
||||
docker-compose logs -f
|
||||
|
||||
# Vérifier que tout fonctionne
|
||||
curl -k https://localhost/health
|
||||
```
|
||||
|
||||
|
||||
### 9. MONITORING ET ALERTES
|
||||
|
||||
```bash
|
||||
# Installer des outils de monitoring
|
||||
sudo apt install htop iotop nethogs -y
|
||||
|
||||
# Surveiller les logs en temps réel
|
||||
tail -f /var/log/innotexboard/security.log
|
||||
tail -f /var/log/nginx/innotexboard-access.log
|
||||
tail -f /var/log/nginx/innotexboard-error.log
|
||||
|
||||
# Vérifier les tentatives d'intrusion
|
||||
sudo fail2ban-client status innotexboard-auth
|
||||
```
|
||||
|
||||
|
||||
### 10. BACKUPS AUTOMATIQUES
|
||||
|
||||
```bash
|
||||
# Créer un script de backup
|
||||
sudo nano /usr/local/bin/backup-innotexboard.sh
|
||||
```
|
||||
|
||||
Contenu de `/usr/local/bin/backup-innotexboard.sh`:
|
||||
```bash
|
||||
#!/bin/bash
|
||||
BACKUP_DIR="/var/backups/innotexboard"
|
||||
DATE=$(date +%Y%m%d_%H%M%S)
|
||||
|
||||
mkdir -p $BACKUP_DIR
|
||||
|
||||
# Backup de la configuration
|
||||
tar -czf $BACKUP_DIR/config_$DATE.tar.gz \
|
||||
/home/innotex/Documents/Projet/innotexboard/.env \
|
||||
/home/innotex/Docker \
|
||||
/etc/nginx/sites-available/innotexboard
|
||||
|
||||
# Backup des logs (7 derniers jours)
|
||||
tar -czf $BACKUP_DIR/logs_$DATE.tar.gz \
|
||||
/var/log/innotexboard
|
||||
|
||||
# Nettoyer les backups > 30 jours
|
||||
find $BACKUP_DIR -name "*.tar.gz" -mtime +30 -delete
|
||||
|
||||
echo "Backup completed: $DATE"
|
||||
```
|
||||
|
||||
```bash
|
||||
# Rendre exécutable
|
||||
sudo chmod +x /usr/local/bin/backup-innotexboard.sh
|
||||
|
||||
# Ajouter au crontab (backup quotidien à 2h du matin)
|
||||
sudo crontab -e
|
||||
# Ajouter: 0 2 * * * /usr/local/bin/backup-innotexboard.sh >> /var/log/innotexboard/backup.log 2>&1
|
||||
```
|
||||
|
||||
|
||||
## 🔍 TESTS DE SÉCURITÉ
|
||||
|
||||
### Test SSL/TLS
|
||||
```bash
|
||||
# Tester la configuration SSL (note A+ attendue)
|
||||
# Aller sur: https://www.ssllabs.com/ssltest/
|
||||
```
|
||||
|
||||
### Test des Headers
|
||||
```bash
|
||||
# Vérifier les headers de sécurité
|
||||
curl -I https://votre-domaine.com
|
||||
|
||||
# Devrait contenir:
|
||||
# - Strict-Transport-Security
|
||||
# - X-Frame-Options: DENY
|
||||
# - X-Content-Type-Options: nosniff
|
||||
# - Content-Security-Policy
|
||||
```
|
||||
|
||||
### Test Rate Limiting
|
||||
```bash
|
||||
# Tester la protection brute force (devrait bloquer après 5 tentatives)
|
||||
for i in {1..10}; do
|
||||
curl -X POST https://votre-domaine.com/api/v1/auth/login \
|
||||
-d "username=test&password=wrong" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded"
|
||||
sleep 1
|
||||
done
|
||||
```
|
||||
|
||||
### Scan de Vulnérabilités
|
||||
```bash
|
||||
# Installer OWASP ZAP ou utiliser:
|
||||
sudo apt install nikto -y
|
||||
nikto -h https://votre-domaine.com
|
||||
```
|
||||
|
||||
|
||||
## 🚨 MAINTENANCE
|
||||
|
||||
### Mise à jour régulière
|
||||
```bash
|
||||
# Tous les mois
|
||||
sudo apt update && sudo apt upgrade -y
|
||||
sudo certbot renew
|
||||
docker-compose pull
|
||||
docker-compose up -d --build
|
||||
|
||||
# Vérifier les logs après chaque mise à jour
|
||||
docker-compose logs -f
|
||||
```
|
||||
|
||||
### Surveiller les tentatives d'intrusion
|
||||
```bash
|
||||
# Voir les IPs bannies
|
||||
sudo fail2ban-client status innotexboard-auth
|
||||
|
||||
# Débannir une IP
|
||||
sudo fail2ban-client set innotexboard-auth unbanip IP_ADDRESS
|
||||
```
|
||||
|
||||
|
||||
## 📞 EN CAS DE PROBLÈME
|
||||
|
||||
1. Vérifier les logs: `/var/log/innotexboard/security.log`
|
||||
2. Vérifier Nginx: `sudo nginx -t`
|
||||
3. Vérifier Docker: `docker-compose ps`
|
||||
4. Vérifier le firewall: `sudo ufw status`
|
||||
5. Vérifier Fail2Ban: `sudo systemctl status fail2ban`
|
||||
|
||||
|
||||
## ✅ CHECKLIST FINALE
|
||||
|
||||
- [ ] SECRET_KEY changé en production
|
||||
- [ ] DEBUG=False
|
||||
- [ ] Certificat SSL installé et fonctionnel
|
||||
- [ ] Firewall UFW activé
|
||||
- [ ] Fail2Ban configuré et actif
|
||||
- [ ] Logs configurés et rotationnels
|
||||
- [ ] Backups automatiques configurés
|
||||
- [ ] Tests de sécurité passés (SSL Labs, headers, rate limiting)
|
||||
- [ ] Monitoring en place
|
||||
- [ ] Documentation d'incident préparée
|
||||
Reference in New Issue
Block a user