YunoHost/doc
1
0
Fork 0
mirror of https://github.com/YunoHost/doc.git synced 2024-09-03 20:06:26 +02:00
Code Issues Projects Releases Packages Wiki Activity

Add security.md

Browse source
This commit is contained in:
kload@kload.fr 2014-05-13 16:09:43 +02:00 committed by YunoHost
parent c68bd85719
commit 0486ae244d
1 changed files with 51 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

51
security.md Normal file
View file

@ -0,0 +1,51 @@
# Security
YunoHost has been developed to provide the best security without too much complication. Every protocol used in YunoHost are **encrypted**, only password's hash are stored and by default each user is able to access to his personal directory only.
Two things remain important to note:
* Installing additional apps can **increase significantly** the number of potential security flaws. Do not hesitate to get information about them **before using it**, and try to install only those which will suit your needs.
* The fact that YunoHost is a well-spread software increase chances to face an attack. If a flaw is discovered, it could potentially affect all the YunoHost instances at once. Keep your system **up-to-date** to remain safe.
*If you need some advises, do not hesitate to [ask us](/support).*
## Improve security
If your YunoHost server is used in a critical production environment, or if you want to improve its safety, you may want to follow those good practices.
**Attention :** *Following those instructions requires advanced knowledges in system administration.*
### SSH authentication via key
By default, the SSH authentication uses the administration password. Deactivation this kind of authentication and replacing it by a key mechanism is advised.
**On your client**:
```bash
ssh-keygen
ssh-copy-id -i ~/.ssh/id_rsa.pub <your_yunohost_server>
```
Type your admnistration password and your key will be copied on your server.
**On your server**, edit the SSH configuration file, in order to deactivate the password authentication.
```bash
nano /etc/ssh/sshd_config
# Modify or add the following line
PasswordAuthentication no
```
Save and restart SSH daemon.
### Deactivate YunoHost API
YunoHost administration is accessible through an **HTTP API**, served on the 6787 port by default. It can be used to administrate a lot of things on your server, thus to break many things between malicious hands. The best thing to do, if you know how to use the [command-line interface](/moulinette), is to deactivate the `yunohost-api` service.
```bash
sudo service yunohost-api stop
```