aidevops 2.52.1

package/.agent/aidevops/security.md

@@ -0,0 +1,350 @@
+---
+description: Security best practices for AI DevOps
+mode: subagent
+tools:
+  read: true
+  write: false
+  edit: false
+  bash: false
+  glob: true
+  grep: true
+  webfetch: false
+---
+
+# Security Best Practices
+
+<!-- AI-CONTEXT-START -->
+
+## Quick Reference
+
+**Credential Rules**:
+- NEVER commit API tokens to git
+- Store in `~/.config/aidevops/mcp-env.sh` (600 permissions)
+- Rotate tokens quarterly
+- Use least-privilege principle
+
+**SSH Security**:
+- Use Ed25519 keys: `ssh-keygen -t ed25519`
+- Permissions: 600 (private), 644 (public), 700 (~/.ssh/)
+- Protect with passphrases
+
+**File Permissions**:
+- Config files: 600
+- Scripts: 755
+- SSH keys: 600 (private), 644 (public)
+
+**Script Security**:
+- `scripts/` - Shared, committed (use placeholders for secrets)
+- `scripts-private/` - Local only, gitignored (real credentials OK)
+
+**Incident Response**: Disable creds → Block IPs → Isolate systems → Investigate → Rotate all creds → Patch
+
+**Security Checklist**: MFA on cloud accounts, regular token rotation, audit SSH keys, monitor logs
+<!-- AI-CONTEXT-END -->
+
+This document outlines security best practices for the AI Assistant Server Access Framework.
+
+## 🔐 **Credential Management**
+
+### API Tokens
+
+- **Never commit API tokens to version control**
+- Store tokens in separate configuration files
+- Add config files to `.gitignore`
+- Use environment variables for CI/CD
+- Rotate tokens regularly (quarterly recommended)
+- Use least-privilege principle for API permissions
+
+### SSH Keys
+
+- **Use Ed25519 keys** (modern, secure, fast)
+- Generate unique keys per environment if needed
+- Protect private keys with passphrases
+- Set proper file permissions (600 for private keys, 644 for public keys)
+- Regular key rotation and audit
+
+### Password Files
+
+- Store SSH passwords in separate files (never in scripts)
+- Set restrictive permissions (600)
+- Consider using SSH keys instead of passwords when possible
+
+## 🔑 **SSH Security**
+
+### Key Management Best Practices
+
+```bash
+# Generate secure Ed25519 key
+ssh-keygen -t ed25519 -C "your-email@domain.com"
+
+# Set proper permissions
+chmod 600 ~/.ssh/id_ed25519
+chmod 644 ~/.ssh/id_ed25519.pub
+
+# Add passphrase protection
+ssh-keygen -p -f ~/.ssh/id_ed25519
+```
+
+### SSH Configuration Security
+
+```bash
+# ~/.ssh/config security settings
+Host *
+    # Disable password authentication when keys are available
+    PasswordAuthentication no
+
+    # Use only secure key exchange algorithms
+    KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group16-sha512
+
+    # Use only secure ciphers
+    Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
+
+    # Use only secure MAC algorithms
+    MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
+
+    # Disable X11 forwarding by default
+    ForwardX11 no
+
+    # Connection timeout
+    ConnectTimeout 10
+```
+
+### Server Hardening
+
+- Disable root login where possible
+- Use non-standard SSH ports
+- Implement fail2ban or similar
+- Regular security updates
+- Monitor SSH logs
+
+## 🛡️ **Access Control**
+
+### Principle of Least Privilege
+
+- Grant minimum necessary permissions
+- Use separate API tokens per project/environment
+- Implement role-based access control
+- Regular access reviews and cleanup
+
+### Network Security
+
+- Use VPNs or bastion hosts for sensitive environments
+- Implement IP whitelisting where possible
+- Use private networks for internal communication
+- Monitor network traffic
+
+### Multi-Factor Authentication
+
+- Enable MFA on all cloud provider accounts
+- Use hardware security keys when available
+- Implement time-based OTP for API access
+
+## 📊 **Monitoring and Auditing**
+
+### Access Logging
+
+```bash
+# Enable SSH logging
+# Add to /etc/ssh/sshd_config
+LogLevel VERBOSE
+
+# Monitor SSH access
+tail -f /var/log/auth.log | grep ssh
+```
+
+### API Usage Monitoring
+
+- Monitor API rate limits and usage
+- Set up alerts for unusual activity
+- Regular audit of API token usage
+- Log all API calls in production
+
+### Security Scanning
+
+```bash
+# Regular security scans
+nmap -sS -O target-server
+
+# SSH security audit
+ssh-audit target-server
+
+# SSL/TLS testing
+testssl.sh target-server
+```
+
+## 🚨 **Incident Response**
+
+### Compromise Detection
+
+- Monitor for unauthorized SSH connections
+- Watch for unusual API activity
+- Set up alerts for failed authentication attempts
+- Regular review of server logs
+
+### Response Procedures
+
+1. **Immediate Actions**
+   - Disable compromised credentials
+   - Block suspicious IP addresses
+   - Isolate affected systems
+
+2. **Investigation**
+   - Analyze logs for attack vectors
+   - Identify scope of compromise
+   - Document findings
+
+3. **Recovery**
+   - Rotate all potentially compromised credentials
+   - Update and patch systems
+   - Restore from clean backups if necessary
+
+4. **Prevention**
+   - Implement additional security measures
+   - Update security procedures
+   - Conduct security training
+
+## 🔒 **File Permissions**
+
+### Recommended Permissions
+
+```bash
+# Configuration files
+chmod 600 configs/.*.json
+
+# SSH keys
+chmod 600 ~/.ssh/id_*
+chmod 644 ~/.ssh/id_*.pub
+chmod 600 ~/.ssh/config
+chmod 700 ~/.ssh/
+
+# Password files
+chmod 600 ~/.ssh/*_password
+
+# Scripts
+chmod 755 *.sh
+chmod 755 .agent/scripts/*.sh
+chmod 755 ssh/*.sh
+```
+
+### Git Security
+
+```bash
+# .gitignore for security
+echo "configs/.*.json" >> .gitignore
+echo "*.password" >> .gitignore
+echo ".env" >> .gitignore
+echo "*.key" >> .gitignore
+echo "*.pem" >> .gitignore
+```
+
+## Script Security
+
+### Directory Structure
+
+```text
+.agent/
+├── scripts/              # Shared (committed to Git)
+│   └── [helper].sh       # Use placeholders: YOUR_API_KEY_HERE
+└── scripts-private/      # Private (gitignored, never committed)
+    └── [custom].sh       # Real credentials OK here
+```
+
+### Guidelines
+
+**Shared scripts (`scripts/`):**
+- Use placeholders: `readonly API_TOKEN="YOUR_API_TOKEN_HERE"`
+- Load from secure storage: `api_key=$(.agent/scripts/setup-local-api-keys.sh get service)`
+- Never hardcode actual credentials
+
+**Private scripts (`scripts-private/`):**
+- Safe for real API keys (gitignored)
+- Create from templates in `scripts/`
+- Never share outside secure channels
+
+### Verification
+
+```bash
+# Verify private scripts are gitignored
+git status --ignored | grep scripts-private
+# Should show: .agent/scripts-private/ (ignored)
+```
+
+## 🌐 **Network Security**
+
+### VPN and Bastion Hosts
+
+- Use VPN for accessing production systems
+- Implement bastion hosts for multi-hop access
+- Restrict direct internet access to servers
+
+### Firewall Rules
+
+```bash
+# Basic iptables rules
+iptables -A INPUT -p tcp --dport 22 -s trusted-ip -j ACCEPT
+iptables -A INPUT -p tcp --dport 22 -j DROP
+```
+
+### SSL/TLS
+
+- Use TLS 1.2 or higher for all API communications
+- Implement certificate pinning where possible
+- Regular certificate rotation
+
+## 📋 **Security Checklist**
+
+### Initial Setup
+
+- [ ] Generate secure SSH keys with passphrases
+- [ ] Set proper file permissions on all sensitive files
+- [ ] Configure secure SSH client settings
+- [ ] Add sensitive files to .gitignore
+- [ ] Enable MFA on all cloud accounts
+
+### Regular Maintenance
+
+- [ ] Rotate API tokens quarterly
+- [ ] Audit SSH keys and remove unused ones
+- [ ] Review and update access permissions
+- [ ] Monitor logs for suspicious activity
+- [ ] Update and patch all systems
+
+### Emergency Procedures
+
+- [ ] Document incident response procedures
+- [ ] Test backup and recovery processes
+- [ ] Maintain emergency contact information
+- [ ] Regular security drills and training
+
+## 🔍 **Security Tools**
+
+### Recommended Tools
+
+```bash
+# SSH security audit
+ssh-audit server-ip
+
+# Network scanning
+nmap -sS -sV target
+
+# SSL/TLS testing
+testssl.sh target
+
+# File integrity monitoring
+aide --init
+aide --check
+
+# Log analysis
+fail2ban-client status
+```
+
+### Automation
+
+- Implement automated security scanning
+- Set up log monitoring and alerting
+- Use configuration management for consistent security settings
+- Regular automated backups with encryption
+
+---
+
+**Remember: Security is an ongoing process, not a one-time setup. Regular reviews and updates are essential for maintaining a secure infrastructure.**