Server Tools: Security and Safeguards

Security and safeguards of Server Tools: input validation per type, backups before deletion and what they do not cover, rollbacks, file permissions, audit log, passwords and limits.

Deutsche Version

Back to overview

Security and Safeguards

Server Tools runs as root and changes the system. This page describes what the tool protects and what it does not.

graph LR
    A["Validate input"] --> B["Back up configuration"]
    B --> C["Prompt"]
    C --> D["Apply change"]
    D --> E["Configuration test and reload"]
    E --> F["Audit log"]
    E -->|"Error"| G["Rollback"]

Not every operation goes through all stages. Which ones apply is described on the pages of the respective commands.

Input validation

Every input is checked against a fixed pattern before use. On an error the tool changes nothing.

Type	Rule
Domain	Labels of letters, digits and `-` (1 to 63 characters each), ending only in letters, at least 2. A name such as `localhost` is valid, an IP address is not
Database name	`a-z A-Z 0-9 _ -`, 1 to 64 characters
User name (MySQL)	`a-z A-Z 0-9 _ -`, 1 to 32 characters
Linux user	Lowercase letters, digits, `_`, `-`, starts with a letter or `_`, at most 32 characters. Existing accounts with a UID below 1000 are rejected
Path (DocumentRoot)	Resolved with `realpath` and must be located under an entry of `ST_ALLOWED_DOCROOT_PATHS`. `..` and symlinks are resolved beforehand
Email	`local@host.tld` with common characters
Password	Minimum length `ST_PASSWORD_MIN_LENGTH`
PHP version	7.4, 8.0, 8.1, 8.2, 8.3 or 8.4
Cron schedule	Five fields of digits and `* / , -`
Port	Integer from 1 to 65535
Protocol	`tcp` or `udp`
IP address	IPv4, each octet 0 to 255
URL	`http://` or `https://`, host, optionally port. The part from the first `/` onward is not checked further
SSH key	One line, 40 to 8192 characters, type `ssh-rsa`, `ssh-ed25519`, `ecdsa-sha2-nistp256/384/521` or FIDO (`sk-`)

In addition:

MySQL names are wrapped in backticks and escaped, character set and collation must consist of A-Za-z0-9_.
Cron commands: at most 500 characters, printable, without a line break.
The DNS provider must be on the list of supported providers if the plugin is to be installed.

Backups before deletion

With ST_AUTO_BACKUP=true the tool creates a .tar.gz file (mode 600) in ST_BACKUP_DIR (mode 700) before deleting:

Operation	Backed up	File name
`db delete`	Credential file of the database	`db_<name>_<timestamp>.tar.gz`
`vhost delete`	VHost configuration file	`vhost_<domain>_<timestamp>.tar.gz`

The backup is created before the prompt, even if you cancel afterwards. If it fails, the tool asks Continue without backup?.

Not backed up are the content of a database, the DocumentRoot and the logs of a domain, the -le-ssl.conf, the logrotate file, cron files, SSH keys and certificates. Old backups are not deleted automatically.

Rollbacks

Operation	On error
`db create`	If creating the user fails, the database is dropped again. If granting the privileges fails, database and user remain
Reassign database (menu)	The old user gets its privileges back
`vhost create`	If the reload fails, the site is disabled. Files remain
`vhost php`	The old configuration file is restored and reloaded
www and HTTPS redirect (menu)	The old configuration file is restored
`user create`	The user is deleted, a newly created `.ssh` is removed

For VHost changes, a configuration test runs before the Apache or Nginx reload (apache2ctl configtest or nginx -t). If it fails, no reload happens. Exceptions are the direct systemctl reload apache2 in "Recreate all certificates" in the menu and in the generated ssl-renewal.sh. Both reload without a preceding configuration test.

Files and permissions

File	Mode
Credential files	600 (or 400 via `ST_CREDENTIAL_FILE_PERMISSIONS`)
Audit log	600
Backup directory, dump directory	700
Backups, dumps, exports	600
Config `/etc/server-tools/config`	600 on installation, checked on load
VHost configurations	640 (redirect VHosts 644)
Logrotate files, cron files	644
Installed binary	700

The tool writes files with their modes via a temporary file and renames it afterwards. A symlink as the target is rejected.

When loading the config file it checks owner and permissions, see Configuration. The options file for MySQL produces a warning if its mode is not 600 or 400.

Passwords

Generated passwords come from openssl rand -base64 32, cleaned of =, + and /.
They are only shown on a terminal, not in pipes or scripts.
If you pass a password via --password, it is visible in the process list during the call and ends up in the shell history.
When creating a MySQL user, the password is briefly part of the arguments of the mysql process as part of the SQL statement.
user set-password rejects passwords containing a colon.

Audit log

The tool records creating, deleting and changing with timestamp, executing user and action in ST_AUDIT_LOG, see Firewall, Fail2Ban, logs and status. The log is not rotated or truncated.

Installer protection

uninstall only deletes the library directory if core.sh and install.sh are in it, and removes shortcuts only if they point to its own binary.
install aborts if it runs from the installed copy.

What the tool does not protect

With --yes all prompts are skipped. In particular vhost delete then deletes the directory /var/www/<domain> for VHosts with a DocumentRoot, vhost create overwrites existing VHosts and cron remove deletes every matching file.
Whoever can write the config file executes code as root.
SSH user isolation is based on ACLs, not on chroot, see SSH users.
The tool sets no firewall rule for SSH and checks nothing before firewall changes.