mirror of
https://github.com/acedanger/shell.git
synced 2025-12-06 00:00:13 -08:00
feat: Add comprehensive Plex recovery validation script
- Introduced `validate-plex-recovery.sh` for validating Plex database recovery. - Implemented checks for service status, database integrity, web interface accessibility, API functionality, and recent logs. - Added detailed recovery summary and next steps for users. fix: Improve Debian patching script for compatibility - Enhanced `debian-patches.sh` to securely download and execute bootstrap scripts. - Updated package mapping logic and ensured proper permissions for patched files. fix: Update Docker test scripts for better permission handling - Modified `run-docker-tests.sh` to set appropriate permissions on logs directory. - Ensured log files have correct permissions after test runs. fix: Enhance setup scripts for secure installations - Updated `setup.sh` to securely download and execute installation scripts for zoxide and nvm. - Improved error handling for failed downloads. fix: Refine startup script for log directory permissions - Adjusted `startup.sh` to set proper permissions for log directories and files. chore: Revamp update-containers.sh for better error handling and logging - Rewrote `update-containers.sh` to include detailed logging and error handling. - Added validation for Docker image names and improved overall script robustness.
This commit is contained in:
Peter Wood
376
SECURITY-REMEDIATION-PLAN.md
Normal file
376
SECURITY-REMEDIATION-PLAN.md
Normal file
@@ -0,0 +1,376 @@
|
||||
# Security Remediation Plan
|
||||
|
||||
**Priority:** HIGH
|
||||
**Target Completion:** Next 30 days
|
||||
**Responsible:** Development Team
|
||||
|
||||
## Overview
|
||||
|
||||
This document outlines the prioritized remediation plan for security issues identified in the comprehensive security review conducted on $(date '+%Y-%m-%d').
|
||||
|
||||
## Status Summary
|
||||
|
||||
| Priority | Issue Count | Status |
|
||||
|----------|-------------|---------|
|
||||
| CRITICAL | 1 | ✅ RESOLVED |
|
||||
| HIGH | 3 | 🔄 IN PROGRESS |
|
||||
| MEDIUM | 5 | 📋 PLANNED |
|
||||
| LOW | 2 | 📋 BACKLOG |
|
||||
|
||||
## Priority 1: High-Risk Issues (Complete within 7 days)
|
||||
|
||||
### 1.1 Remote Code Execution via curl | bash
|
||||
|
||||
**Risk Level:** HIGH
|
||||
**Impact:** Arbitrary code execution
|
||||
**Effort:** 2-4 hours
|
||||
|
||||
**Files to Fix:**
|
||||
|
||||
- `/home/acedanger/shell/setup/debian-patches.sh` (Line 176)
|
||||
- `/home/acedanger/shell/setup/setup.sh` (Lines 552, 564)
|
||||
|
||||
**Remediation Steps:**
|
||||
|
||||
1. **For debian-patches.sh:**
|
||||
|
||||
```bash
|
||||
# Replace line 176:
|
||||
# curl -s https://raw.githubusercontent.com/acedanger/shell/main/bootstrap.sh | bash
|
||||
|
||||
# With secure download and execution:
|
||||
TEMP_BOOTSTRAP=$(mktemp)
|
||||
if curl -s https://raw.githubusercontent.com/acedanger/shell/main/bootstrap.sh -o "$TEMP_BOOTSTRAP"; then
|
||||
# Optional: verify checksum if available
|
||||
bash "$TEMP_BOOTSTRAP"
|
||||
rm -f "$TEMP_BOOTSTRAP"
|
||||
else
|
||||
echo "Failed to download bootstrap script"
|
||||
exit 1
|
||||
fi
|
||||
```
|
||||
|
||||
2. **For setup.sh (zoxide installation):**
|
||||
|
||||
```bash
|
||||
# Replace line 552:
|
||||
# curl -sS https://raw.githubusercontent.com/ajeetdsouza/zoxide/main/install.sh | bash
|
||||
|
||||
# With secure installation:
|
||||
TEMP_ZOXIDE=$(mktemp)
|
||||
if curl -sS https://raw.githubusercontent.com/ajeetdsouza/zoxide/main/install.sh -o "$TEMP_ZOXIDE"; then
|
||||
# Optional: verify known good checksum
|
||||
bash "$TEMP_ZOXIDE"
|
||||
rm -f "$TEMP_ZOXIDE"
|
||||
else
|
||||
echo "Failed to download zoxide installer"
|
||||
exit 1
|
||||
fi
|
||||
```
|
||||
|
||||
3. **For setup.sh (nvm installation):**
|
||||
|
||||
```bash
|
||||
# Replace line 564:
|
||||
# curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh | bash
|
||||
|
||||
# With secure installation:
|
||||
TEMP_NVM=$(mktemp)
|
||||
if curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.5/install.sh -o "$TEMP_NVM"; then
|
||||
# Optional: verify checksum against known good hash
|
||||
bash "$TEMP_NVM"
|
||||
rm -f "$TEMP_NVM"
|
||||
else
|
||||
echo "Failed to download nvm installer"
|
||||
exit 1
|
||||
fi
|
||||
```
|
||||
|
||||
**Testing Requirements:**
|
||||
|
||||
- Test installation processes in isolated environment
|
||||
- Verify all dependent functionality continues to work
|
||||
- Run security scan to confirm fix
|
||||
|
||||
**Acceptance Criteria:**
|
||||
|
||||
- [ ] No direct piping of remote content to bash
|
||||
- [ ] Downloaded scripts verified before execution
|
||||
- [ ] Proper error handling implemented
|
||||
- [ ] Security test passes
|
||||
|
||||
## Priority 2: Medium-Risk Issues (Complete within 14 days)
|
||||
|
||||
### 2.1 Excessive Privilege Usage
|
||||
|
||||
**Risk Level:** MEDIUM-HIGH
|
||||
**Impact:** Privilege escalation, security boundary violations
|
||||
**Effort:** 4-6 hours
|
||||
|
||||
**Files to Review:**
|
||||
|
||||
- `/home/acedanger/shell/setup/startup.sh` (Lines 45, 46, 65, 66)
|
||||
- Various Plex scripts with extensive sudo usage
|
||||
|
||||
**Remediation Steps:**
|
||||
|
||||
1. **startup.sh permissions fix:**
|
||||
|
||||
```bash
|
||||
# Replace chmod 777 with appropriate permissions
|
||||
# Line 46: sudo chmod -R 777 /logs
|
||||
sudo chmod -R 755 /logs
|
||||
|
||||
# Line 65: sudo chmod -R 777 /logs
|
||||
sudo chmod -R 755 /logs
|
||||
|
||||
# Ensure log files are 644
|
||||
find /logs -type f -exec sudo chmod 644 {} \;
|
||||
```
|
||||
|
||||
2. **Plex scripts sudo optimization:**
|
||||
- Identify minimum required sudo operations
|
||||
- Group sudo operations to reduce frequency
|
||||
- Use service-specific users where possible
|
||||
- Document privilege requirements
|
||||
|
||||
**Testing Requirements:**
|
||||
|
||||
- Verify all functionality with reduced privileges
|
||||
- Test in restricted environment
|
||||
- Confirm no privilege escalation vulnerabilities
|
||||
|
||||
**Acceptance Criteria:**
|
||||
|
||||
- [ ] No usage of 777 permissions
|
||||
- [ ] Minimal sudo usage documented
|
||||
- [ ] Service-specific users implemented where possible
|
||||
- [ ] Privilege requirements documented
|
||||
|
||||
### 2.2 Input Validation Enhancement
|
||||
|
||||
**Risk Level:** MEDIUM
|
||||
**Impact:** Path traversal, injection attacks
|
||||
**Effort:** 3-4 hours per script
|
||||
|
||||
**Scripts Requiring Enhanced Validation:**
|
||||
|
||||
- Docker deployment scripts
|
||||
- User-facing setup scripts
|
||||
- File operation utilities
|
||||
|
||||
**Remediation Steps:**
|
||||
|
||||
1. **Implement input validation functions:**
|
||||
|
||||
```bash
|
||||
# Add to common utilities or each script
|
||||
validate_path() {
|
||||
local path="$1"
|
||||
# Check for path traversal attempts
|
||||
if [[ "$path" =~ \.\./|^/etc|^/usr/bin|^/bin ]]; then
|
||||
echo "ERROR: Invalid path detected: $path"
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
validate_docker_image() {
|
||||
local image="$1"
|
||||
if [[ ! "$image" =~ ^[a-zA-Z0-9._/-]+:[a-zA-Z0-9._-]+$ ]]; then
|
||||
echo "ERROR: Invalid Docker image format: $image"
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
```
|
||||
|
||||
2. **Apply validation to all user inputs**
|
||||
3. **Add bounds checking for numerical inputs**
|
||||
4. **Sanitize file paths consistently**
|
||||
|
||||
## Priority 3: Maintenance and Monitoring (Complete within 30 days)
|
||||
|
||||
### 3.1 Automated Security Scanning
|
||||
|
||||
**Effort:** 2-3 hours setup + ongoing maintenance
|
||||
|
||||
**Implementation Steps:**
|
||||
|
||||
1. **Add ShellCheck to CI/CD:**
|
||||
|
||||
```yaml
|
||||
# .github/workflows/security.yml
|
||||
name: Security Scan
|
||||
on: [push, pull_request]
|
||||
jobs:
|
||||
shellcheck:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: Run ShellCheck
|
||||
uses: ludeeus/action-shellcheck@master
|
||||
with:
|
||||
severity: warning
|
||||
```
|
||||
|
||||
2. **Weekly security script:**
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
# weekly-security-scan.sh
|
||||
find . -name "*.sh" -exec shellcheck {} \;
|
||||
# Additional security tools as needed
|
||||
```
|
||||
|
||||
**Acceptance Criteria:**
|
||||
|
||||
- [ ] Automated ShellCheck on all commits
|
||||
- [ ] Weekly security scan implemented
|
||||
- [ ] Security issues tracked and resolved
|
||||
- [ ] Documentation updated
|
||||
|
||||
### 3.2 Security Documentation
|
||||
|
||||
**Effort:** 4-6 hours
|
||||
|
||||
**Deliverables:**
|
||||
|
||||
- [ ] Security standards document
|
||||
- [ ] Incident response procedures
|
||||
- [ ] Security training materials
|
||||
- [ ] Regular review schedule
|
||||
|
||||
## Priority 4: Long-term Improvements (Complete within 60 days)
|
||||
|
||||
### 4.1 Security Architecture Review
|
||||
|
||||
**Scope:** Overall security architecture and practices
|
||||
**Effort:** 8-12 hours
|
||||
|
||||
**Activities:**
|
||||
|
||||
- Review all inter-script dependencies
|
||||
- Analyze privilege requirements across the stack
|
||||
- Design secure defaults and configurations
|
||||
- Implement defense-in-depth strategies
|
||||
|
||||
### 4.2 Security Testing Framework
|
||||
|
||||
**Scope:** Automated security testing
|
||||
**Effort:** 12-16 hours
|
||||
|
||||
**Deliverables:**
|
||||
|
||||
- Automated vulnerability scanning
|
||||
- Penetration testing procedures
|
||||
- Security regression testing
|
||||
- Performance impact assessment
|
||||
|
||||
## Implementation Timeline
|
||||
|
||||
### Week 1 (Priority 1)
|
||||
|
||||
- [ ] Day 1-2: Fix curl | bash patterns in setup scripts
|
||||
- [ ] Day 3-4: Test and validate fixes
|
||||
- [ ] Day 5: Security review and documentation update
|
||||
|
||||
### Week 2 (Priority 2)
|
||||
|
||||
- [ ] Day 1-3: Address excessive privilege usage
|
||||
- [ ] Day 4-5: Implement enhanced input validation
|
||||
- [ ] Weekend: Testing and validation
|
||||
|
||||
### Week 3-4 (Priority 3)
|
||||
|
||||
- [ ] Week 3: Implement automated security scanning
|
||||
- [ ] Week 4: Complete security documentation
|
||||
|
||||
### Week 5-8 (Priority 4)
|
||||
|
||||
- [ ] Ongoing: Security architecture review
|
||||
- [ ] Ongoing: Security testing framework development
|
||||
|
||||
## Resource Requirements
|
||||
|
||||
### Development Time
|
||||
|
||||
- **Priority 1:** 8-12 hours total
|
||||
- **Priority 2:** 16-20 hours total
|
||||
- **Priority 3:** 12-16 hours total
|
||||
- **Priority 4:** 20-28 hours total
|
||||
|
||||
### Skills Required
|
||||
|
||||
- Shell scripting expertise
|
||||
- Security best practices knowledge
|
||||
- CI/CD pipeline configuration
|
||||
- System administration
|
||||
|
||||
### Tools Needed
|
||||
|
||||
- ShellCheck
|
||||
- Git hooks for security scanning
|
||||
- Testing environments (Docker)
|
||||
- Security scanning tools
|
||||
|
||||
## Success Metrics
|
||||
|
||||
### Security Improvements
|
||||
|
||||
- [ ] 0 critical vulnerabilities
|
||||
- [ ] <5 high-risk issues
|
||||
- [ ] 100% of scripts pass security checks
|
||||
- [ ] All curl | bash patterns eliminated
|
||||
|
||||
### Process Improvements
|
||||
|
||||
- [ ] Automated security scanning implemented
|
||||
- [ ] Security review process established
|
||||
- [ ] Documentation complete and up-to-date
|
||||
- [ ] Team trained on security practices
|
||||
|
||||
### Compliance Measures
|
||||
|
||||
- [ ] Security checklist adopted
|
||||
- [ ] Regular security reviews scheduled
|
||||
- [ ] Incident response procedures tested
|
||||
- [ ] Security metrics tracked and reported
|
||||
|
||||
## Risk Management
|
||||
|
||||
### Implementation Risks
|
||||
|
||||
- **Functionality Impact:** Thorough testing required for all changes
|
||||
- **Timeline Pressure:** Prioritize critical fixes, defer non-critical items if needed
|
||||
- **Resource Availability:** Ensure dedicated time for security work
|
||||
|
||||
### Mitigation Strategies
|
||||
|
||||
- Implement changes in isolated branches
|
||||
- Require peer review for all security changes
|
||||
- Maintain rollback procedures for all modifications
|
||||
- Test in staging environment before production deployment
|
||||
|
||||
## Communication Plan
|
||||
|
||||
### Stakeholder Updates
|
||||
|
||||
- **Weekly:** Progress updates to development team
|
||||
- **Bi-weekly:** Status reports to management
|
||||
- **Monthly:** Security metrics and trend analysis
|
||||
|
||||
### Escalation Procedures
|
||||
|
||||
- **Blocked Issues:** Escalate within 24 hours
|
||||
- **New Critical Findings:** Immediate escalation
|
||||
- **Timeline Risks:** Weekly assessment and communication
|
||||
|
||||
---
|
||||
|
||||
**Document Owner:** Security Team
|
||||
**Last Updated:** $(date '+%Y-%m-%d')
|
||||
**Next Review:** $(date -d '+30 days' '+%Y-%m-%d')
|
||||
|
||||
**Approval Required:** Development Team Lead, Security Officer
|
||||
**Change Control:** All modifications to this plan require documented approval
|
||||
Reference in New Issue
Block a user