> For the complete documentation index, see [llms.txt](https://kth-expeca.gitbook.io/testbedconfig/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kth-expeca.gitbook.io/testbedconfig/prepare/security.md).

# Security

## Management router

### Configure SSH server

Disable SSH access with password. Instead operators can ssh into the testbed only if their public keys are registered.

Having logged in, run the following commands to switch off password access:

```bash
configure
set service ssh disable-password-authentication
commit
save
exit
```

To add SSH public keys, the key must be saved in a file first, then be loaded.

```bash
vi /tmp/my_pubkey
configure
loadkey <user> /tmp/my_pubkey
commit
save
exit
```

### Bring up the firewall

Follow the instructions [here](https://help.ui.com/hc/en-us/articles/204962154-EdgeRouter-How-to-Create-a-WAN-Firewall-Rule) to establish a basic set of firewall rules: `WAN_IN` and `WAN_LOCAL`

```bash
configure

set firewall name WAN_IN default-action drop
set firewall name WAN_IN description 'WAN to internal'
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 description 'Allow established/related'
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable
set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 description 'Drop invalid state'
set firewall name WAN_IN rule 20 state invalid enable

set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'WAN to router'
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 description 'Allow established/related'
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 description 'Drop invalid state'
set firewall name WAN_LOCAL rule 20 state invalid enable

set interfaces ethernet eth3 firewall in name WAN_IN
set interfaces ethernet eth3 firewall local name WAN_LOCAL

commit ; save
```

Then, we open only SSH port on the firewall.

Use the GUI to add a new rule to the WAN\_LOCAL chain. It already has:

* Rule 1 - allow established and related
* Rule 2 - drop invalid.

So add Rule 3 -

* On the Basic pane: Enable, Action accept, Protocol tcp
* On the Advanced pane: State new
* On the Destination pane: Port 22

Check out the [source](https://community.ui.com/questions/How-to-allow-SSH-access-to-WAN-on-ER-X-And-nothing-else-/d6073898-8b28-4926-996b-efd11936c617).

## Controller node

### Configure SSH server

Limit SSH access only to the management network and make sure public key authentication is disabled.

```bash
sudo vim /etc/ssh/sshd_config
...
ListenAddress 10.10.2.1
...
```

### Bring up the firewall

Check `ufw`'s status

```bash
sudo ufw status
```

Apply the default policy firewall

```bash
sudo ufw default allow outgoing
sudo ufw default deny incoming
```

Make sure the directive `IPV6=yes` do exists in `/etc/default/ufw` file. For instance:

```bash
cat /etc/default/ufw
```

Open and limit SSH TCP port 22 connections, HTTP, and HTTPS

```bash
sudo ufw allow ssh
sudo ufw limit ssh
sudo ufw allow http
sudo ufw allow https
```

Turn on firewall

```bash
sudo ufw enable
```

Check it is up

```bash
sudo systemctl status ufw.service
```