Security Audit

Generated 2026-07-20 07:00 EDT · read-only, nothing was changed
I'll load the six audit tool schemas, then run them all read-only.
I'll run all six audit tools now (read-only).
Audit complete — all six checks ran read-only. Nothing was changed. Prioritized report below.

# Security Audit — jvrcode droplet (2026-07-20)

## 🔴 CRITICAL
- **`/var/www/wp/wp-config.php` is world-readable** — WordPress DB credentials exposed to any local user/process. → `chmod 640` (owner + web group only). *(Fixable via `fix_file_permissions`.)*

## 🟠 HIGH
- **6 exposed `.git` directories in web roots** (`jvrcode.com`, `panini-wc2026`, `wp`, `app1`, `threadmarkusa`, `radio`) — leak full source + history (often creds) if served. → Add Nginx `location ~ /\.git { deny all; return 404; }`. *(Fixable via `secure_nginx_dotfiles`.)*
- **Flask dev server on port 5000, public (`0.0.0.0`)** — Werkzeug/dev servers have no auth/TLS and aren't production-hardened. → Bind to `127.0.0.1` behind Nginx, or `ufw deny 5000`.

## 🟡 MEDIUM
- **Node app on port 3400 listening on all interfaces (`*`)** — should sit behind the Nginx TLS proxy, not face the internet directly. → Bind loopback + reverse-proxy; firewall the port.
- **Icecast2 on port 8000, public** — likely intentional (radio stream), but plaintext and internet-facing. → Confirm it's meant to be public; otherwise front with Nginx/TLS.

## 🟢 LOW / informational
- **26 package updates pending (0 security).** → Routine `apt upgrade` at next maintenance window.
- **`jvrcode.com` cert: 31 days left.** Within normal certbot window (renews ~30d out); nothing under the 21-day alert threshold. → Just confirm `certbot.timer` is active.
- **7,308 failed SSH logins** (top: 141.11.250.228 ×530), targeting `admin`/`ubuntu`/`jvrcode`. Already mitigated — fail2ban active, password auth off, key-only. No action needed.
- **`.../certifi/cacert.pem` world-readable** — false positive; it's a public CA bundle, not sensitive.
- **`/var/www/panini-wc2026/.env`** present but not world-readable (0 KB). → Verify it holds no secrets; keep out of any served path.

## Good posture (no action)
- SSH hardened: `PermitRootLogin prohibit-password`, `PasswordAuthentication no`, X11 forwarding off.
- UFW active, fail2ban active.
- Databases (MySQL 3306/33060, Postgres 5432, gunicorn 8001) correctly loopback-only.
- All TLS certs valid, none expiring within 21 days.

**Top 3 to act on:** (1) lock down `wp-config.php`, (2) block `.git` in Nginx, (3) get the port-5000 Flask app off the public interface.

I made no changes. Want me to save this report to a file, or start on any of the fixes? Each remediation uses a guarded tool (backup + validate + rollback) and will prompt for your confirmation before applying.

--- done: Audit complete — all six checks ran read-only. Nothing was changed. Prioritized report below.

# Security Audit — jvrcode droplet (2026-07-20)

## 🔴 CRITICAL
- **`/var/www/wp/wp-config.php` is world-readable** — WordPress DB credentials exposed to any local user/process. → `chmod 640` (owner + web group only). *(Fixable via `fix_file_permissions`.)*

## 🟠 HIGH
- **6 exposed `.git` directories in web roots** (`jvrcode.com`, `panini-wc2026`, `wp`, `app1`, `threadmarkusa`, `radio`) — leak full source + history (often creds) if served. → Add Nginx `location ~ /\.git { deny all; return 404; }`. *(Fixable via `secure_nginx_dotfiles`.)*
- **Flask dev server on port 5000, public (`0.0.0.0`)** — Werkzeug/dev servers have no auth/TLS and aren't production-hardened. → Bind to `127.0.0.1` behind Nginx, or `ufw deny 5000`.

## 🟡 MEDIUM
- **Node app on port 3400 listening on all interfaces (`*`)** — should sit behind the Nginx TLS proxy, not face the internet directly. → Bind loopback + reverse-proxy; firewall the port.
- **Icecast2 on port 8000, public** — likely intentional (radio stream), but plaintext and internet-facing. → Confirm it's meant to be public; otherwise front with Nginx/TLS.

## 🟢 LOW / informational
- **26 package updates pending (0 security).** → Routine `apt upgrade` at next maintenance window.
- **`jvrcode.com` cert: 31 days left.** Within normal certbot window (renews ~30d out); nothing under the 21-day alert threshold. → Just confirm `certbot.timer` is active.
- **7,308 failed SSH logins** (top: 141.11.250.228 ×530), targeting `admin`/`ubuntu`/`jvrcode`. Already mitigated — fail2ban active, password auth off, key-only. No action needed.
- **`.../certifi/cacert.pem` world-readable** — false positive; it's a public CA bundle, not sensitive.
- **`/var/www/panini-wc2026/.env`** present but not world-readable (0 KB). → Verify it holds no secrets; keep out of any served path.

## Good posture (no action)
- SSH hardened: `PermitRootLogin prohibit-password`, `PasswordAuthentication no`, X11 forwarding off.
- UFW active, fail2ban active.
- Databases (MySQL 3306/33060, Postgres 5432, gunicorn 8001) correctly loopback-only.
- All TLS certs valid, none expiring within 21 days.

**Top 3 to act on:** (1) lock down `wp-config.php`, (2) block `.git` in Nginx, (3) get the port-5000 Flask app off the public interface.

I made no changes. Want me to save this report to a file, or start on any of the fixes? Each remediation uses a guarded tool (backup + validate + rollback) and will prompt for your confirmation before applying.