Security
SiroPing is designed for data that must stay on your server — no call-home telemetry. This page covers what SiroPing does, and what you own.
Built-in security
| Layer | What SiroPing does |
|---|---|
| Credential encryption | Login passwords, SMTP passwords, Telegram tokens encrypted at rest (Fernet) |
| Tenant isolation | Data between workspaces fully separated; IDOR blocked |
| RBAC | Owner / Admin / Member per workspace |
| 2FA | TOTP per user (Settings → Two-Factor Authentication) |
| Brute-force protection | Login rate-limit: 5 failed attempts / 15 min per IP+user |
| Audit log | Logins, ACK/resolve, license actions — owner/superuser view at siroping/audit/ |
| Web security | CSRF, XSS-escaped output, secure cookies, X-Frame-Options |
| Headers | HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy |
| TLS | Nginx + Let's Encrypt (certbot), auto-renew |
| Log hygiene | No secrets in logs (webhook tokens redacted) |
What you own (operator)
- OS hardening — updates, UFW (open only 22/80/443), SSH key auth.
- Backups — SiroPing has daily automatic backups; copy them offsite.
- Secrets — rotate the root password, admin password and app keys.
- DNS/HTTPS — keep the certificate valid (auto-renew handles it).
Operational notes
warning
`doctor` reports a **Security** check. A fresh install shows `WARNING` until
`DEBUG=False`, a strong `SECRET_KEY` and `ENCRYPTION_KEY` are set — fix those before going live.
important
The **private signing key** for licenses is never distributed with the software.
A customer install ships only the public key needed to verify licenses.
Recommend baseline
- Install behind HTTPS; set
SESSION_COOKIE_SECURE/CSRF_COOKIE_SECURE/SECURE_SSL_REDIRECT. - Enable 2FA on the first admin immediately.
- Rotate the initial root password; use SSH keys.
- Verify a restore at least once (
backup --verify).