hardening: secrets, localhost binds, and stronger 3proxy auth

3proxy/first-instanse.cfg

@@ -1,8 +1,9 @@
 # regular 3proxy configuration
 fakeresolve
 flush
-auth iponly
+auth strong
-admin -p8161 -a0.0.0.0
+users $/run/secrets/PROXY_USERS
+admin -p8161 -a127.0.0.1
 # strict required by 3proxy-eagle log lines
 log
 logformat " type=%N destination=%n to=%O from=%I"

README.md

@@ -1,5 +1,24 @@
 Welcome to darkproxy...
 
+## Production hardening defaults
+
+The stack now uses safer defaults for production:
+
+* Sensitive passwords are loaded from Docker secrets instead of inline values.
+* Admin/monitoring ports are bound to `127.0.0.1` on the host.
+* 3proxy now requires authentication (`auth strong`).
+
+Before starting in production, set these secret files:
+
+```sh
+printf 'proxyuser:CL:YOUR_STRONG_PROXY_PASSWORD\n' > secrets/3proxy_users.txt
+printf 'YOUR_STRONG_PIHOLE_PASSWORD\n' > secrets/pihole_webpassword.txt
+printf 'YOUR_STRONG_GRAFANA_PASSWORD\n' > secrets/grafana_admin_password.txt
+```
+
+SOCKS clients must now authenticate to 3proxy with credentials from
+`secrets/3proxy_users.txt`.
+
 This container runs the following vontainers in the stack.
 
 3proxy-eagle - Socks5/http proxy

docker-compose.yml

@@ -10,12 +10,14 @@ services:
     volumes:
       - "./3proxy/first-instanse.cfg:/etc/3proxy/first-instanse.cfg"
       - "./3proxy/second-instanse.cfg:/etc/3proxy/second-instanse.cfg"
+    secrets:
+      - PROXY_USERS
     restart: unless-stopped
     sysctls:
       - "net.ipv6.conf.all.disable_ipv6=0"
     ports:
-      - 2000:1080 # socks port
+      - "127.0.0.1:2000:1080" # socks port (localhost only)
-      - 2002:8161 # 3proxy-eagle web page
+      - "127.0.0.1:2002:8161" # 3proxy-eagle web page (localhost only)
     networks:
       darkproxy:
         ipv4_address: 10.5.0.8
@@ -167,7 +169,7 @@ services:
 #      - "67:67/udp"
       # Uncomment the line below if you are using Pi-hole as your NTP server
 #       - "123:123/udp"
-      - "2003:80/tcp" # pihole web port
+      - "127.0.0.1:2003:80/tcp" # pihole web port (localhost only)
     environment:
       # Set the appropriate timezone for your location (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones), e.g:
       TZ: 'America/Detroit'
@@ -178,8 +180,10 @@ services:
       PIHOLE_DNS_: 10.5.0.4
       TEMPERATUREUNIT: f
       WEBTHEME: lcars
-      WEBPASSWORD: darkproxy
+      WEBPASSWORD_FILE: /run/secrets/PIHOLE_WEBPASSWORD
       FTLCONF_dns_upstreams: coredns
+    secrets:
+      - PIHOLE_WEBPASSWORD
     # Volumes store your data between container upgrades
     volumes:
      # For persisting Pi-hole's databases and common configuration file
@@ -278,7 +282,7 @@ services:
     volumes:
       - ./monitor/prometheus.yml:/etc/prometheus/prometheus.yml:ro
     ports:
-      - "9090:9090"
+      - "127.0.0.1:9090:9090"
     networks:
       - darkproxy
 
@@ -286,9 +290,11 @@ services:
     image: grafana/grafana:latest
     container_name: darkgraf
     ports:
-      - "2005:3000"
+      - "127.0.0.1:2005:3000"
     environment:
-      - GF_SECURITY_ADMIN_PASSWORD=secret
+      - GF_SECURITY_ADMIN_PASSWORD__FILE=/run/secrets/GRAFANA_ADMIN_PASSWORD
+    secrets:
+      - GRAFANA_ADMIN_PASSWORD
     volumes:
       - grafana-data:/var/lib/grafana
     networks:
@@ -323,4 +329,10 @@ secrets:
     file: ./secrets/tz.txt
   YGGDRASIL_GENERATE_KEYS:
     file: ./secrets/YGGDRASIL_GENERATE_KEYS.txt
+  PIHOLE_WEBPASSWORD:
+    file: ./secrets/pihole_webpassword.txt
+  GRAFANA_ADMIN_PASSWORD:
+    file: ./secrets/grafana_admin_password.txt
+  PROXY_USERS:
+    file: ./secrets/3proxy_users.txt