docs: add Hardening-Cacti-Installation guide by somethingwithproof · Pull Request #224 · Cacti/documentation

somethingwithproof · 2026-04-03T02:36:06Z

Summary

Adds Hardening-Cacti-Installation.md covering OS-level hardening controls
Integrates into the Cacti Installation nav section in README.md (item 8)
Adds a See Also cross-reference in Standards-Security.md

What the guide covers

File permission matrix (writable: rra/, log/, cache/; read-only: scripts/, resource/, lib/)
Web server access restrictions — Apache <DirectoryMatch> and Nginx location snippets that block direct HTTP access to scripts/ and resource/; motivated by the package-import advisory where a crafted archive wrote resource/test.php and reached it over the web
PHP-FPM pool hardening: clear_env, security.limit_extensions, php_admin_value[disable_functions], expose_php; note on open_basedir trade-offs (disables realpath cache)
SELinux for RHEL/AlmaLinux/Rocky: semanage fcontext with httpd_sys_content_t vs httpd_sys_rw_content_t, httpd_can_network_connect_db boolean, systemd drop-in
AppArmor for Debian/Ubuntu: profile template with explicit deny on scripts/ and resource/ writes, AppArmorProfile= systemd drop-in, complain-before-enforce workflow
Verification checklist

Test plan

Verify markdown renders without broken links
Confirm README.md navigation entry resolves to the new file
Confirm Standards-Security.md See Also link resolves correctly

Copilot

Pull request overview

Adds a new OS-level hardening guide to the documentation set and links it from the existing security standards and installation navigation, alongside introducing baseline repo automation configs (CodeQL + Dependabot).

Changes:

Added Hardening-Cacti-Installation.md with guidance on permissions, web server restrictions, PHP-FPM, SELinux, AppArmor, and verification steps.
Linked the new guide from README.md (Cacti Installation section) and from Standards-Security.md via a new “See Also”.
Added .github/workflows/codeql.yml and .github/dependabot.yml.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
Standards-Security.md	Adds a “See Also” link to the new hardening guide.
README.md	Adds the hardening guide to the installation navigation list.
Hardening-Cacti-Installation.md	New hardening guide content and verification checklist.
.github/workflows/codeql.yml	Introduces a CodeQL workflow configuration.
.github/dependabot.yml	Introduces Dependabot update configuration.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-03T02:39:46Z

Hardening-Cacti-Installation.md

+| Path | Purpose | Recommended mode |
+|------|---------|-----------------|
+| `rra/` | RRDtool data files | `www-data:www-data 750` |
+| `log/` | Cacti log files | `www-data:www-data 750` |
+| `cache/` | Boost / poller cache | `www-data:www-data 750` |
+| `resource/` | XML templates | `root:root 755` (read-only for web) |
+| `scripts/` | Data-source scripts | `root:root 755` (read-only for web) |
+| `lib/`, `include/` | PHP libraries | `root:root 755` |
+


The permissions matrix table uses double leading/trailing pipes (|| ... ||), which breaks GitHub-flavored Markdown table rendering (it will be parsed as empty first column / misaligned rows). Use single | delimiters for the header and each row so the table renders correctly.

Copilot · 2026-04-03T02:39:46Z

Hardening-Cacti-Installation.md

+### Apache
+
+Add inside your Cacti `<VirtualHost>` or `.htaccess`:
+
+```apache
+# Deny direct HTTP access to the script and resource trees.
+# A PHP file written here via import cannot be reached over the web.
+<DirectoryMatch "^/var/www/html/cacti/(scripts|resource)/">
+    <FilesMatch "\.php$">


This section says the Apache snippet can be added in a <VirtualHost> or .htaccess, but <DirectoryMatch> is not permitted in .htaccess context. Please adjust the guidance (e.g., restrict to server/vhost config, or provide an .htaccess-compatible alternative such as FilesMatch/RedirectMatch rules).

Copilot · 2026-04-03T02:39:46Z

Hardening-Cacti-Installation.md

+
+- [Installing Under Ubuntu/Debian](Installing-Under-Ubuntu-Debian.md)
+- [Installing Under CentOS (LAMP)](Install-Under-CentOS_LAMP.md)
+- [Standards Security](Standards-Security.md)


Repository docs consistently end with a footer separator and copyright notice as the final lines (e.g., Standards-Documentation.md ends with --- then Copyright ...). This new document currently ends with a “See Also” list and has no trailing copyright footer, which makes it inconsistent with the rest of the documentation set. Add the standard footer at the end (and keep it last).

Suggested change

- [Standards Security](Standards-Security.md)

- [Standards Security](Standards-Security.md)

---

Copyright (C) 2004-2025 The Cacti Group

Copilot · 2026-04-03T02:39:46Z

Standards-Security.md

 ---
 Copyright (c) 2004-2026 The Cacti Group
+
+## See Also
+
+For OS-level hardening controls covering file permissions, web server access
+restrictions, PHP-FPM pool settings, SELinux, and AppArmor, see
+[Hardening a Cacti Installation](Hardening-Cacti-Installation.md).


The new “See Also” section is placed after the file’s footer/copyright line. Across this repo, the convention is that the final lines are --- followed by the copyright notice (e.g., Standards-Documentation.md), with no additional content after it. Consider moving “See Also” above the --- footer (or otherwise keep the copyright line last) to match the established documentation footer pattern.

Suggested change

---

Copyright (c) 2004-2026 The Cacti Group

## See Also

For OS-level hardening controls covering file permissions, web server access

restrictions, PHP-FPM pool settings, SELinux, and AppArmor, see

[Hardening a Cacti Installation](Hardening-Cacti-Installation.md).

## See Also

For OS-level hardening controls covering file permissions, web server access

restrictions, PHP-FPM pool settings, SELinux, and AppArmor, see

[Hardening a Cacti Installation](Hardening-Cacti-Installation.md).

---

Copyright (c) 2004-2026 The Cacti Group

Copilot · 2026-04-03T02:39:47Z

.github/dependabot.yml

+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10


Dependabot is configured for the npm ecosystem at the repo root, but there is no package.json/lockfile in this repository. This will cause Dependabot update runs to error/no-op. Either remove the npm entry or point it at the directory that actually contains npm manifests (if any).

Suggested change

- package-ecosystem: "npm"

directory: "/"

schedule:

interval: "weekly"

open-pull-requests-limit: 10

Copilot · 2026-04-03T02:39:47Z

.github/workflows/codeql.yml

+on:
+  push:
+    branches: [main, master, develop, regression-audit]
+    paths-ignore:
+      - "**/*.php"
+      - "**/*.md"
+  pull_request:
+    branches: [main, master, develop, regression-audit]
+    paths-ignore:
+      - "**/*.php"
+      - "**/*.md"
+  schedule:
+    - cron: "30 1 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["ruby"]
+    steps:


The CodeQL workflow is configured to analyze only ruby, but this repo appears to contain little/no Ruby source (aside from markdownlint config), while most content is Markdown (and some PHP, which CodeQL doesn’t analyze). As written, this job is likely to provide minimal value while consuming CI time. Consider either removing CodeQL for this repo, or adjusting the configuration to target a language actually present / a workflow type you intend to scan, and revisit paths-ignore so it runs on the relevant changes.

somethingwithproof added 8 commits March 15, 2026 16:58

ci: add dependabot config with npm and github-actions

d56c40c

ci: add CodeQL (JS/TS, excludes PHP) with workflow_dispatch

634891c

ci: remove CodeQL JS/TS workflow (no JavaScript in this repo)

a85e2f0

ci: add CodeQL for ruby

4698428

fix(ci): use specific runner labels, fix codeql concurrency

a4c514f

docs: add Hardening-Cacti-Installation guide

41c7582

docs: add Hardening-Cacti-Installation to Cacti Installation nav

e67e132

docs: cross-reference hardening guide from Standards-Security

8d46a5b

Copilot AI review requested due to automatic review settings April 3, 2026 02:36

Copilot started reviewing on behalf of somethingwithproof April 3, 2026 02:36 View session

Copilot AI reviewed Apr 3, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs: add Hardening-Cacti-Installation guide#224

docs: add Hardening-Cacti-Installation guide#224
somethingwithproof wants to merge 8 commits intoCacti:developfrom
somethingwithproof:docs/hardening-cacti-installation

somethingwithproof commented Apr 3, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

somethingwithproof commented Apr 3, 2026

Summary

What the guide covers

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants