Secure server hardening

[basti-app]

Secure server hardening

[BohdanPetryshyn]

The reason Basti uses EC2 instead of Fargate is that Session Manager port forwarding is only supported for EC2.

[BohdanPetryshyn]

Thank you for your input!

I have a couple of solutions in mind for keeping the instance up-to-date:

1. Adding a command like basti patch that would apply all the patches according to some policy.
2. Setting up an AWS Patch Manager rule that would do this automatically. The problem with this approach is that it (most likely) doesn't work when the instance is stopped.
3. Two solutions could be combined so that the command would start the instance and patch it with Patch Manager.

[BohdanPetryshyn]

What about the image (AMI) used for the EC2 instance - Basti uses the latest Amazon Linux 2 kernel version 5.10 available at basti init time.

[adamaltman]

Noting some of this in documentation would be good. I vote to prioritize basti patch so that it can be viable for production use. Also, is there a basti destroy or some way to kill the EC2 instance?

[BohdanPetryshyn]

basti cleanup command destroys all the resources created by Basti:

https://github.com/BohdanPetryshyn/basti#cleanup-optional

[BohdanPetryshyn]

@adamaltman, Basti now updates software packages and OS kernel at shutdown time once a day as described in README here 😉

[BohdanPetryshyn]

The new security feature is available in v1.1.0