Security & isolation
BOA's multi-tenant threat model and every layer that enforces it — SYNPROXY, CSF, the Nginx edge, AppArmor, restricted shells, SSH and admin-path hardening.
BOA's foundational threat model: multiple Octopus tenants share one host but
cannot affect each other or escape their boundaries. This area is the operator
reference for every layer that enforces that model — the trust hierarchy, the
per-tenant restricted shell, the network edge (SYNPROXY → CSF/LFD → Nginx),
per-binary AppArmor confinement, SSH/SFTP hardening, password policy, the
default /admin* protection and the IP-based access controls that build on it,
strict binary permissions, the codebase-wide audit hardening, the mailing
restriction, and the backend Drush extension deny-filter.
The defence is layered. A request crosses, in order: kernel SYNPROXY → CSF/LFD → the Nginx Abuse Guard → PHP-FPM (function-restricted, AppArmor-confined) → Drupal. Each layer filters more, so by the time traffic reaches application code it has already survived several independent gates.
The pages below take each layer in turn — the trust model and its built-in protections, the per-tenant restricted shell, the CSF and SYNPROXY network edge, AppArmor confinement, SSH and SFTP hardening, password hashing, the default admin-path protection and the whole-site and login/admin IP allow-lists, strict binary permissions, the security-audit hardening, the mailing restriction, and the backend Drush extension deny-filter.
Adjacent operating topics
- Abuse Guard (nginx IDS) — the deep scan_nginx scoring, ban pipeline and request guards that CSF and the security model reference.
- Nginx internals — the vhost generator and the
config-template maps that emit the
/admin*block, AI policy and realip. - Migration & cloning — the
xmass/xoctflow that the migration-proxy trust on the CSF page supports. - Troubleshooting — blocked-IP recovery and SSH host-key-changed recovery.
BOA security model — multi-Ægir architecture
The three-tier root, aegir and tenant trust model, and the built-in protections that isolate Octopus tenants; the deep hardening knobs live on their own focused pages.
lshell + manage_ltd_users
The per-tenant restricted shell that isolates Octopus tenants: the oN and oN.ftp two-account model, what lshell blocks, and the manage_ltd_users orchestrator.
CSF + LFD firewall lifecycle
CSF and the LFD login-failure daemon as BOA's host firewall: the install and upgrade lifecycle, the Abuse Guard ban loop, migration-proxy trust, and blocked-IP recovery.
SYNPROXY iptables-based DDoS protection
Linux kernel SYN-flood mitigation as the lowest DDoS layer beneath CSF: the synproxy command family, live counters, reassert after reboot, and snapshot rollback.
AppArmor confinement profiles
The 46 Mandatory Access Control profiles BOA ships for PHP and its daemons — off by default, opt-in via a control file and reboot in complain or enforce mode.
SSH server + SFTP hardening
What BOA enforces in sshd_config, how the strip-and-append upgrade reconciliation decides which edits survive, and the MySecureShell and Pure-FTPd SFTP and FTPS chroot.
Password hashing — SHA512 → Bcrypt/Blowfish
The default SHA512 account hashing and the optional pam_unix2 migration to Bcrypt, including the PAM transition and the failure mode that can lock out every account.
Extra SSH/SFTP/FTPS accounts per client
How BOA provisions one extra SSH, SFTP and FTPS subaccount per Ægir Client, scoped to that Client's own sites, and its provisioning, key and removal lifecycle.
`/admin*` URL protection
The default block on anonymous /admin access — the unconditional Nginx guard, the INI-gated 301 redirect to the homepage, and the disable_admin_dos_protection per-site opt-out.
Whole-site IP allow-list — `ip_access`
The ip_access generator that locks an entire site — or the master SQL-admin proxies — to a per-instance IP allow-list at Nginx, with automatic anti-lockout for loopback, the server and active SSH clients.
Login/admin IP allow-list — `user_admin_access`
The user_admin_access generator that locks only a site's /user and /admin surface to a per-instance IP allow-list at Nginx while the rest of the site stays public, with the same anti-lockout as ip_access.
Mailing policy — no bulk mail from BOA hosts
Why BOA hosts send transactional mail only and not bulk, what to route through an external provider instead, and how to configure an SMTP relay for outbound mail.
Drush extension deny-filter (*.drush.inc)
The default-deny filter that stops tenant .drush.inc command files from running as a privileged backend identity, its backend-only gate, per-instance opt-ins and kill switch.
Shared codebase permissions — fixrepo
The root-only fixrepo tool that makes an entire codebase and its git metadata group-writable with setgid directories, so an account's oN and oN.ftp identities can work on the same tree without permission clashes.
The codebase lock — nightly ownership management
How BOA's nightly worker re-asserts code ownership and permissions on registered platforms, what unlock.info and skip.info flip, which barracuda.cnf and INI knobs gate the whole machinery, and how Verify interacts with it.
Strict binary permissions
The _STRICT_BIN_PERMISSIONS hardening: group-read stripping on system binaries and the system-shell switch to dash, both running only during barracuda upgrade passes.
Security audit hardening & edge anti-spoofing
The filesystem permission baseline, the codebase-wide 5.9.5 security-audit outcomes, the 5.10.1 Cloudflare-aware anti-spoofing hardening, and the edgetest edge-stack checker.
Database credentials — cloaking
Why a hosted site's settings.php holds no database password, where the credentials actually live, and how the web and command-line paths each obtain them.