foxhunt/scripts/production-security-hardening.sh

#!/bin/bash
# Foxhunt Production Security Hardening Script
# Applies comprehensive security hardening for production deployment

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Configuration
FOXHUNT_ROOT="${FOXHUNT_ROOT:-/home/jgrusewski/Work/foxhunt}"
LOG_FILE="/tmp/foxhunt-hardening-$(date +%s).log"

echo -e "${BLUE}🔒 Foxhunt Production Security Hardening${NC}"
echo "============================================="

# Logging function
log() {
    echo "$(date): $1" | tee -a "$LOG_FILE"
}

# Error handler
error_exit() {
    echo -e "${RED}❌ Error: $1${NC}" >&2
    log "ERROR: $1"
    exit 1
}

# Success message
success() {
    echo -e "${GREEN}✅ $1${NC}"
    log "SUCCESS: $1"
}

# Warning message
warning() {
    echo -e "${YELLOW}⚠️  $1${NC}"
    log "WARNING: $1"
}

# Check if running as root (for system-level hardening)
check_permissions() {
    if [[ $EUID -eq 0 ]]; then
        warning "Running as root - will apply system-level hardening"
        SYSTEM_HARDENING=true
    else
        log "Running as user - will apply application-level hardening only"
        SYSTEM_HARDENING=false
    fi
}

# Verify Foxhunt directory structure
verify_structure() {
    log "Verifying Foxhunt directory structure..."
    
    required_dirs=(
        "$FOXHUNT_ROOT/tli/src/auth"
        "$FOXHUNT_ROOT/core/src/compliance"
        "$FOXHUNT_ROOT/config/security"
        "$FOXHUNT_ROOT/certs"
    )
    
    for dir in "${required_dirs[@]}"; do
        if [[ ! -d "$dir" ]]; then
            error_exit "Required directory not found: $dir"
        fi
    done
    
    success "Directory structure verified"
}

# Generate production secrets if not exist
generate_secrets() {
    log "Checking production secrets..."
    
    if [[ ! -f "/tmp/foxhunt-production-secrets/production-secrets.env" ]]; then
        warning "Production secrets not found - generating..."
        
        if [[ -x "$FOXHUNT_ROOT/scripts/generate-production-secrets.sh" ]]; then
            "$FOXHUNT_ROOT/scripts/generate-production-secrets.sh"
            success "Production secrets generated"
        else
            error_exit "Secret generation script not found or not executable"
        fi
    else
        log "Production secrets already exist"
    fi
}

# Configure secure file permissions
secure_file_permissions() {
    log "Securing file permissions..."
    
    # Secure configuration files
    find "$FOXHUNT_ROOT/config" -name "*.toml" -exec chmod 640 {} \;
    find "$FOXHUNT_ROOT/config" -name "*.env*" -exec chmod 600 {} \;
    
    # Secure certificate files
    if [[ -d "$FOXHUNT_ROOT/certs" ]]; then
        find "$FOXHUNT_ROOT/certs" -name "*.pem" -exec chmod 600 {} \;
        find "$FOXHUNT_ROOT/certs" -name "*.key" -exec chmod 600 {} \;
        chmod 700 "$FOXHUNT_ROOT/certs"
    fi
    
    # Secure scripts
    find "$FOXHUNT_ROOT/scripts" -name "*.sh" -exec chmod 750 {} \;
    
    success "File permissions secured"
}

# Validate security configurations
validate_security_config() {
    log "Validating security configurations..."
    
    # Check for placeholder secrets
    if grep -r "CHANGE_ME" "$FOXHUNT_ROOT/config/" 2>/dev/null; then
        error_exit "Found placeholder secrets in configuration files"
    fi
    
    if grep -r "production_.*_replace" "$FOXHUNT_ROOT/config/" 2>/dev/null; then
        error_exit "Found production placeholder values in configuration files"
    fi
    
    # Validate TLS configuration
    if [[ -f "$FOXHUNT_ROOT/config/security/security-hardening.toml" ]]; then
        if ! grep -q "TLS_AES_256_GCM_SHA384" "$FOXHUNT_ROOT/config/security/security-hardening.toml"; then
            warning "Strong TLS cipher suites not configured"
        fi
    fi
    
    success "Security configuration validated"
}

# Apply Rust security hardening
rust_security_hardening() {
    log "Applying Rust security hardening..."
    
    # Create cargo config for security flags
    mkdir -p "$FOXHUNT_ROOT/.cargo"
    
    cat > "$FOXHUNT_ROOT/.cargo/config.toml" << 'EOF'
[build]
rustflags = [
    "-D", "unsafe_op_in_unsafe_fn",
    "-D", "clippy::undocumented_unsafe_blocks",
    "-W", "rust_2024_idioms",
    "-C", "force-frame-pointers=yes",
    "-C", "stack-protector=strong",
    "-C", "relocation-model=pic",
]

[target.x86_64-unknown-linux-gnu]
rustflags = [
    "-C", "link-arg=-Wl,-z,relro,-z,now",
    "-C", "link-arg=-Wl,--as-needed",
]
EOF
    
    # Set secure Rust environment variables
    export RUSTFLAGS="-D unsafe_op_in_unsafe_fn -D clippy::undocumented_unsafe_blocks"
    
    success "Rust security hardening applied"
}

# Configure TLS/SSL hardening
tls_hardening() {
    log "Configuring TLS/SSL hardening..."
    
    # Update TLS configuration to enforce TLS 1.3
    if [[ -f "$FOXHUNT_ROOT/config/security/security-hardening.toml" ]]; then
        # Ensure TLS 1.3 is enforced
        if ! grep -q "min_version.*1.3" "$FOXHUNT_ROOT/config/security/security-hardening.toml"; then
            warning "TLS 1.3 not enforced in configuration"
        fi
    fi
    
    # Generate DH parameters if needed
    if [[ ! -f "$FOXHUNT_ROOT/certs/dhparam.pem" ]]; then
        log "Generating DH parameters (this may take a while)..."
        openssl dhparam -out "$FOXHUNT_ROOT/certs/dhparam.pem" 2048
        chmod 600 "$FOXHUNT_ROOT/certs/dhparam.pem"
    fi
    
    success "TLS/SSL hardening configured"
}

# System-level hardening (requires root)
system_hardening() {
    if [[ "$SYSTEM_HARDENING" == "true" ]]; then
        log "Applying system-level hardening..."
        
        # Configure iptables for security
        iptables -P INPUT DROP
        iptables -P FORWARD DROP
        iptables -P OUTPUT ACCEPT
        
        # Allow loopback
        iptables -A INPUT -i lo -j ACCEPT
        
        # Allow established connections
        iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
        
        # Allow SSH (modify port as needed)
        iptables -A INPUT -p tcp --dport 22 -j ACCEPT
        
        # Allow HTTPS
        iptables -A INPUT -p tcp --dport 443 -j ACCEPT
        
        # Allow gRPC (if needed)
        iptables -A INPUT -p tcp --dport 50051 -j ACCEPT
        
        # Save iptables rules
        iptables-save > /etc/iptables/rules.v4
        
        # Configure fail2ban
        if command -v fail2ban-client >/dev/null 2>&1; then
            systemctl enable fail2ban
            systemctl start fail2ban
        fi
        
        # Set kernel security parameters
        cat >> /etc/sysctl.conf << 'EOF'
# Foxhunt Security Hardening
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.tcp_syncookies = 1
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2
fs.suid_dumpable = 0
EOF
        
        sysctl -p
        
        success "System-level hardening applied"
    else
        log "Skipping system-level hardening (not running as root)"
    fi
}

# Configure monitoring and alerting
setup_monitoring() {
    log "Setting up security monitoring..."
    
    # Create monitoring configuration
    mkdir -p "$FOXHUNT_ROOT/config/monitoring"
    
    cat > "$FOXHUNT_ROOT/config/monitoring/security-alerts.yml" << 'EOF'
# Foxhunt Security Monitoring Configuration
alerts:
  authentication_failures:
    threshold: 5
    window: 300  # 5 minutes
    action: block_ip
    
  trading_anomalies:
    threshold: 3_sigma
    window: 60  # 1 minute
    action: alert_risk_team
    
  data_exfiltration:
    threshold: unusual_transfer
    window: 300  # 5 minutes
    action: quarantine_system
    
  api_abuse:
    threshold: rate_limit_exceeded
    window: 60  # 1 minute
    action: temporary_suspension

notifications:
  slack_webhook: "${SLACK_SECURITY_WEBHOOK}"
  email_alerts: "security@foxhunt.com"
  sms_alerts: "+1-XXX-XXX-XXXX"
  
escalation:
  level_1: 5    # 5 minutes
  level_2: 15   # 15 minutes
  level_3: 60   # 1 hour
EOF
    
    success "Security monitoring configured"
}

# Validate Rust security features
validate_rust_security() {
    log "Validating Rust security features..."
    
    cd "$FOXHUNT_ROOT"
    
    # Check for unsafe code
    if grep -r "unsafe" src/ 2>/dev/null | grep -v "// SAFETY:" | head -5; then
        warning "Found potentially undocumented unsafe code"
    fi
    
    # Check for unwrap/expect usage
    if grep -r "\.unwrap()" src/ 2>/dev/null | head -5; then
        warning "Found .unwrap() usage - consider using proper error handling"
    fi
    
    # Check Cargo.toml for security features
    if [[ -f "Cargo.toml" ]]; then
        if ! grep -q "deny.*clippy::unwrap_used" Cargo.toml; then
            warning "clippy::unwrap_used not denied in Cargo.toml"
        fi
    fi
    
    success "Rust security validation completed"
}

# Create security checklist
create_security_checklist() {
    log "Creating security deployment checklist..."
    
    cat > "$FOXHUNT_ROOT/SECURITY_CHECKLIST.md" << 'EOF'
# Foxhunt Production Security Checklist

## Pre-Deployment Security Verification

### Secrets Management
- [ ] All production secrets generated using `scripts/generate-production-secrets.sh`
- [ ] No placeholder secrets (CHANGE_ME, production_*_replace) in configuration
- [ ] Secrets deployed to secure storage (Vault/AWS Secrets Manager/etc.)
- [ ] Database passwords rotated and secured
- [ ] API keys generated and properly scoped

### TLS/SSL Configuration
- [ ] Production certificates installed (not self-signed)
- [ ] TLS 1.3 enforced
- [ ] Strong cipher suites configured
- [ ] Certificate expiration monitoring enabled
- [ ] HSTS headers configured

### Authentication & Authorization
- [ ] MFA enabled for all privileged accounts
- [ ] RBAC properly configured and tested
- [ ] Session timeouts configured appropriately
- [ ] Account lockout policies enabled
- [ ] Audit logging for all authentication events

### System Security
- [ ] Firewall rules configured (iptables/security groups)
- [ ] Fail2ban configured for brute force protection
- [ ] System patches up to date
- [ ] Unnecessary services disabled
- [ ] File permissions properly secured

### Application Security
- [ ] Rust security flags enabled in build
- [ ] No unsafe code without proper SAFETY comments
- [ ] Input validation implemented
- [ ] Error handling doesn't expose sensitive information
- [ ] Rate limiting configured

### Monitoring & Incident Response
- [ ] Security monitoring dashboard configured
- [ ] Alert thresholds properly tuned
- [ ] Incident response plan tested
- [ ] Contact information updated
- [ ] Backup and recovery procedures verified

### Compliance
- [ ] SOX controls tested and documented
- [ ] GDPR/CCPA compliance verified
- [ ] Audit logging meets regulatory requirements
- [ ] Data retention policies implemented
- [ ] Regulatory reporting mechanisms tested

### Final Verification
- [ ] Full security scan completed
- [ ] Penetration testing performed
- [ ] All security findings remediated
- [ ] Documentation updated
- [ ] Team training completed

## Post-Deployment Verification

### Immediate (0-24 hours)
- [ ] All services started successfully
- [ ] Security monitoring active
- [ ] No critical alerts triggered
- [ ] Authentication working properly
- [ ] TLS certificates valid

### Short-term (1-7 days)
- [ ] Monitor security logs for anomalies
- [ ] Verify backup procedures
- [ ] Test incident response procedures
- [ ] Review performance impact of security controls
- [ ] Conduct security awareness training

### Ongoing
- [ ] Weekly security log review
- [ ] Monthly security control testing
- [ ] Quarterly security assessment
- [ ] Annual penetration testing
- [ ] Continuous monitoring and improvement

---
**Deployment Date**: _______________
**Security Officer**: _______________
**Approval**: _______________
EOF
    
    success "Security checklist created"
}

# Main execution
main() {
    log "Starting Foxhunt production security hardening"
    
    check_permissions
    verify_structure
    generate_secrets
    secure_file_permissions
    validate_security_config
    rust_security_hardening
    tls_hardening
    system_hardening
    setup_monitoring
    validate_rust_security
    create_security_checklist
    
    echo ""
    echo -e "${GREEN}🎉 Security hardening completed successfully!${NC}"
    echo ""
    echo -e "${BLUE}📋 Next Steps:${NC}"
    echo "1. Review the security checklist: $FOXHUNT_ROOT/SECURITY_CHECKLIST.md"
    echo "2. Deploy production secrets securely"
    echo "3. Test all security controls"
    echo "4. Conduct security validation"
    echo ""
    echo -e "${YELLOW}📄 Log file: $LOG_FILE${NC}"
    echo -e "${YELLOW}🔍 Documentation: $FOXHUNT_ROOT/docs/SECURITY_INCIDENT_RESPONSE.md${NC}"
}

# Run main function
main "$@"