Server security
Last review: November 9, 2026The server hosting Rayor Connect is configured following ANSSI's guide “Configuration recommendations of a GNU/Linux system” (ANSSI-BP-028, version 2.0 of October 3, 2022). This page publishes our checklist, recommendation by recommendation, including what is not compliant yet.
This is a self-assessment. It is not a certification, a qualification or a security visa: ANSSI has not examined this server and is not associated with this page.
Summary
Minimal level · 11 items
8 compliant · 3 partial
Intermediate level · 29 items
5 compliant · 14 partial · 4 not compliant · 6 not applicable
Scope and method
- Scope: the operating system (Ubuntu 22.04 LTS) of the virtual server hosting Rayor Connect, hosted in France by OVHcloud. This server also runs other Rayor services.
- Method: each item is checked directly on the machine (kernel parameters, file permissions, accounts, listening services, sudo and SSH configuration).
- Target levels: minimal and intermediate. The guide reserves the enhanced and high levels for systems that need them; they are not assessed here.
- What we do not publish: software versions, ports and service names, so as not to help an attacker.
- Reference guide: ANSSI-BP-028 v2.0 (PDF, cyber.gouv.fr).
Minimal level
| No. | Recommendation | Status |
|---|---|---|
| R30 | Disable unused user accountsRoot account locked; service accounts have no login shell or are locked. | Compliant |
| R31 | Use strong passwordsRemote login by key only: password authentication is refused. | Compliant |
| R53 | Avoid files or directories without a known user or groupFixed on 2026-11-09. Only exception: container data, owned by accounts defined inside those containers. | Compliant |
| R54 | Enable the sticky bit on writable directoriesNo world-writable directory without the sticky bit remains (3 fixed on 2026-11-09). | Compliant |
| R56 | Avoid executables with setuid and setgid rightsEvery setuid/setgid executable comes from distribution packages (1 unnecessary right removed on 2026-11-09). | Compliant |
| R58 | Install only strictly necessary packagesServer shared by several Rayor services: build tools and unused components are still installed. Inventory in progress. | Partial |
| R59 | Use trusted package repositoriesOfficial Ubuntu repositories and signed vendor repositories only. The pre-release repository is pinned to priority 1 (never installed automatically). | Compliant |
| R61 | Apply updates regularlySecurity patches are installed automatically every day, with CVE monitoring. A reboot is still needed to load the latest kernel. | Partial |
| R62 | Disable unnecessary services6 unnecessary services stopped on 2026-11-09, including a legacy file transfer service replaced by an encrypted one. | Compliant |
| R68 | Protect stored passwordsSystem passwords are hashed (yescrypt for any new password). No plaintext passwords. | Compliant |
| R80 | Reduce the attack surface of network servicesDatabases, caches and internal services listen on loopback only. A few paused administration services are still reachable: closing in progress. | Partial |
Intermediate level
| No. | Recommendation | Status |
|---|---|---|
| R2 | Configure the BIOS/UEFIVirtual machine: the firmware is managed by the hosting provider (OVHcloud). | Not applicable |
| R3 | Enable UEFI Secure BootThe instance boots in BIOS mode: Secure Boot is not available on it. | Not compliant |
| R5 | Set a bootloader passwordNo bootloader password. Compensating measure: the console is only reachable from the hosting provider's customer area; boot configuration is readable by root only. | Partial |
| R8 | Set memory configuration optionsCPU mitigations (Spectre, Meltdown…) are active. Boot-time memory hardening options are not set yet. | Partial |
| R9 | Set kernel configuration optionsAll options are applied except halting on kernel errors, left out to preserve availability (single machine). | Partial |
| R11 | Enable and configure the Yama LSMYama enabled, ptrace restricted to descendant processes. | Compliant |
| R12 | Set IPv4 network configuration optionsApplied, with two justified deviations: forwarding stays on (containers), and two ARP options are not set because they would cut the network with the provider's addressing. | Partial |
| R13 | Disable IPv6No public IPv6 address. The stack stays loaded because internal services depend on it; redirects and source routing are refused. | Partial |
| R14 | Set filesystem configuration optionsLinks, FIFOs and regular files protected; core dumps of privileged programs disabled. | Compliant |
| R28 | Typical partitioningSingle partition provided by the hosting provider's image. | Not compliant |
| R32 | Expire local user sessionsIdle sessions closed after 15 minutes (console and SSH). | Compliant |
| R33 | Ensure accountability of administrative actionsRoot account disabled; privileged actions go through sudo and are logged. No per-process logging (auditd) yet. | Partial |
| R34 | Disable service accountsService accounts have no login shell or are locked. | Compliant |
| R35 | Use unique and exclusive service accountsEach daemon has its own account, but the websites share one execution account. | Partial |
| R39 | Change sudo configuration directivesenv_reset, use_pty and ignore_dot enabled. noexec, requiretty and umask not set: they would break automated administration tasks. | Partial |
| R40 | Use unprivileged target users for sudo commandsThe backup rule is limited to a single script. The administration account keeps full rights. | Partial |
| R42 | Ban negations in sudo specificationsNo negation in the sudo configuration. | Compliant |
| R43 | Specify arguments in sudo specificationsArguments are specified for the backup rule, not for the administration account (full rights). | Partial |
| R44 | Edit files securely with sudoNo sudo rule delegates file editing. | Not applicable |
| R50 | Restrict access to sensitive files and directoriesSystem authentication files and TLS private keys are root-only. Some application configuration files are still readable by other local accounts. | Partial |
| R52 | Restrict access to sockets and named pipesWebsite sockets are restricted to their account. A few service sockets still live in a shared temporary directory. | Partial |
| R55 | Separate users' temporary directoriesTemporary directory shared by all services. | Not compliant |
| R63 | Disable non-essential service featuresSSH X11 and agent forwarding disabled on 2026-11-09; web directory listing disabled. One service still accepts plaintext authentication. | Partial |
| R67 | Secure remote authentication through PAMNo system authentication is delegated to a remote directory. | Not applicable |
| R69 | Secure access to remote user databasesNo remote system user database. | Not applicable |
| R70 | Separate system and directory administrator accountsNo directory. | Not applicable |
| R74 | Harden the local mail serviceThis server is the domain's mail server: mail is an exposed service, covered by R79. | Not applicable |
| R75 | Configure a mail alias for service accountsSystem mail sent to root is not yet forwarded to an administrator. | Not compliant |
| R79 | Harden and monitor exposed servicesAutomatic banning of abuse, anti-DDoS protection, IP reputation, uptime monitoring. A patch is still pending on an administration component, whose access is restricted to a single IP address. | Partial |
Report a vulnerability
Found a vulnerability? Write to contact@rayor.fr. We answer every report and fix the issue before anything is published.