wekan / Tickets / #890 MongoDB Encryption and Wekan

Anonymous - 2017-03-04

Originally posted by: xet7

@fmonthel

Depends when Sandstorm gets grain-level encryption working. Then only those that have permissions to Wekan board are able to open it, and it's encrypted at rest.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2017-03-04

Originally posted by: xet7

@fmonthel

Another option would be to figure out how to store Wekan data in ZeroDB:
https://opensource.zerodb.com/

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2017-10-10

Originally posted by: amadilsons

@xet7 Is there any specific approach you think should be taken to go about this issue??

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2017-10-10

Originally posted by: xet7

@amadilsons

If you have any progress, please add info to this issue.

Sandstorm

1) Find where in https://sandstorm.io dev mailinglist, GitHub issues, and code repos is current status of encrypted grains progress.

2) Try to make encrypted grains work on Sandstorm.

Standalone Wekan

1) Install ZeroDB and Wekan locally.

2) Try to write some code that saves data to ZeroDB, and read data from there.

3) Look at possible ways for Wekan to save data to ZeroDB, look at discussion about other databases [#787] . One possibility would be to have: Wekan <=> MongoDB driver to ZeroDB converter <=> ZeroDB database

4) If you get Wekan working with ZeroDB, you could install ZeroDB to any server use it remotely with locally installed Wekan, and server admin would not have access to data.

API time limited tokens

If you don't want to use always same passwords when using API etc, but have limited time tokens, look at HashiCorp Vault.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2019-07-24

Originally posted by: xet7

Wekan also works with Percona Server for MongoDB:
https://www.percona.com/software/mongo-database/percona-server-for-mongodb

Here is feature matrix:
https://www.percona.com/software/mongo-database/feature-comparison

According to that feature matrix:

Percona MongoDB encryption is available for x64 free version, but not for original MongoDB Community version.

Percona MongoDB is available for x64, but not for ARM. Well, it could probably be compiled from Percona MongoDB GitHub repo, I have not tested it.

@fmonthel @amadilsons

Because you seem to be interested in this, you could try this and add comment to this issue, does encryption work, and what steps you did to get encryption working.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2019-07-24

Originally posted by: xet7

https://github.com/wekan/wekan master branch works with Percona MongoDB 4.x.
You can build Wekan with ./rebuild-wekan.sh with first option 1 install dependencies, then option 2 build source. Then edit start-wekan.sh for ROOT_URL and MONGO_BIND_IP 127.0.0.1 and MONGODB_PORT=27017, and then ./start-wekan.sh.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2019-07-24

Originally posted by: xet7

Hmm, other possibility would be for me to change Wekan Snap MongoDB to Percona MongoDB, and try to make some configuration options for enabling MongoDB encryption.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2020-10-21

Originally posted by: noor-alghamdi

@xet7 do you mean that we can't encrypt DB on wekan snap?

how do we ensure that we'll not lose data in wekan snap??

I'm asking you that because there are many security standards we need to follow :\

thank you.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2020-10-21

Originally posted by: xet7

@namacoconut

Oh sorry, I did not know you would like to encrypt DB.

For ensuring you do not lose data, you should have at least daily backups,
although just for extra safety, backups could be multiple times per day:
https://github.com/wekan/wekan/wiki/Backup

From MongoDB, if required, it is also possible to dump all database
content to plain text JSON files. Attachments are base64 encoded:
https://github.com/wekan/wekan/wiki/Export-from-Wekan-Sandstorm-grain-.zip-file

For securing Wekan server, to some bare metal server it is possible
to install KVM / XEN / or other VM, and there install Linux
with full disk encryption. Then at that VM only allow SSH
with SSH public/private keys from bare metal server to VM,
at /etc/ssh/sshd_config disable password login and do

sudo service ssh restart

With UFW firewall, inside VM, you can close all other than
necessary ports:

sudo apt install ufw sudo ufw allow http sudo ufw allow https sudo ufw allow ssh sudo ufw enable

Also with UFW or other firewall you can allow accessing
Wekan only from some selected IP addresses.

For using Wekan Snap SSL/TLS only on selected IP
addresses with Wekan included Caddy or Nginx,
it is not possible to use Let's Encrypt free certs,
because that would require exposing server to
Internet so that free cert validation can happen.
The workaround is to buy SSL/TLS certificate and
install it manually:
https://github.com/wekan/wekan/wiki/Caddy-Webserver-Config

It is same for Nginx.

Anyway, inside that full disk encrypted VM, all Wekan
settings are also encrypted.

If that is not enough, and you would like to encrypt database,
encrypting MongoDB database is available on Percona MongoDB:
https://www.percona.com/software/mongodb/feature-comparison

I will look how to make possible changing MONGO_URL in Snap.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2020-10-21

Originally posted by: xet7

Hmm, let's discuss some more.

If Wekan Snap included MongoDB server would be changed to Percona MongoDB, then it would be possible to add settings to Wekan so that MongoDB would be encrypted. But usually only those have direct access to MongoDB, that can SSH to Wekan server, and then get MONGO_URL username and password login etc Snap settings with:

sudo snap get wekan

But if that Wekan Snap is inside of encrypted Linux VM, only those that have ssh public key access to that VM can modify it, or get those settings. Anyway, Wekan does need to be able to read database login username and password from MONGO_URL to be able to login to database.

In Wekan database, currently passwords are hashed. Other data is plaintext.

Is it needed to worry about accessing server RAM ? There could be some upcoming KVM patches that prevent host accessing quest RAM:
https://lwn.net/Articles/834719/

Regarding various compliance standards, there is SIMP project, that starts from compliant configuration:
https://www.simp-project.com

Other alternative is for compliance Saltstack, although more expensive I think:
https://www.saltstack.com

When compared to some other software:

At RocketChat, there is possibility to have end-to-end encryption in chat. Wekan does not have that.

At Protonmail, frontend Javascript only saves encrypted database to backend, server admins do not have access to any plaintext data. Wekan does not have that.

If there were Wekan version made with PHP, it would be possible to encrypt serverside passwords with Ioncube Encoder, and then use those passwords with salt etc to encrypt or decrypt other data.

It could be possible to add to to Wekan encrypting of users data with combined hash from username/emailaddress/password and some other data. But in that case nobody else than that user can have any access to that data, and if that user does forget password, it is not possible to get access anymore.

Then there is physical security:

Wekan server not being accessible from Internet, so nobody can do any kind of attack directly, or having Wekan inside of VPN

Wekan source version installed to some encrypted VM, that has Wekan only. In that case, KVM VM "sandbox" prevents Wekan code to access any other VMs. And only sometimes creating new version of that KVM VM and doing backup-restore for data.

Wekan used in local LAN that is not connected directly to Internet

Some VM tech also allows for encrypting VMs. For example, AFAIK AWS has some features for encrypted VM storage, and probably some other clouds, that do certify their environment. Although, usually Wekan is self-hosted at private servers for those that can not use any public cloud at all.

Similar to SaltStack, but made with Golang, there is mgmt:
https://github.com/purpleidea/mgmt

With mgmt it is possible to immediately automatically respond to some events. For example, if mgmt detects some file has been changed, then it replaces that file with original file. Possibly it can also detect if there is some new software process started, and kill it immediately.

Then there is logging:

You can enable MongoDB to log all queries

It is also possible to send some logs to LogStash/ElasticSearch https://github.com/wekan/wekan-logstash

And also generate some stats https://github.com/wekan/wekan-stats
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2020-10-21

Originally posted by: xet7

For process monitoring, there is also https://osquery.io . With it you can make queries for processes, files, etc. I have read some discussion that in some cases it can replace virus scan or other monitoring systems, for example by verifying file hashes, signatures etc.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2023-11-21

Ticket changed by: xet7

status: open --> closed
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Anonymous - 2023-11-21

Originally posted by: xet7

WeKan' s future is not SSPL-licensed MongoDB.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

MongoDB Encryption and Wekan

Milestone

Searches

Help

#890 MongoDB Encryption and Wekan

Discussion

Sandstorm

Standalone Wekan

API time limited tokens