> For the complete documentation index, see [llms.txt](https://docs.abtasty.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.abtasty.com/recommendations-and-merchandising_deprecated/security-and-gdpr/security-configuration-of-our-servers.md).

# Security Configuration of Our Servers

#### General Security and Hardening Principles <a href="#h_01jdq3m5nh6xcfqavyrxfq705y" id="h_01jdq3m5nh6xcfqavyrxfq705y"></a>

* **Minimisation**\
  Only components strictly necessary for the system’s functionality are installed.
  * All services, especially those actively listening on the network, are considered sensitive. Only those essential for system operation and maintenance are installed. Unjustified services are disabled, uninstalled, or removed.
  * Features configured at the level of active services must be limited to the bare minimum required.
* **Least Privilege**\
  Every object or entity managed by the system is granted only the permissions strictly necessary for its operation—no more, no less.
* **Defence in Depth**\
  Network services are hosted on separate environments whenever possible. This prevents other services from being affected if one becomes compromised within the same environment.
* **Monitoring and Maintenance**\
  Regular updates are performed, and the stable Debian distribution is used.

***

#### System Installation <a href="#h_01jdq3m5nh930q45f2fbmhke58" id="h_01jdq3m5nh930q45f2fbmhke58"></a>

* **Minimal Package Installation**\
  Only essential packages are installed, ensuring the system setup is as minimal as possible, selecting only what is necessary for the intended purpose.
* **Repository Selection**\
  Only up-to-date official repositories of the distribution are used.
* **Root Password and Administrator Accounts**
  * The root password is chosen with the utmost care, following current recommendations, and is known only to those who need access.
  * Each administrator has a dedicated account (local or remote) and does not use the root account for system administration access. Privilege escalation operations are carried out using tools like `sudo`, ensuring activities are traceable.

***

#### System Configuration and Services <a href="#h_01jdq3m5nh6hd7y93g0nfa84eb" id="h_01jdq3m5nh6hd7y93g0nfa84eb"></a>

* **Hardening and Monitoring of Services Handling Arbitrary Traffic**
  * SSH access is permitted only via VPN.
  * Root login is prohibited, and authentication is performed using SSH keys.
* **Network Sysctl Settings**
  * IP forwarding is systematically disabled for servers that do not act as routers.
* **Dedicated Service Accounts**\
  Each service has its own exclusive system account, dedicated solely to its operation.
* **Access Rights for Sensitive Files**\
  Files containing sensitive information (e.g., certificates) are readable only by users who need access.
* **Resident Services and Daemons**
  * Only network daemons strictly necessary for the system’s operation and the services they provide are active and listening on appropriate network interfaces.
  * All other daemons are disabled and, wherever possible, uninstalled.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.abtasty.com/recommendations-and-merchandising_deprecated/security-and-gdpr/security-configuration-of-our-servers.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.