Security

Soviez applies a production-oriented security baseline on your server. It is security-hardened — not a claim that your system can never be compromised.

What Soviez protects

Area	What you get
Database	Least-privilege application role; PostgreSQL is not exposed to the internet
Application	ERP runs in isolated containers; application ports stay private
Network edge	Firewall, Nginx reverse proxy, HTTPS; serve ERP only on port 443
Host	SSH hardening, intrusion detection, optional audit tooling
Malware	Scheduled and on-demand scanning; suspicious files are quarantined, not auto-deleted
Restore safety	Untrusted backups enter a restricted validation path before Production use

Malware scanning

Soviez uses multiple scanning layers:

• ClamAV — signature-based antivirus for filestore and filesystem paths where supported
• YARA — pattern matching for addons, Python code, webshells, and known indicators
• Native checks — database, process, network, and integrity scanners

Response policy: detect → preserve evidence → quarantine → classify. Soviez never auto-deletes suspicious business files or signing keys.

Do not point ClamAV realtime scanning at PostgreSQL data directories.

Security commands

soviez.sh --security-status
soviez.sh --security-scan
soviez.sh --security-scan-db
soviez.sh --security-check
soviez.sh --security-harden
soviez.sh --security-report
soviez.sh --security-update-check
soviez.sh --security-backup-check

Scan results use three levels:

Status	Meaning
PASS	Checks passed
REVIEW	Your judgment is required before proceeding
FAIL	Remediation required; do not promote or cut over until resolved

--security-status reports operational state, not merely whether packages are installed.

PostgreSQL boundary

The ERP application runs as a least-privilege database role. Compromise of an ERP admin account must not automatically grant PostgreSQL superuser access, host root, or Docker control.

AppArmor

AppArmor must remain enabled on the host. Disabling AppArmor is not a supported troubleshooting step.

Webmin and Virtualmin

Soviez.sh NEVER installs Webmin or Virtualmin.

If third-party control panels are detected, Soviez may report them during security checks. Remove or isolate them according to your security policy.

Optional third-party tools

Tools such as auditd, Lynis, or AIDE may complement Soviez controls where equivalent native checks exist. Soviez does not require Wazuh, Falco, osquery, or CrowdSec as part of the default baseline.

Related

• RESTORE.md — quarantine and untrusted restore paths
• BACKUP.md — backup integrity checks
• TROUBLESHOOTING.md — security-related symptoms