Security & Privacy

~horse is a shared Unix system. We apply strict privilege separation, sandboxing, and modern cryptographic standards to keep user data private and the server stable.

System & Process Isolation

• Process Hiding: /proc is mounted with hidepid=invisible. Users can only see their own processes; daemon commands, arguments, and other users' activity are hidden.
• Resource Limits: Process and memory caps (limits.conf) prevent fork bombs and runaway memory allocation from degrading system performance.
• Home Sandboxing: User home directories are strictly 0700 (owner-only access).
• No Sudo: General shell users have no elevated privileges or access to raw device sockets.

Web & Content Sandboxing

• Static Hosting: User sites (~/public_www/) are strictly static. No user-level PHP or dynamic server-side scripts run under the webserver.
• MIME & Traversal Protection: Path traversal is blocked (return 404), and unmapped files default to text/plain with nosniff to prevent MIME-type confusion.
• Security Headers: All HTTPS endpoints enforce HSTS (max-age=31536000), clickjacking defense (SAMEORIGIN), and Referrer-Policy.
• Bot Protection: The /signup endpoint is rate-limited against automated scripts.

Authentication & Cryptography

• SSH Keys Only: Password auth over SSH is disabled. All logins require SSH keys (Ed25519 recommended).
• Modern TLS: All services (HTTPS, Mail, XMPP) require TLS 1.2 or 1.3 with strong ciphers. Legacy protocols and TLS session tickets are disabled for Perfect Forward Secrecy.

Email Security

• Anti-Spoofing: Postfix enforces reject_sender_login_mismatch. Authenticated users cannot forge sender addresses or impersonate others.
• Authentication & Delivery: 2048-bit DKIM signing, strict SPF (-all), DMARC (quarantine), MTA-STS (enforce), and zero unauthenticated open relay.

Network & Privacy

• Isolated DNS: The Unbound resolver serves only localhost and internal mesh interfaces; port 53 is firewalled from public internet recursion.
• Zero Logging: Web access logs route to /dev/null. DNS queries and visitor IPs are never logged or tracked.
• Intrusion Prevention: Fail2ban monitors authentication across SSH, Mail, and IRC, automatically banning abusive IPs.

Responsible Disclosure

Found a vulnerability or security issue? Please report it to abuse@tilde.horse or postmaster@tilde.horse.