Skip to content

Check points for securing Home Assistant installations #1151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Oct 8, 2016
Merged

Check points for securing Home Assistant installations #1151

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c0daa8b
Add check points
fabaff Oct 6, 2016
34af8ef
Add check points
fabaff Oct 6, 2016
705f8e8
Fix link
fabaff Oct 6, 2016
a4f1f6c
Grammar and style fixes
robbiet480 Oct 6, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions source/_includes/asides/getting_started_navigation.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ <h1 class="title delta">Getting Started Guide</h1>
<li>{% active_link /getting-started/customizing-devices/ Customizing devices and services %}</li>
<li>{% active_link /getting-started/presence-detection/ Presence Detection %}</li>
<li>{% active_link /getting-started/troubleshooting-configuration/ Troubleshooting %}</li>
<li>{% active_link /getting-started/securing/ Security Check Points %}</li>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't list be in alphabetical order?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From my point of view, this is something for the end. It's not required but should be mentioned.

</ul>
</li>
<li>
Expand Down
28 changes: 28 additions & 0 deletions source/getting-started/securing.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
---
layout: page
title: "Securing"
description: "Instructions how to secure your Home Assistant installation."
date: 2016-10-06 06:00
sidebar: true
comments: false
sharing: true
footer: true
---

One of the reasons to use Home Assistant is that it's not depending on cloud services. Even if you are only using Home Assistant in your local network, you should consider to secure your instance.

### {% linkable_title Checklist %}

- [Protect your web interface with a password](https://home-assistant.io/getting-started/basic/#password-protecting-the-web-interface)
- Secure your host. Sources could be [Red Hat Enterprise Linux 7 Security Guide](https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/pdf/Security_Guide/Red_Hat_Enterprise_Linux-7-Security_Guide-en-US.pdf), [CIS Red Hat Enterprise Linux 7 Benchmark](https://benchmarks.cisecurity.org/tools2/linux/CIS_Red_Hat_Enterprise_Linux_7_Benchmark_v1.0.0.pdf), or the [Securing Debian Manual](https://www.debian.org/doc/manuals/securing-debian-howto/index.en.html).
- Restrict network access to your device. Set `PermitRootLogin no` in your sshd config (usually `/etc/ssh/sshd_config`) and to use keys for authentication instead of passwords.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This setting will only disallow login with root over ssh.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, this would be most likely already be covered by the first point but better mention this twice as the hardening guides are pretty extensive.

- Don't run Home Assistant as root.
- Keep your [secrets](/topics/secrets/) safe.

Additional points if you want to allow remote access:

- Protect your communication with [TLS](blog/2015/12/13/setup-encryption-using-lets-encrypt/)
- Protect your communication with [Tor](/cookbook/tor_configuration/)
- Use a [proxy](/cookbook/apache_configuration/)