Exquisite.social Security

Protecting the Exquisite community is paramount to us, on every level. This document highlights the more technical measures we have taken to secure the Mastodon instance.

High-level

  • We regularly patch and install updates,
  • We work through the least priviledge model,
  • We use encryption wherever possible,
  • Processes are thoroughly isolated,
  • The security is continuously monitored.

Server

  • The OS and software is updated every week (Thursdays, 22:00 - 23:59 CEST),
  • The storage on the server is fully encrypted (using AES-XTS-256),
  • The server solely runs Mastodon and the required stack, thus preventing additional attack surface.

Web front-end

  • Any plain-text (HTTP) traffic is redirected to the TLS secure counterpart (HTTPS),
  • TLS (or more specifically: TLSv1.2 and TLSv1.3) is used for transit encryption - with HSTS and robust ciphers,
  • OCSP stapling is enabled,
  • TLS session tickets are disabled (at least until Nginx fixes this properly).

Networking

  • The server itself is strictly firewalled (using pf(8)), both egress and ingress - on a daemon/service level,
  • Internal service communication is encrypted (eg: Mastodon is configured to connect to the local PostgreSQL server using TLS).

Etc

  • Backups are made every 24 hours, using a 'pull mechanism'. The Mastodon server does NOT have access to the backup repository,
  • SSH is hardened (PKI authentication, MFA via hardware tokens),
  • SSH ciphers are hardened.