File size: 2,453 Bytes
79ea999 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 |
#!/bin/bash
# Security Check Script
# Validates security configuration and provides security recommendations
set -e
echo "============================================================"
echo "Security Configuration Check"
echo "============================================================"
# Check OMP_NUM_THREADS
if [ -z "$OMP_NUM_THREADS" ]; then
echo "⚠️ WARNING: OMP_NUM_THREADS not set"
elif ! [[ "$OMP_NUM_THREADS" =~ ^[0-9]+$ ]] || [ "$OMP_NUM_THREADS" -le 0 ]; then
echo "❌ ERROR: OMP_NUM_THREADS is invalid: $OMP_NUM_THREADS"
else
echo "✅ OMP_NUM_THREADS: $OMP_NUM_THREADS"
fi
# Check HF_TOKEN
if [ -z "$HF_TOKEN" ]; then
echo "❌ ERROR: HF_TOKEN not set"
else
echo "✅ HF_TOKEN is set"
fi
# Check rate limiting
if [ "$RATE_LIMIT_ENABLED" != "false" ]; then
echo "✅ Rate limiting enabled"
else
echo "⚠️ WARNING: Rate limiting disabled (not recommended for production)"
fi
# Check log directory
if [ -d "$LOG_DIR" ]; then
echo "✅ Log directory exists: $LOG_DIR"
if [ -w "$LOG_DIR" ]; then
echo "✅ Log directory is writable"
else
echo "⚠️ WARNING: Log directory is not writable"
fi
else
echo "⚠️ WARNING: Log directory does not exist: ${LOG_DIR:-/tmp/logs}"
fi
# Check if running with Gunicorn
if pgrep -f "gunicorn" > /dev/null; then
echo "✅ Running with Gunicorn (production server)"
else
if pgrep -f "flask_api_standalone.py" > /dev/null; then
echo "⚠️ WARNING: Running with Flask dev server (not recommended for production)"
else
echo "ℹ️ Application not running"
fi
fi
# Check security headers (if app is running)
if curl -s -I http://localhost:7860/api/health > /dev/null 2>&1; then
echo ""
echo "Checking security headers..."
headers=$(curl -s -I http://localhost:7860/api/health)
required_headers=(
"X-Content-Type-Options"
"X-Frame-Options"
"X-XSS-Protection"
"Strict-Transport-Security"
"Content-Security-Policy"
)
for header in "${required_headers[@]}"; do
if echo "$headers" | grep -qi "$header"; then
echo "✅ $header present"
else
echo "⚠️ WARNING: $header missing"
fi
done
fi
echo ""
echo "============================================================"
echo "Security Check Complete"
echo "============================================================"
|