`DW-Agents/dw-agents/agent-security/README.md`

99 lines
# Security Agent

System security monitoring and management for DW-Agents infrastructure.

## Overview

The Security Agent continuously monitors the server's security status and automatically reports critical issues to the Needs Attention agent for immediate action.

## Features

- **System Security Monitoring**
  - Security updates detection
  - Firewall status monitoring
  - Failed login attempt tracking
  - SSL certificate expiration monitoring
  - Port scanning detection
  - System uptime tracking

- **Automated Response**
  - Hourly security scans
  - Automatic reporting of critical/high severity issues to Needs Attention agent
  - Issue tracking and resolution management
  - Real-time dashboard

- **Security Checks**
  - Available security updates
  - UFW firewall status
  - Recent failed login attempts in auth logs
  - SSL certificate expiration dates
  - Open ports and dangerous services (Telnet, FTP, SMB, RDP, VNC)

## Access

- **Port:** 9892
- **External:** http://45.61.58.125:9892
- **Local:** http://localhost:9892

## Authentication

- **Username:** admin2025
- **Password:** Otis

## API Endpoints

- `POST /api/scan` - Run security scan manually
- `GET /api/stats` - Get security statistics
- `GET /api/issues` - Get active security issues
- `POST /api/issues/:id/resolve` - Mark issue as resolved
- `POST /api/issues/:id/report` - Report issue to Needs Attention agent

## Integration

The Security Agent automatically integrates with:

- **Needs Attention Agent (Port 9886)** - Receives critical and high severity security alerts
- **Master Hub (Port 9893)** - Listed as a monitored agent

## Running the Agent

```bash
cd /root/DW-Agents/agent-security
npx tsx security-agent.ts
```

Or use PM2 for production:

```bash
pm2 start security-agent.ts --name security-agent --interpreter npx --interpreter-args tsx
pm2 save
```

## Security Issue Severity Levels

- **Critical** - Immediate action required (e.g., dangerous ports open, SSL expiring in < 7 days)
- **High** - Urgent attention needed (e.g., firewall inactive, many failed logins)
- **Medium** - Should be addressed soon (e.g., security updates available)
- **Low** - Monitor and address when convenient

## Auto-Reporting

Issues with **Critical** or **High** severity are automatically reported to the Needs Attention agent (Port 9886) for immediate visibility.

## Dashboard Features

- Real-time security statistics
- Active security issues by severity
- System uptime and connection metrics
- One-click issue resolution
- Manual security scan trigger
- Auto-refresh every 5 minutes

## Created

November 8, 2025

## Part of DW-Agents System

Unified authentication across all agents: admin2025 / Otis