opsi-secure: Security hardening for Debian-based OPSI servers

Security in an OPSI environment is not a one-time setting but an ongoing process. This is especially true for Debian-based installations running in internal or public networks, where many default settings can be improved with relatively little effort.

That is exactly why we developed opsi-secure: it supports the targeted review and hardening of an OPSI installation on Debian in a transparent, traceable, and automated way. It is especially well suited for new installations, where security standards can be set cleanly and consistently from the beginning.

Why a dedicated security tool?

An OPSI environment consists of several components that work together: the server, the depot, Redis, WebDAV, Samba, and the related configuration. Some security measures are sensible but not always trivial: some changes only work together, others must be checked carefully first, and in production environments a backup before changes is essential.

With opsi-secure, we want to simplify these points:

• inventory and security checks for the relevant components
• careful planning of changes before implementation
• automatic backups before write operations
• clear confirmations instead of silent deletion without approval

This is particularly important when the environment is used in larger networks or in live production settings.

What does opsi-secure review and change?

opsi-secure is intentionally conservative. It first checks the current state of the system, analyzes the relevant settings, and then shows which security measures may be appropriate. Only after targeted review and confirmation are changes applied.

The relevant areas include, among others:

• WebDAV and Samba configuration
• Redis socket and Redis password
• disabling features that are unnecessary or incompatible
• checking depot overrides and cleaning them up safely
• backups and restoration of changes

At its core, the goal is to move a standard installation into a safer, better documented, and more controllable state without risking accidental changes to a running production environment.

A typical workflow

The operation is intentionally simple and transparent:

opsi-secure check
opsi-secure harden --dry-run
opsi-secure harden

The first step is always a review of the current state. After that, a preview of the planned measures can be checked. Only then changes are applied.

The --dry-run mode is especially useful here: it shows what would happen without actually modifying the environment.

Why this matters for OPSI

OPSI is frequently used in managed client environments, educational institutions, and production IT infrastructures. In those settings, a clean hardening baseline is not just a matter of “better default settings,” but a requirement for reliable and auditable operation.

With opsi-secure, administrators gain a structured entry point for improving the security of an OPSI installation without manually reviewing and implementing each setting individually.

Important: the script is deliberately careful

The tool is currently a focused security assistant rather than a complete, fully automated hardening solution. It aims to guide the most common and important steps securely and transparently, especially for new installations where the base can be established cleanly and consistently. In the current testing phase, the primary goal is to validate the security logic, checks, and rollback procedures in real operation.

This means in practice:

• no changes without confirmation for critical steps
• backups before write operations
• verifiable restore strategies
• no uncontrolled changes to default security settings in uncertain system states

That is exactly the right approach for serious system hardening: clean, transparent, and with clear security boundaries.

Conclusion

With opsi-secure, we have created a practical tool for everyday operations: it helps administrators systematically review Debian-based OPSI environments and apply targeted hardening without losing sight of security.

For administrators who want to make their OPSI servers more secure, this is a meaningful first step toward a more robust and better-documented security baseline.