Pen Test 2022

Doc from Bill to attach? Or not?

Cluster: test.omnivore.com.au

Setup:

• Empty database, 1 default admin user (see BootStrap.groovy)
• Deployed latest build 1.285
• Cloned All That Digi and CityBeachSoftware stores from m1
• Imported products
• Created a few test orders
• Created user account linked to All That Digi: username: tester, password: Tester123!@#
• Created api client:
  clientId = QlL0dSEVd7uWT49dSHzxy33VN7Xe5Msf
  secret: VsstGcs3exi0CvVqW2VAKwCOTOjzt2wD
• apt-get update

  apt-get upgrade

• 
  

Reviewed crypto setup for nginx: /etc/nginx/sites-available/omnivore.com.au

It seems to have strong settings presumably from last pen test findings.

It also seems to have some additions related to clamav that I don't recognize. (Sep 22 2021)

Reviewed firewall setup. Found squid running and added to firewall. Disable?

Review nginx sites-enabled, only omnivore is enabled at this time.

~