Security hardening checklist

Management Server

• Use HTTPS with a certificate issued by a trusted internal or public CA.
• Restrict TCP 8443 to approved administrator networks and enrolled node IPs.
• Use a unique local administrator password and store it in an approved password manager.
• Configure LDAP/AD with LDAPS, a least-privilege bind identity, and an authorization group.
• Rotate the node enrollment token after suspected exposure and re-enroll affected nodes.
• Protect /etc/axiom/axiom.toml, TLS keys, license state, and backups.
• Review Global Audit Log, node delivery state, and Support diagnostics regularly.

SMB Proxy Node

• Deny direct client-to-file-server TCP 445 at the firewall.
• Allow backend TCP 445 only from approved SMB node IPs.
• Keep IPv4 forwarding disabled.
• Limit TCP 9443 to the Management Server.
• Keep SSH limited to administration networks.
• Start new detection logic in Monitor mode, review evidence, then move selected rules to Block.
• Validate known_bad blocking with a harmless fixture after every material upgrade.
• Monitor disk usage for /var/log/axiom and define retention appropriate to policy.

DNS Security Node

• Limit inbound UDP/TCP 53 to approved client, DC, or resolver networks.
• Limit upstream egress to configured resolver IPs and ports.
• Review every threat-feed source before enabling it.
• Maintain an explicit allow path and rollback process for false positives.
• Keep category controls disabled until a trusted category database is configured.
• Validate UDP and TCP DNS, local records, and AD functionality after policy changes.

Air-gap handling

• Move installers, activation files, license files, and policy imports through an approved transfer station.
• Verify file hashes and signatures before import.
• Keep the license private signing key outside customer environments.
• Document who moved each artifact, when, and for which system.

Operational principle

A security event in a dashboard is not proof of enforcement by itself. Validate the client outcome, the node log, the backend state, and the Management event together.