Security hardening of RAP3 installations

[stefjoosten]

Since we have a working RAP3 repository installed at http://52.174.4.78/RAP3/ we can start thinking about consolidating the security measures required for rule repositories.

TODO list

• SSH configuration: prevent that outside users log in as daemon (nor as root) (see for example http://serverfault.com/questions/285800/how-to-disable-ssh-login-with-password-for-some-users/
• Apache: see https://httpd.apache.org/docs/trunk/misc/security_tips.html
• HTTPS-cookies need a flag "Secure", "HHTP-only", and "Samesite". This needs to be addressed in the Ampersand code; not in the deployment.

[Michiel-s]

Could we agree not to open RAP specific issues/topics/discussions in the Ampersand repo? Maybe good to (re)open this issue in the RAP repository

[Michiel-s]

Issue request copied to AmpersandTarski/RAP#20