Database Hardening, Edge Blocking, and Network Security

1. Overview & Business Value#

This comprehensive operational guide details the architecture, business workflows, configuration parameters, and execution steps for Database Hardening, Edge Blocking, and Network Security within SmartERP.

Infrastructure security ensures the SmartERP database cannot be enumerated, queried, or compromised from public internet networks.

Edge Nginx Hardening#

Public enumeration endpoints are permanently blocked at the Nginx edge proxy:

location ~* ^/(?:web/database|xmlrpc/2/db|jsonrpc/db) {
    return 404;
}

{screenshot:database-and-network-hardening-overview-dashboard}

2. Prerequisites & Security Access Groups#

• Required Modules: base, web, smarterp_security
• Security Groups:
  • Enterprise Security Officer (Technical ID: base.group_user)
  • Security Administrator (Technical ID: base.group_system)
• Master Data Dependencies: Established security group hierarchy, defined multi-company boundaries, and configured access control lists (ir.model.access.csv).

3. Step-by-Step Configuration & Execution#

Step 1: Navigating to the Module Interface#

1. Log into your SmartERP instance at https://smarterp.et/odoo.
2. Open the main App Switcher (grid icon in the top-left corner).
3. Select the Settings app icon.
4. From the top navigation bar, open Users & Companies → Users / Groups / Record Rules.

{screenshot:database-and-network-hardening-app-switcher-navigation}

Step 2: Creating and Parameterizing Records#

1. Click the New button in the top-left control panel.
2. Complete the mandatory fields in the security form:
   • Rule Name (Mandatory): Descriptive identifier for security rule.
   • Target Model (Mandatory): Underlying data model subject to access control.
   • Domain Filter (Mandatory): Logical Python domain expression enforcing row-level restriction.
3. Configure optional parameters: group assignment, global rule flags, and active state.

{screenshot:database-and-network-hardening-record-creation-form}

Step 3: Validating and Processing Transactions#

• Execution & Validation: Switch user context to test persona and verify query behavior.
• Log Verification: Confirm that restricted records are omitted from list and search views.

{screenshot:database-and-network-hardening-transaction-processing-state}

4. Advanced Configuration Points#

• Automated Actions & Scheduled Tasks (Crons):
  • Security: Audit log archival (base.ir_cron_audit_archive)
  • Security: Expire dormant sessions (base.ir_cron_session_expire)
• Custom Print Templates & Reports:
  • Role-Based Access Control (RBAC) Security Matrix
  • System Security & User Activity Audit Dossier
• Multi-Company Rules: Record-level security isolation under Company 1 (Ashewa Technology Solutions S.C.).

5. Comprehensive Troubleshooting Matrix#