Security

A checklist to harden an Antimatter server: what to expose, the limits and privacy settings to review, the outside services the server contacts, and how to report a security problem.

What to expose

The site's compose file also runs every container with no-new-privileges, runs Antimatter as an unprivileged user on a distroless image, and runs the GIF service with a read-only file system. The database, the storage and the GIF service sit on a network without Internet access.

Checklist after installing

1. Create the first administrator account before anyone else can reach the server (Installing).
2. Serve Antimatter over HTTPS only, and set the site URL to the https:// address (Domain and HTTPS).
3. Keep .env, config.json and TLS keys readable by root (or the server's user) only: chmod 600 .env.
4. Decide who can create accounts, keep Enable Open Server off unless the community is public, and turn on Require Email Verification once email works (Sign-in and accounts).
5. Turn on multi-factor authentication, and enforce it for administrators' accounts at least, or use your identity provider's.
6. Review the outside connections below, in particular the STUN server Calls uses by default.
7. Before adding model connections, set the AI encryption key (AM_AI_ENCRYPTION_KEY) and keep a copy apart from the database backups (AI).
8. Back up, and test a restore (Backups and upgrades).
9. Keep the images or the packages up to date: security fixes arrive with new versions.

Rate limiting

The server can limit how many API requests each client makes. It is off by default. In System Console › Environment › Rate Limiting:

Behind a proxy, limits by address only work if the server knows each client's address (ServiceSettings.TrustedProxyIPHeader and ServiceSettings.TrustedProxyIPs, see Client addresses behind a proxy). Otherwise every request seems to come from the proxy, and everyone shares one limit. The same goes for IP filtering and for the addresses in audit logs.

Sign-in attempts are limited separately: Maximum Login Attempts (10) locks an account after that many failed passwords.

IP filtering

System Console › Site Configuration › IP Filtering limits access to the server by IP address, with allow and deny rules (an address or a CIDR range each). With Enable IP Filtering on, people whose address matches a deny rule, or no allow rule when there are allow rules, can't reach the server. The page refuses rules that would block your own address. Behind a proxy, set up client addresses first (Client addresses behind a proxy): otherwise every request seems to come from the proxy.

Uploads and file sharing

Antimatter doesn't scan uploads for malware.

Privacy settings

In System Console › Site Configuration › Users and Teams:

Ignoring, blocking and message requests

With Enable ignoring, blocking and message requests on (the default), people can ignore and block each other, and choose whether direct messages from people they don't know arrive normally, wait as message requests, or are refused outright (someone refused can't start a direct or group message with them, or write in one not yet accepted); each choice can differ per community, and the most restrictive of the communities people share wins. This suits public communities. In a workplace where colleagues must always be able to reach each other, turn it off (AM_PRIVACYSETTINGS_ENABLEUSERBLOCKING=false): none of these direct-message choices are enforced any more, but the lists and choices people made are kept, and apply again if you turn it back on. Which profile details each community's people see is enforced either way; system admins and the person themself always see everything.

Sessions and tokens

• Session lengths and idle timeout: see Sign-in and accounts. Shorter sessions mean a lost laptop or phone stays signed in for less time.
• Enable Personal Access Tokens (ServiceSettings.EnableUserAccessTokens, off) lets people create API tokens; Maximum Personal Access Token Lifetime (days) limits them. Both are in System Console › Integrations › Integration Management.
• To sign everyone out at once, for example after a suspected breach: Revoke All Sessions in System Console › User Management › Users.
• In Antimatter's interface, people are warned of a new sign-in to their own account while they are connected, and can disconnect it themselves (see Where you are signed in). System admins aren't told of other people's sign-ins.
• The Calendar app's private calendar feed link (see Mail and Calendar) is a capability: anyone who has it can read what its owner can see, so it ends up in your reverse proxy's access logs. Only its hash is stored on the server, so a leaked log entry alone doesn't expose it.

Connections to outside services

Antimatter contacts no service run by Mattermost, Inc. It sends no telemetry, crash reports or security update checks, and fetches no product notices. A configuration brought over from Mattermost that still names one of Mattermost's services (its push services, its app marketplace, its notices or its STUN server for calls) doesn't make the server contact them: those addresses are ignored.

The server and the apps connect to other outside services only for the features that need them, and to the services you configure:

By default the server refuses to connect to private and loopback addresses for these (link previews, webhooks, apps, community model connections), so a message or an integration can't be used to reach your internal network. List the internal hosts it may reach in Allow untrusted internal connections to (ServiceSettings.AllowedUntrustedInternalConnections, in System Console › Environment › Developer); the site's compose file lists gifs there.

Reporting a vulnerability

Report security problems privately, as explained in the Antimatter security policy, not in public issues.