Security hardening

Hardening the server, Odoo configuration, users and passwords, 2FA, network exposure, updates and audit.

In this lesson

Server hardening
Odoo configuration and user security
Audit and data protection

Key points

Patched OS, SSH keys, firewall 80/443, fail2ban, local PostgreSQL, unprivileged user
admin_passwd strong or manager off; list_db False; updates; remove unused modules
2FA for internal users; API keys for integrations; quarterly access review
Group-change logs (Odoo 20), encrypted backups, NDPA data inventory

Real-world example

A Lagos company's Odoo was found by a scanner with the database manager open and admin_passwd 'admin'. An attacker downloaded a backup. The incident response: rotate every credential, disable the manager, enforce 2FA, add fail2ban, notify the regulator as the NDPA requires for qualifying breaches, and review logs for further access.

Questions and answers

Why archive instead of delete users?

To keep history, ownership of records and audit trails.

Which Nigerian body regulates data protection?

The Nigeria Data Protection Commission (NDPC).

Read the full lesson, worked example and quiz