Overview

calmo.cloud checks every live and test Odoo service once a day for the most common production security problems and rates the result from A to F. Servers can run fail2ban to block brute-force logins, and the Security page shows where those attempts come from.

What it checks #

Security Insights runs a fixed catalogue of black-box checks against the platform hostname of each Odoo service and against its server's address. Nothing is installed inside your Odoo. The checks cover:

• Logins and data: does the default admin / admin login still work, is a private attachment reachable without logging in?
• Exposed endpoints: are the database manager, the database list or /website/info reachable from the internet, do error pages show Python tracebacks?
• Transport security: is HTTP redirected to HTTPS, is the certificate valid and strong, are TLS 1.0, TLS 1.1 and weak ciphers rejected, are HSTS and the other security headers set?
• Open ports: do PostgreSQL, Odoo's own ports, the Traefik dashboard or the Docker API answer from the internet?
• Server protection: is fail2ban active on the server, is the Odoo version still supported?

Services on calmo.cloud get the security headers and the blocks for the database manager and /website/info from their proxy, so most checks pass without you doing anything. For the full list, see Security Checks.

Score and grade #

Every service starts at 100 points. Each failed check deducts its points, and the grade follows the score alone:

A critical finding deducts 40 points, so one is enough for a D. A successful admin / admin login deducts all 100. Checks that could not be verified, for example because the database name is unknown, deduct nothing and mark the result as incomplete. If the login page itself is not reachable, the service gets no grade until it is.

Severity levels #

The severity of a check follows from its points:

How checks run #

• Checks run daily for every running live and test service. Demo systems, copies, preview deployments and coding-agent copies are not checked and get no rating. Login attempts on demo systems still count towards fail2ban bans.
• Click Run checks now on a service's Security tab to run the catalogue at any time. The checks run in the background and the tab shows the results within a minute or two.
• A check that cannot be verified does not overwrite a failure that was confirmed before.

The Security tab #

The Security tab of an Odoo service shows:

• the grade, the score out of 100 and when the service was last checked
• counters for checks that need attention (failed), need review (not verified or skipped), passed and not run
• every check with its result, the points it deducted and how to fix it; Check details shows what was observed, such as the certificate grade or the detected Odoo version

Failed checks are listed first, critical before warning. A badge on the Security tab shows how many checks are failing, coloured by the worst of them. Use Refresh or switch on Live refresh to update the page while you work on a fix.

Dashboard #

The Security Status widget on the dashboard summarizes your team:

• Rated A: how many of your checked Odoos have the best rating
• Needs attention: Odoos rated D or worse
• Protected servers: servers with fail2ban enabled
• Bans (24h): IP addresses banned in the last 24 hours, with the number of failed logins

Only your own Odoos count. Odoos another team shares with you are rated on that team's dashboard.

Fail2ban #

Fail2ban watches the SSH and Odoo logins on a server and blocks IP addresses that fail too often:

To enable it, open the server's settings, switch to the Fail2ban tab and turn it on, then redeploy the Odoo services on that server so their logins are watched. Fail2ban cannot be switched off again once it is installed. Provisioning templates have an Enable Fail2ban switch for new servers. Fail2ban metrics arrive through server metrics, so enable Telegraf on the server too.

The server resolves the addresses it sees to a country and city with a local copy of the DB-IP City Lite database. Only counts per country and city are sent to calmo.cloud. IP addresses never leave your server.

The Security page #

As soon as one of your servers has fail2ban enabled, Security appears in the panel menu. For a time range from one hour to 30 days, it shows:

• Protected servers, IP addresses currently banned, bans and failed logins
• Attack origins: an interactive globe with the countries failed logins come from, next to a list of those countries. Select a country in the list or on the globe to highlight it in both. Drag the globe to rotate it.
• Failed login attempts across all servers, split into SSH and Odoo logins
• Top attack sources: the top countries, cities and most attacked servers
• Odoo security ratings: every checked Odoo grouped by grade, worst first, each linking to its Security tab

The page refreshes when you click Refresh. Switch on Live refresh to update it every five minutes. Each server's Metrics page has a fail2ban section of its own, with failed logins by country.

Public Odoo Security Check #

The free Odoo Security Check runs the same catalogue against any Odoo you own or may test, including ones not hosted on calmo.cloud. It needs no account:

1. Enter the Odoo's address, for example odoo.example.com.
2. Optionally, under Additional checks, enter the database name if your Odoo hides it. The default-password and login-protection checks need it. The name is used for the checks only and is not stored.
3. Confirm that you own the Odoo or have the owner's permission, then click Check my Odoo.

The results appear check by check as they finish. They are kept for one hour and only your browser session can open them. There is no shareable link.

Two checks differ from the ones in the panel. The public check tests login brute-force protection with up to 50 failed logins from a random test account, and these attempts may show in your logs. Instead of that test, the panel checks that fail2ban is active on the service's server. The public check skips its port checks when the Odoo sits behind a CDN, because only the CDN would answer.

Fixing findings #

Each failed check says what was observed and how to fix it. The most common fixes:

• Default admin password: change the admin password in Odoo.
• Database manager or database list exposed: set list_db = False and a strong admin_passwd in the Odoo configuration and redeploy the service.
• Fail2ban not active: enable fail2ban in the server's settings, as described above.
• Odoo version not supported: plan the upgrade on a copy first.
• HTTPS, certificate or headers: check that the server's proxy and the service's certificate are healthy. See Adding a domain.

After fixing an issue, click Run checks now to confirm the finding has cleared.