> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://helpdesk.ggcircuit.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# 🔐 ggRock Security

This article outlines the key security considerations you should take into account when planning to integrate ggRock into your infrastructure.

---

## 🧱 Infrastructure Exposure

There are two primary ways ggRock can potentially expose your environment:

1. **Required network ports** — These must be open for proper operation.
2. **ggRock application access** — If someone gains access to the UI or API backend, they could potentially misuse it.

---

## 🌐 Required Network Ports

Below is a list of ports required for a standard ggRock installation:

| Port | Protocol | Usage |
| ---- |
| 22 | TCP | SSH |
| 69 | UDP | TFTP |
| 80 | TCP | HTTP |
| 443 | TCP | HTTPS |
| 3260 | TCP | iSCSI |
| 4011 | UDP | ProxyDHCP |
| 9090 | TCP | Debian Control Panel |
| 9100 | TCP | Prometheus Node Exporter (stats collection) |

💡 **Tip:**  
Refer to **ggRock IPTABLES Firewall Configuration** for guidance on securing your server with its built-in firewall.

---

### 🔁 Port Forwarding Consideration

When ggRock is used as the **default gateway** for client PCs, it will forward external traffic to your main LAN gateway. In this setup, any ports you intend to expose to the internet must also be opened in the local firewall.

---

## 🛡️ Recommended Network Mitigations

* Use an **external VPN** with IP whitelisting to control remote access to the network hosting ggRock.
* If remote access to the ggRock app is **not** required, limit access to **LAN-only**.

---

## ⚙️ ggRock Application Security

The ggRock application includes Linux and Python scripts, along with a C# .NET Core backend — all tightly integrated.

* All **closed-source components** (excluding `ggrock-linux-configurator`) are encrypted and obfuscated for both **security** and **DRM** purposes.
* Application access is protected by an **Identity system** with a single admin account gating all functionality.
* As of now, ggRock has **no known or intended methods** of remote code execution that could be used maliciously — even with administrative access.

---

## 🔐 Application Access Mitigations

* Follow **password best practices** for the ggRock administrator account.
* For server administration:

* Use a **non-elevated user** account whenever possible.
* Avoid sharing or using **root credentials** unless absolutely necessary. 

---