Improve analytics data aggregation security and reliability

Enhance security by removing hardcoded paths, implementing a wrapper script for manual execution, and adding robust credential validation in the analytics aggregator.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 7a657272-55ba-4a79-9a2e-f1ed9bc7a528
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 47661cde-4285-4ce6-8d00-fb236a5a01b7
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/449cf7c4-c97a-45ae-8234-e5c5b8d6a84f/7a657272-55ba-4a79-9a2e-f1ed9bc7a528/oGXAoP7

.replit

@@ -14,6 +14,10 @@ run = ["npm", "run", "start"]
 localPort = 5000
 externalPort = 80
 
+[[ports]]
+localPort = 40793
+externalPort = 3001
+
 [[ports]]
 localPort = 41303
 externalPort = 3002

deployment/run_analytics.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+#
+# IDS Analytics Aggregator - Manual Execution Wrapper
+# Carica credenziali da .env e esegue aggregazione
+#
+# Usage:
+#   ./run_analytics.sh hourly
+#   ./run_analytics.sh daily
+#
+
+set -e
+
+# Verifica parametro
+if [ "$#" -ne 1 ]; then
+    echo "Usage: $0 {hourly|daily}"
+    exit 1
+fi
+
+MODE=$1
+
+# Verifica modo valido
+if [ "$MODE" != "hourly" ] && [ "$MODE" != "daily" ]; then
+    echo "Errore: modo deve essere 'hourly' o 'daily'"
+    exit 1
+fi
+
+# Directory IDS
+IDS_DIR="/opt/ids"
+ENV_FILE="$IDS_DIR/.env"
+SCRIPT="$IDS_DIR/python_ml/analytics_aggregator.py"
+VENV="$IDS_DIR/venv/bin/python3"
+
+# Verifica file .env esiste
+if [ ! -f "$ENV_FILE" ]; then
+    echo "Errore: File $ENV_FILE non trovato!"
+    exit 1
+fi
+
+# Verifica permessi .env (deve essere readable solo da owner)
+ENV_PERMS=$(stat -c %a "$ENV_FILE")
+if [ "$ENV_PERMS" != "600" ] && [ "$ENV_PERMS" != "400" ]; then
+    echo "Attenzione: $ENV_FILE dovrebbe avere permessi 600 (rw-------)"
+    echo "Esegui: chmod 600 $ENV_FILE"
+fi
+
+# Carica variabili d'ambiente e esegui aggregatore
+echo "🔄 Esecuzione aggregazione $MODE..."
+
+# Export variabili da .env
+set -a
+source "$ENV_FILE"
+set +a
+
+# Esegui come user ids con venv
+if [ "$(whoami)" = "ids" ]; then
+    # Già user ids
+    "$VENV" "$SCRIPT" "$MODE"
+else
+    # Switch a user ids
+    sudo -u ids -E "$VENV" "$SCRIPT" "$MODE"
+fi
+
+echo "✅ Aggregazione $MODE completata!"

python_ml/analytics_aggregator.py

@@ -18,9 +18,14 @@ class AnalyticsAggregator:
     """
     Aggregatore analytics per traffico normale + attacchi
     Salva statistiche permanenti in network_analytics
+    
+    SECURITY: Richiede variabili d'ambiente per credenziali DB.
+    - Production: Gestite da systemd EnvironmentFile
+    - Manual: Usare script wrapper run_analytics.sh
     """
     
     def __init__(self):
+        # Leggi credenziali da variabili d'ambiente (iniettate da systemd o wrapper)
         self.db_params = {
             'host': os.getenv('PGHOST', 'localhost'),
             'port': int(os.getenv('PGPORT', 5432)),
@@ -29,6 +34,19 @@ class AnalyticsAggregator:
             'password': os.getenv('PGPASSWORD', ''),
         }
         
+        # Fail-fast: verifica credenziali obbligatorie
+        missing = []
+        for key in ['PGHOST', 'PGDATABASE', 'PGUSER', 'PGPASSWORD']:
+            if not os.getenv(key):
+                missing.append(key)
+        
+        if missing:
+            raise ValueError(
+                f"Credenziali database mancanti: {', '.join(missing)}\n"
+                f"Esecuzione manuale: usa ./deployment/run_analytics.sh\n"
+                f"Systemd: verifica EnvironmentFile in ids-analytics-aggregator.service"
+            )
+    
     def get_connection(self):
         """Crea connessione database"""
         return psycopg2.connect(**self.db_params)

replit.md

@@ -50,7 +50,7 @@ The IDS employs a React-based frontend for real-time monitoring, detection visua
 
 ## Recent Updates (Novembre 2025)
 
-### 📊 Network Analytics & Dashboard System (22 Nov 2025 - 15:00)
+### 📊 Network Analytics & Dashboard System (24 Nov 2025 - 11:30)
 - **Feature Completa**: Sistema analytics con traffico normale + attacchi, visualizzazioni grafiche avanzate, dati permanenti
 - **Componenti**:
   1. **Database**: `network_analytics` table con aggregazioni orarie/giornaliere permanenti
@@ -61,6 +61,8 @@ The IDS employs a React-based frontend for real-time monitoring, detection visua
 - **Grafici**: Area Chart, Pie Chart, Bar Chart, Line Chart, Real-time Stream
 - **Flag Emoji**: 🇮🇹🇺🇸🇷🇺🇨🇳 per identificazione immediata paese origine
 - **Deploy**: Migration 005 + `./deployment/setup_analytics_timer.sh`
+- **Security Fix**: Rimosso hardcoded path, implementato wrapper script sicuro `run_analytics.sh` per esecuzioni manuali
+- **Production-grade**: Credenziali gestite via systemd EnvironmentFile (automatico) o wrapper script (manuale)
 
 ### 🌍 IP Geolocation Integration (22 Nov 2025 - 13:00)
 - **Feature**: Informazioni geografiche complete (paese, città, organizzazione, AS) per ogni IP