sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs: cite clean build 28d31e4 for F-02 bench-verification

Browse Source 
F-02/P-17 SSH host certs re-verified on the rebuilt 28d31e4 image (not the
hand-fixed host): the auto-derived FQDN principal is baked, so by-FQDN no-TOFU
admin login survives a reboot with zero manual steps. Cite the digest in the
design-doc status + bench-outcome, SSP v0.4 status line + R-16 row, and Annex A
2.4 row + R-16 register row.
This commit is contained in:
Audiobuzz
2026-07-11 11:31:57 +00:00
parent f9f7c7c940
commit 0a3deca335
3 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ssp-annex-a-ism-residual-risk.md
+2 -2
View File
@@ -115,7 +115,7 @@ ISM/PSPF style). Ratings are **pre-treatment** unless stated; the AO accepts the
| Strong machine authentication | ISM-1546*, ISM-0974* | Mutual, certificate-based auth. | **802.1X EAP-TLS**, client key non-exportable in **TPM** (`0x81000100`), cert in TPM NV. The **management-plane agent reuses the same TPM identity** for mTLS (`RequireAndVerifyClientCert` to the fleet CA; server keys inventory off the verified cert serial). One non-exportable key = 802.1X + NVMe hostnqn + agent stream. | Partial | R-01 (not bench-verified; disabled in test builds), R-08 (placeholder CA), R-14 (mgmt plane = connected system) |
| Privileged access restricted | ISM-1507*, ISM-0445* | Limit & control admin access. | Single key-only `wheel` admin; root login disabled; admin **confined to `staff_u`** with a sudo `sysadm_r`/`sysadm_t` role/type transition (SELinux context elevates on privilege use). | Partial | R-05 |
| Secure remote administration | ISM-1506*, ISM-1232* | Hardened admin channel. | SSH **key-only**, password & keyboard-interactive off, hardened ciphers/MACs/KEX (STIG crypto policy; ECDSA/RSA keys — ed25519 excluded by policy). | Implemented | — |
| Administrative host-key trust (SSH host certs) | ISM-1506*, ISM-1091* | Admins can verify host identity (no persistent TOFU). | Ephemeral overlay ⇒ new sshd host keys each boot; each host's per-boot key is **signed into an OpenSSH host certificate by the fleet SSH CA** at boot, brokered via the **enrol-broker host plane** over **TPM-identity mTLS** (`fleet-ssh-hostcert`). Admins trust one **`@cert-authority`** line; step-ca stays behind the broker; client **fails open** to a bare key if unreachable (no admin lock-out). **Implemented + bench-verified 2026-07-11** (comet-beacon-54: FQDN login/no-TOFU, per-boot re-sign, SELinux clean). | Implemented | **R-16** |
| Administrative host-key trust (SSH host certs) | ISM-1506*, ISM-1091* | Admins can verify host identity (no persistent TOFU). | Ephemeral overlay ⇒ new sshd host keys each boot; each host's per-boot key is **signed into an OpenSSH host certificate by the fleet SSH CA** at boot, brokered via the **enrol-broker host plane** over **TPM-identity mTLS** (`fleet-ssh-hostcert`). Admins trust one **`@cert-authority`** line; step-ca stays behind the broker; client **fails open** to a bare key if unreachable (no admin lock-out). **Implemented + bench-verified 2026-07-11 on clean build `28d31e4`** (comet-beacon-54: FQDN login/no-TOFU, **survives reboot unattended**, SELinux clean). | Implemented | **R-16** |
| No default/shared credentials | ISM-1304* | No baked credentials. | No per-host secrets in any artifact; identity from TPM at runtime; `machine-id` empty; host keys regenerated at first boot. | Implemented | — |
| MFA for privileged users | ISM-1173*, ISM-1504* | MFA on privileged access. | Machine auth is cert+TPM (strong). **Human admin MFA on the management-plane UI now enforced via WebAuthn passkeys** (phishing-resistant, origin-bound, hardware-backed — the manager's admin plane, v0.3). Host **SSH** admin remains key-only (no separate human MFA). | Partial (host SSH) / Implemented (mgmt UI) | R-05 |
| Passwordless appliance accounts | — (STIG #10) | Account lockout/aging. | `kiosk`/`fleetadmin` are key-only; password aging/faillock **exempted for these two only**, full policy system-wide otherwise. | Implemented | R-05 (folds into rotatable-access roadmap) |
@@ -208,7 +208,7 @@ asked to accept. Treatments map to [docs/TODO.md](TODO.md) (working POA&M).
| **R-12** | **No formal Incident Response Plan**; volatile RAM overlay complicates live forensics. | 2.1, 2.6 (ISM-0043*/0109*) | Possible × Moderate → **Medium** | Inherent recovery (reboot → verified state; revert digest); centralised logs survive host wipe. | Author IRP + log-retention + break-glass/forensics procedure suited to stateless hosts. | **Low** | SecOps — *before production* |
| **R-14** | **Management/enrolment plane is a connected system, built but not yet separately authorised.** The host now trusts + streams to the fleet-manager and enrols via the broker + **step-ca fleet CA** (a new trust anchor + key material); the broker exposes **one unauthenticated pre-auth CSR endpoint**; InfluxDB holds telemetry + a bearer token. These server-side controls (CA key protection, broker hardening, admin-plane exposure, data-at-rest) are outside this SSP's boundary. | 2.4, 2.5, 2.6, 2.9 (ISM-1546*/1483*/0501*) | Possible × Moderate → **Medium** | Host-side exposure is limited: **outbound-only** mTLS, TPM-bound identity, **read-only** telemetry (no user data), and **commands logged-not-applied in v1**. Broker enrolment is human-anchored (OOB fingerprint + admin mTLS approve; no auto-approval). Mgmt-plane admin UI behind passkey MFA. | Author a **separate SSP/authorisation** for the management plane (CA key protection, broker endpoint hardening + rate-limiting, InfluxDB token/data protection, admin-plane network exposure); TLS everywhere is already in place on this plane. | **Low–Medium** | Platform/SecOps — *before the mgmt plane is production* |
| **R-15** | **Deferred agent reconcile actuators.** v1 receives `DesiredState`/`Command` but **only logs** them; when actuation (apply `kiosk_url` / `reboot` / drain) is built, `fleet-agent` becomes a **remote host-mutation channel**. | 2.5 (ISM-1483*/1509*) | Rare × Moderate → **Low** (v1) | v1 performs **no host mutation** — the receive path is inert; the command authZ path (server-authoritative desired-state, verified over mTLS) is designed but not exercised. | At build time, assess the command/authZ path (who can set desired-state, replay/authZ, blast radius of `reboot`/drain) before enabling actuators; keep it behind an explicit flag. | **Low** | Platform team — *at actuator build* |
| **R-16** | Per-boot SSH host keys made admin SSH **perpetual TOFU** — a host key can never be pinned, so a LAN MITM of admin SSH is client-undetectable. **Remediated 2026-07-11** (`poam-hardening`): broker-mediated **SSH host certificates**. | 2.4, 2.9 (ISM-1506*/1091*) | Possible × Moderate → **Medium** (pre-fix) | Each per-boot key is **signed by the fleet SSH CA** via the enrol-broker host plane (TPM-mTLS); admins trust one **`@cert-authority`** line; step-ca behind the single front door; client **fails open** to a bare key (no lock-out) if broker/CA unreachable. | **Bench-verified 2026-07-11** (comet-beacon-54: FQDN login/no-TOFU, per-boot re-sign across reboot, SELinux clean). Remaining: broker-side principal validation (defence-in-depth) + roll the `@cert-authority` anchor to admins. Design B deferred, not required. | **Low** | Platform team — *done; roll anchor* |
| **R-16** | Per-boot SSH host keys made admin SSH **perpetual TOFU** — a host key can never be pinned, so a LAN MITM of admin SSH is client-undetectable. **Remediated 2026-07-11** (`poam-hardening`): broker-mediated **SSH host certificates**. | 2.4, 2.9 (ISM-1506*/1091*) | Possible × Moderate → **Medium** (pre-fix) | Each per-boot key is **signed by the fleet SSH CA** via the enrol-broker host plane (TPM-mTLS); admins trust one **`@cert-authority`** line; step-ca behind the single front door; client **fails open** to a bare key (no lock-out) if broker/CA unreachable. | **Bench-verified 2026-07-11 on clean build `28d31e4`** (comet-beacon-54: FQDN login/no-TOFU, **survives reboot unattended** — auto-derived FQDN principal, not a manual edit; SELinux clean). Remaining: broker-side principal validation (defence-in-depth) + roll the `@cert-authority` anchor to admins. Design B deferred, not required. | **Low** | Platform team — *done; roll anchor* |
| **R-17** | **Time source was unauthenticated** (DHCP-handed NTP, no NTS) — an attacker spoofing DHCP/NTP could shift the clock to make expired/revoked certs validate (time feeds EAP-TLS, agent mTLS, future log TLS). **Remediated 2026-07-11** (`secure-ntp`): **NTS (RFC 8915)**. | 2.9 (ISM-1453*/1139*) | Possible × Moderate → **Low–Medium** (pre-fix) | Serving NTP presents a **fleet-CA-signed** NTS-KE cert; host (`secure_ntp=true`) verifies against `radius-ca.pem` and **no longer mixes in** the unauthenticated DHCP source; server name derived from the DHCP domain (no baked FQDN). A spoofer can only **DoS**, not shift time. Compensating meanwhile: isolated LAN + cert-serial inventory gate. | **Bench-verify** `chronyc authdata` NTS cookies, tcp/4460, cold-clock `nocerttimecheck`, STIG chrony compat; issue the per-environment NTS server cert (F-03/P-18 M3). | **Low** | Platform team — *bench-verify* |
### 3.1 Risk heatmap (post-treatment targets)