docs: TLS audit offload bench-verified (poam-hardening-5bc6d27) — all gates passed

CLAUDE.md

@@ -291,17 +291,17 @@ instead of working around it.
   label (no allow rules). The dispatcher also now skips `lo` (was writing a spurious
   duplicate). **Toggle:** `secure_ntp=false` reverts the dispatcher to the legacy
   unauthenticated **DHCP option 42** path (plain `server <ip> iburst`).
-- TLS audit offload (2f → `serving/audit-collector`, gtls/6514, since
-  2026-07-12): the plaintext-514 path was bench-verified; the TLS upgrade is
-  NOT yet. On a booted host confirm the sender is ESTABLISHED to **:6514**
-  (not the legacy :514), records land in `audit-collector/logs/<ip>/`, and a
-  wrong CA is rejected (sender spools + logs a cert-validation error — proves
-  x509/name is enforced). Prereqs: collector cert issued
-  (`audit-collector/issue-cert.sh`, SAN = `audit.fleet.lab`, same step-ca as
-  the build's `fleet_ca`), 6514/tcp open on the boot NIC (host-networked —
-  same ufw trap as 514), image built with the real fleet CA. The three
-  `rsyslog_encrypt_offload_*` STIG rules are enforced (waivers dropped) and
-  must PASS in the report.
+- TLS audit offload (2f → `serving/audit-collector`, gtls/6514):
+  **BENCH-VERIFIED 2026-07-12** (build `poam-hardening-5bc6d27`, host
+  `comet-beacon-54`): sender on :6514 only, tcpdump shows no cleartext, an
+  evil-twin cert (same CN, wrong signer) is rejected `signer not found` with
+  lossless spool drain after restore, and the three `rsyslog_encrypt_offload_*`
+  STIG rules PASS (waivers dropped; full results in TODO #8). Per-deployment
+  prereqs remain: collector cert issued (`audit-collector/issue-cert.sh`,
+  SAN = `audit.fleet.lab`, same step-ca as the build's `fleet_ca`), 6514/tcp
+  open on the boot NIC (host-networked — same ufw trap as 514), image built
+  with the real fleet CA. Legacy plaintext :514 intake still open for pre-TLS
+  images — close it once the fleet is migrated.
 - `fleet` Plymouth theme: confirm (a) the script plugin package actually
   installed (`/usr/lib64/plymouth/script.so` — else the build fell back to
   `spinner`, logged as a WARNING), (b) the scripted theme + a font got bundled

docs/TODO.md

@@ -228,7 +228,8 @@ firewall, per-host/rotatable admin access. **Remote audit offload — WIRED both
 ends** (2026-06-19): receiver `serving/audit-collector/` (rsyslog TCP/514,
 per-source-host files) + sender in the image (provisioner 2f, `audit_host` var:
 audisp-syslog→LOCAL6 + rsyslog `omfwd` to `audit.fleet.lab`). **UPGRADED TO TLS
-2026-07-12** (gtls/6514, fleet-CA x509/name; see #8 — BENCH-VERIFY pending; the
+2026-07-12 AND BENCH-VERIFIED same day** (gtls/6514, fleet-CA x509/name; full
+results in #8 — incl. evil-twin rejection + lossless spool drain; the
 plaintext-era notes below record the original bring-up). **VERIFIED END-TO-END ON THE BENCH
 2026-06-19** — booted host `cygnus-cruiser-99` (192.168.50.148) forwards to the
 collector, which writes `audit-collector/logs/192.168.50.148/{audit,messages}.log`.
@@ -952,10 +953,11 @@ smoke test.
   secure `nvme connect` as the test path has.
 - **Future hardening waived for now** (from the STIG register): FIPS, firewall,
   per-host/rotatable admin (SSH CA / config-agent).
-- **[x] TLS-encrypted audit/log offload — IMPLEMENTED 2026-07-12 (awaiting
-  bench).** The host→collector hop is now syslog-over-TLS; the plaintext `2f`
-  forward and the three `rsyslog_encrypt_offload_*` waivers are gone. As built
-  (followed the original 5-step plan):
+- **[x] TLS-encrypted audit/log offload — VERIFIED ON THE BENCH 2026-07-12**
+  (build `poam-hardening-5bc6d27`, host `comet-beacon-54` 192.168.50.194 →
+  collector s3). The host→collector hop is now syslog-over-TLS; the plaintext
+  `2f` forward and the three `rsyslog_encrypt_offload_*` waivers are gone. As
+  built (followed the original 5-step plan):
   - **CA reused, not new:** the sender trusts the collector via the fleet CA
     already baked at `/etc/dot1x/radius-ca.pem` (`var.fleet_ca` — now the trust
     anchor for RADIUS EAP-TLS, fleet-agent AND log offload). Collector server
@@ -987,14 +989,24 @@ smoke test.
   - **Firewall:** serving host now needs **6514/tcp** open on the boot NIC
     (same host-networking trap as 514 — see audit-collector/README.md); the
     future workstation egress rule is 6514 too.
-  - **BENCH-VERIFY (the gate):** build with the real fleet CA + run
-    `issue-cert.sh` + `docker compose up -d --build audit`; on a booted host
-    confirm records land in `audit-collector/logs/<ip>/audit.log`, `ss -tnp`
-    on the serving host shows the sender ESTABLISHED to **:6514** (not :514),
-    a tcpdump of :6514 shows TLS (no cleartext syslog), a wrong/placeholder CA
-    is REJECTED (sender spools, `rsyslogd` logs a cert-validation error — proves
-    x509/name is actually enforced), and the STIG report shows the three
-    `rsyslog_encrypt_offload_*` rules PASS (0 new REVIEW rows).
+  - **BENCH RESULTS (all gates passed, 2026-07-12):** sender ESTABLISHED to
+    :6514 only (nothing on :514); records land in
+    `audit-collector/logs/192.168.50.194/audit.log` AND surface in Wazuh
+    (USER_CMD decoded, `staff_u:sysadm_r:sysadm_t` sudo confinement visible);
+    wire check clean (tcpdump canary: 31 packets, 0 cleartext matches, canary
+    decrypted only at the collector); **evil-twin rejected** — a self-signed
+    cert with the SAME CN (`audit.fleet.lab`) was refused with `certificate
+    invalid: signer not found`, the omfwd action suspended, and the spooled
+    record **drained losslessly** after the real cert was restored (original
+    timestamp preserved); STIG scan of record: all three
+    `rsyslog_encrypt_offload_*` rules **pass**, 401 pass / 1 fail, 0 new
+    REVIEW rows (the 1 remaining REVIEW is the pre-existing
+    `selinux_context_elevation_for_sudo` — runtime behaviour verified working
+    on the same host, likely an OVAL word-order artifact: the check may want
+    `ROLE=... TYPE=...` where 2c-STIG writes `TYPE=... ROLE=...` — follow-up).
+    Bench gotcha worth keeping: the smallstep password file location varies by
+    image version (`$STEPPATH/password` vs `$STEPPATH/secrets/password`) —
+    issue-cert.sh probes both (fixed 2026-07-12 after hitting it live).
   (RELP+TLS via `omrelp`/`imrelp` remains the alternative if guaranteed delivery
   is wanted alongside encryption.)
 - **fleet-hostapi: scope CORS to the kiosk origin.** The host-info agent ships

docs/stig-deviations.md

@@ -27,7 +27,7 @@ Posture decisions (2026-06-18, lab phase; offload updated 2026-07-12):
 | 3 | **AIDE / file integrity** (`package_aide_installed`, `aide_build_database`, `aide_periodic_cron_checking`, `aide_scan_notification`, `aide_verify_*`) | The root is read-only and cryptographically verified; an on-disk AIDE db would also be non-deterministic and break the reproducible verity hash. | **dm-verity** verifies the whole root filesystem against a signed root hash on every read — continuous, hardware-backed integrity that supersedes AIDE's periodic scan. |
 | 4 | **Firewall** (`service_firewalld_enabled`, `package_firewalld_installed`, `set_firewalld_default_zone`) | Currently `firewall --disabled`; auto-enabling firewalld/nftables risks the NVMe/TCP (`:4420`) and NetworkManager paths during bring-up. | Isolated boot LAN; egress controlled at the serving-stack / network firewall layer. **Future hardening** — re-enable with explicit allow rules once the secure path is verified. |
 | 5 | **FIPS** (`enable_fips_mode`, `grub2_enable_fips_mode`, `package_dracut-fips_installed`) | Decision: off for the lab phase (interacts with the still-unsigned UKI / Secure Boot story). | Revisit with signing. No weakened crypto is configured in the meantime. |
-| 6 | **Remote audit offload** (`auditd_audispd_configure_remote_server`, `..._encrypt_sent_records`, `..._network_failure_action`, `rsyslog_remote_loghost`) | Offload is done via **rsyslog over TLS** rather than the `audisp-remote` native protocol (simpler, container-friendly receiver), so the audisp-remote rules + `rsyslog_remote_loghost` (whose remediation would inject a bogus loghost) stay waived — the *intent* of all four is met by the rsyslog path. **The three `rsyslog_encrypt_offload_*` rules are NO LONGER waived** (re-selected 2026-07-12): the offload is now encrypted end-to-end and they are evaluated + expected to **pass** (rsyslog+rsyslog-gnutls installed before the scan; remediation writes the gtls/x509 globals). | **Wired both ends, TLS.** Sender (image, provisioner 2f, `audit_host`): audisp-syslog → LOCAL6 + rsyslog `omfwd` over **gtls :6514**, server verified `x509/name` against the baked fleet CA (`/etc/dot1x/radius-ca.pem`, `var.fleet_ca`), disk-assisted queue → host-generic `audit.fleet.lab`. Receiver: `serving/audit-collector/` (gtls listener :6514, server cert from the fleet step-ca via `issue-cert.sh`; legacy plaintext :514 kept only for pre-TLS images during migration — close it once the fleet is on TLS images). No client certs: hosts are fleet-generic (invariant #1 — a baked fleet-wide client key would be shared secret material), and client mTLS with the per-host **TPM identity was considered + deferred 2026-07-12** (redundant with 802.1X/MACsec on the secure path, which authenticates the same TPM credential at L2; rsyslog can't use a non-exportable TPM key without a delegated-cert or PKCS#11-tunnel contraption; hard-failing the forensic safety net on client-auth errors darkens exactly the hosts whose logs matter most — full rationale + revisit trigger in `serving/audit-collector/README.md`). Sender access constrained by the isolated boot LAN + serving-host firewall. No per-host state. |
+| 6 | **Remote audit offload** (`auditd_audispd_configure_remote_server`, `..._encrypt_sent_records`, `..._network_failure_action`, `rsyslog_remote_loghost`) | Offload is done via **rsyslog over TLS** rather than the `audisp-remote` native protocol (simpler, container-friendly receiver), so the audisp-remote rules + `rsyslog_remote_loghost` (whose remediation would inject a bogus loghost) stay waived — the *intent* of all four is met by the rsyslog path. **The three `rsyslog_encrypt_offload_*` rules are NO LONGER waived** (re-selected 2026-07-12): the offload is encrypted end-to-end and all three **pass** in the scan of record (build `poam-hardening-5bc6d27`; rsyslog+rsyslog-gnutls installed before the scan; remediation writes the gtls/x509 globals). Bench-verified same day incl. evil-twin rejection + lossless spool drain (TODO #8). | **Wired both ends, TLS.** Sender (image, provisioner 2f, `audit_host`): audisp-syslog → LOCAL6 + rsyslog `omfwd` over **gtls :6514**, server verified `x509/name` against the baked fleet CA (`/etc/dot1x/radius-ca.pem`, `var.fleet_ca`), disk-assisted queue → host-generic `audit.fleet.lab`. Receiver: `serving/audit-collector/` (gtls listener :6514, server cert from the fleet step-ca via `issue-cert.sh`; legacy plaintext :514 kept only for pre-TLS images during migration — close it once the fleet is on TLS images). No client certs: hosts are fleet-generic (invariant #1 — a baked fleet-wide client key would be shared secret material), and client mTLS with the per-host **TPM identity was considered + deferred 2026-07-12** (redundant with 802.1X/MACsec on the secure path, which authenticates the same TPM credential at L2; rsyslog can't use a non-exportable TPM key without a delegated-cert or PKCS#11-tunnel contraption; hard-failing the forensic safety net on client-auth errors darkens exactly the hosts whose logs matter most — full rationale + revisit trigger in `serving/audit-collector/README.md`). Sender access constrained by the isolated boot LAN + serving-host firewall. No per-host state. |
 | 7 | **Smart card login** (`require_smart_card_login`, `sssd_enable_smartcard`, `install_smartcard_packages`) | Diskless hosts have no smartcard reader; admin access is SSH key-based. Enforcing smartcard login would lock the host out. | Admin auth is an SSH **key-only** account; root is locked; password auth disabled. |
 | 8 | **NOPASSWD sudo** (`sudo_remove_nopasswd`) | The baked admin is a **passwordless, key-only** account, so `sudo` cannot prompt for a password — NOPASSWD is required for it to function at all. | Single fleet-generic admin, key-only, `wheel`; no interactive password exists to protect. Tracked for the eventual per-host/rotatable access model (SSH CA / config-agent). |
 | 9 | **GUI / autologin / GDM** (gnome screensaver, GDM banner, automatic-login rules) | No GNOME/GDM is installed; the kiosk is an **intentional** autologin single-app (weston + Chromium) session on kiosk builds. | Kiosk user is unprivileged and passwordless; the session runs a single locked-down browser (no shell, no nav). Applies to kiosk builds only; non-kiosk builds don't install the GUI stack. |