sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs: TLS audit offload bench-verified (poam-hardening-5bc6d27) — all gates passed

Browse Source
This commit is contained in:
Audiobuzz
2026-07-12 06:28:18 +00:00
parent 4fe6a5ae16
commit 0fc54c64b7
3 changed files with 37 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+11 -11
View File
@@ -291,17 +291,17 @@ instead of working around it.
label (no allow rules). The dispatcher also now skips `lo` (was writing a spurious
duplicate). **Toggle:** `secure_ntp=false` reverts the dispatcher to the legacy
unauthenticated **DHCP option 42** path (plain `server <ip> iburst`).
- TLS audit offload (2f → `serving/audit-collector`, gtls/6514, since
2026-07-12): the plaintext-514 path was bench-verified; the TLS upgrade is
NOT yet. On a booted host confirm the sender is ESTABLISHED to **:6514**
(not the legacy :514), records land in `audit-collector/logs/<ip>/`, and a
wrong CA is rejected (sender spools + logs a cert-validation error — proves
x509/name is enforced). Prereqs: collector cert issued
(`audit-collector/issue-cert.sh`, SAN = `audit.fleet.lab`, same step-ca as
the build's `fleet_ca`), 6514/tcp open on the boot NIC (host-networked —
same ufw trap as 514), image built with the real fleet CA. The three
`rsyslog_encrypt_offload_*` STIG rules are enforced (waivers dropped) and
must PASS in the report.
- TLS audit offload (2f → `serving/audit-collector`, gtls/6514):
**BENCH-VERIFIED 2026-07-12** (build `poam-hardening-5bc6d27`, host
`comet-beacon-54`): sender on :6514 only, tcpdump shows no cleartext, an
evil-twin cert (same CN, wrong signer) is rejected `signer not found` with
lossless spool drain after restore, and the three `rsyslog_encrypt_offload_*`
STIG rules PASS (waivers dropped; full results in TODO #8). Per-deployment
prereqs remain: collector cert issued (`audit-collector/issue-cert.sh`,
SAN = `audit.fleet.lab`, same step-ca as the build's `fleet_ca`), 6514/tcp
open on the boot NIC (host-networked — same ufw trap as 514), image built
with the real fleet CA. Legacy plaintext :514 intake still open for pre-TLS
images — close it once the fleet is migrated.
- `fleet` Plymouth theme: confirm (a) the script plugin package actually
installed (`/usr/lib64/plymouth/script.so` — else the build fell back to
`spinner`, logged as a WARNING), (b) the scripted theme + a font got bundled