sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs: TLS audit offload bench-verified (poam-hardening-5bc6d27) — all gates passed

Browse Source
This commit is contained in:
Audiobuzz
2026-07-12 06:28:18 +00:00
parent 4fe6a5ae16
commit 0fc54c64b7
3 changed files with 37 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/TODO.md
+25 -13
View File
@@ -228,7 +228,8 @@ firewall, per-host/rotatable admin access. **Remote audit offload — WIRED both
ends** (2026-06-19): receiver `serving/audit-collector/` (rsyslog TCP/514,
per-source-host files) + sender in the image (provisioner 2f, `audit_host` var:
audisp-syslog→LOCAL6 + rsyslog `omfwd` to `audit.fleet.lab`). **UPGRADED TO TLS
2026-07-12** (gtls/6514, fleet-CA x509/name; see #8 — BENCH-VERIFY pending; the
2026-07-12 AND BENCH-VERIFIED same day** (gtls/6514, fleet-CA x509/name; full
results in #8 — incl. evil-twin rejection + lossless spool drain; the
plaintext-era notes below record the original bring-up). **VERIFIED END-TO-END ON THE BENCH
2026-06-19** — booted host `cygnus-cruiser-99` (192.168.50.148) forwards to the
collector, which writes `audit-collector/logs/192.168.50.148/{audit,messages}.log`.
@@ -952,10 +953,11 @@ smoke test.
secure `nvme connect` as the test path has.
- **Future hardening waived for now** (from the STIG register): FIPS, firewall,
per-host/rotatable admin (SSH CA / config-agent).
- **[x] TLS-encrypted audit/log offload — IMPLEMENTED 2026-07-12 (awaiting
bench).** The host→collector hop is now syslog-over-TLS; the plaintext `2f`
forward and the three `rsyslog_encrypt_offload_*` waivers are gone. As built
(followed the original 5-step plan):
- **[x] TLS-encrypted audit/log offload — VERIFIED ON THE BENCH 2026-07-12**
(build `poam-hardening-5bc6d27`, host `comet-beacon-54` 192.168.50.194 →
collector s3). The host→collector hop is now syslog-over-TLS; the plaintext
`2f` forward and the three `rsyslog_encrypt_offload_*` waivers are gone. As
built (followed the original 5-step plan):
- **CA reused, not new:** the sender trusts the collector via the fleet CA
already baked at `/etc/dot1x/radius-ca.pem` (`var.fleet_ca` — now the trust
anchor for RADIUS EAP-TLS, fleet-agent AND log offload). Collector server
@@ -987,14 +989,24 @@ smoke test.
- **Firewall:** serving host now needs **6514/tcp** open on the boot NIC
(same host-networking trap as 514 — see audit-collector/README.md); the
future workstation egress rule is 6514 too.
- **BENCH-VERIFY (the gate):** build with the real fleet CA + run
`issue-cert.sh` + `docker compose up -d --build audit`; on a booted host
confirm records land in `audit-collector/logs/<ip>/audit.log`, `ss -tnp`
on the serving host shows the sender ESTABLISHED to **:6514** (not :514),
a tcpdump of :6514 shows TLS (no cleartext syslog), a wrong/placeholder CA
is REJECTED (sender spools, `rsyslogd` logs a cert-validation error — proves
x509/name is actually enforced), and the STIG report shows the three
`rsyslog_encrypt_offload_*` rules PASS (0 new REVIEW rows).
- **BENCH RESULTS (all gates passed, 2026-07-12):** sender ESTABLISHED to
:6514 only (nothing on :514); records land in
`audit-collector/logs/192.168.50.194/audit.log` AND surface in Wazuh
(USER_CMD decoded, `staff_u:sysadm_r:sysadm_t` sudo confinement visible);
wire check clean (tcpdump canary: 31 packets, 0 cleartext matches, canary
decrypted only at the collector); **evil-twin rejected** — a self-signed
cert with the SAME CN (`audit.fleet.lab`) was refused with `certificate
invalid: signer not found`, the omfwd action suspended, and the spooled
record **drained losslessly** after the real cert was restored (original
timestamp preserved); STIG scan of record: all three
`rsyslog_encrypt_offload_*` rules **pass**, 401 pass / 1 fail, 0 new
REVIEW rows (the 1 remaining REVIEW is the pre-existing
`selinux_context_elevation_for_sudo` — runtime behaviour verified working
on the same host, likely an OVAL word-order artifact: the check may want
`ROLE=... TYPE=...` where 2c-STIG writes `TYPE=... ROLE=...` — follow-up).
Bench gotcha worth keeping: the smallstep password file location varies by
image version (`$STEPPATH/password` vs `$STEPPATH/secrets/password`) —
issue-cert.sh probes both (fixed 2026-07-12 after hitting it live).
(RELP+TLS via `omrelp`/`imrelp` remains the alternative if guaranteed delivery
is wanted alongside encryption.)
- **fleet-hostapi: scope CORS to the kiosk origin.** The host-info agent ships
docs/stig-deviations.md
+1 -1
View File
@@ -27,7 +27,7 @@ Posture decisions (2026-06-18, lab phase; offload updated 2026-07-12):
| 3 | **AIDE / file integrity** (`package_aide_installed`, `aide_build_database`, `aide_periodic_cron_checking`, `aide_scan_notification`, `aide_verify_*`) | The root is read-only and cryptographically verified; an on-disk AIDE db would also be non-deterministic and break the reproducible verity hash. | **dm-verity** verifies the whole root filesystem against a signed root hash on every read — continuous, hardware-backed integrity that supersedes AIDE's periodic scan. |
| 4 | **Firewall** (`service_firewalld_enabled`, `package_firewalld_installed`, `set_firewalld_default_zone`) | Currently `firewall --disabled`; auto-enabling firewalld/nftables risks the NVMe/TCP (`:4420`) and NetworkManager paths during bring-up. | Isolated boot LAN; egress controlled at the serving-stack / network firewall layer. **Future hardening** — re-enable with explicit allow rules once the secure path is verified. |
| 5 | **FIPS** (`enable_fips_mode`, `grub2_enable_fips_mode`, `package_dracut-fips_installed`) | Decision: off for the lab phase (interacts with the still-unsigned UKI / Secure Boot story). | Revisit with signing. No weakened crypto is configured in the meantime. |
| 6 | **Remote audit offload** (`auditd_audispd_configure_remote_server`, `..._encrypt_sent_records`, `..._network_failure_action`, `rsyslog_remote_loghost`) | Offload is done via **rsyslog over TLS** rather than the `audisp-remote` native protocol (simpler, container-friendly receiver), so the audisp-remote rules + `rsyslog_remote_loghost` (whose remediation would inject a bogus loghost) stay waived — the *intent* of all four is met by the rsyslog path. **The three `rsyslog_encrypt_offload_*` rules are NO LONGER waived** (re-selected 2026-07-12): the offload is now encrypted end-to-end and they are evaluated + expected to **pass** (rsyslog+rsyslog-gnutls installed before the scan; remediation writes the gtls/x509 globals). | **Wired both ends, TLS.** Sender (image, provisioner 2f, `audit_host`): audisp-syslog → LOCAL6 + rsyslog `omfwd` over **gtls :6514**, server verified `x509/name` against the baked fleet CA (`/etc/dot1x/radius-ca.pem`, `var.fleet_ca`), disk-assisted queue → host-generic `audit.fleet.lab`. Receiver: `serving/audit-collector/` (gtls listener :6514, server cert from the fleet step-ca via `issue-cert.sh`; legacy plaintext :514 kept only for pre-TLS images during migration — close it once the fleet is on TLS images). No client certs: hosts are fleet-generic (invariant #1 — a baked fleet-wide client key would be shared secret material), and client mTLS with the per-host **TPM identity was considered + deferred 2026-07-12** (redundant with 802.1X/MACsec on the secure path, which authenticates the same TPM credential at L2; rsyslog can't use a non-exportable TPM key without a delegated-cert or PKCS#11-tunnel contraption; hard-failing the forensic safety net on client-auth errors darkens exactly the hosts whose logs matter most — full rationale + revisit trigger in `serving/audit-collector/README.md`). Sender access constrained by the isolated boot LAN + serving-host firewall. No per-host state. |
| 6 | **Remote audit offload** (`auditd_audispd_configure_remote_server`, `..._encrypt_sent_records`, `..._network_failure_action`, `rsyslog_remote_loghost`) | Offload is done via **rsyslog over TLS** rather than the `audisp-remote` native protocol (simpler, container-friendly receiver), so the audisp-remote rules + `rsyslog_remote_loghost` (whose remediation would inject a bogus loghost) stay waived — the *intent* of all four is met by the rsyslog path. **The three `rsyslog_encrypt_offload_*` rules are NO LONGER waived** (re-selected 2026-07-12): the offload is encrypted end-to-end and all three **pass** in the scan of record (build `poam-hardening-5bc6d27`; rsyslog+rsyslog-gnutls installed before the scan; remediation writes the gtls/x509 globals). Bench-verified same day incl. evil-twin rejection + lossless spool drain (TODO #8). | **Wired both ends, TLS.** Sender (image, provisioner 2f, `audit_host`): audisp-syslog → LOCAL6 + rsyslog `omfwd` over **gtls :6514**, server verified `x509/name` against the baked fleet CA (`/etc/dot1x/radius-ca.pem`, `var.fleet_ca`), disk-assisted queue → host-generic `audit.fleet.lab`. Receiver: `serving/audit-collector/` (gtls listener :6514, server cert from the fleet step-ca via `issue-cert.sh`; legacy plaintext :514 kept only for pre-TLS images during migration — close it once the fleet is on TLS images). No client certs: hosts are fleet-generic (invariant #1 — a baked fleet-wide client key would be shared secret material), and client mTLS with the per-host **TPM identity was considered + deferred 2026-07-12** (redundant with 802.1X/MACsec on the secure path, which authenticates the same TPM credential at L2; rsyslog can't use a non-exportable TPM key without a delegated-cert or PKCS#11-tunnel contraption; hard-failing the forensic safety net on client-auth errors darkens exactly the hosts whose logs matter most — full rationale + revisit trigger in `serving/audit-collector/README.md`). Sender access constrained by the isolated boot LAN + serving-host firewall. No per-host state. |
| 7 | **Smart card login** (`require_smart_card_login`, `sssd_enable_smartcard`, `install_smartcard_packages`) | Diskless hosts have no smartcard reader; admin access is SSH key-based. Enforcing smartcard login would lock the host out. | Admin auth is an SSH **key-only** account; root is locked; password auth disabled. |
| 8 | **NOPASSWD sudo** (`sudo_remove_nopasswd`) | The baked admin is a **passwordless, key-only** account, so `sudo` cannot prompt for a password — NOPASSWD is required for it to function at all. | Single fleet-generic admin, key-only, `wheel`; no interactive password exists to protect. Tracked for the eventual per-host/rotatable access model (SSH CA / config-agent). |
| 9 | **GUI / autologin / GDM** (gnome screensaver, GDM banner, automatic-login rules) | No GNOME/GDM is installed; the kiosk is an **intentional** autologin single-app (weston + Chromium) session on kiosk builds. | Kiosk user is unprivileged and passwordless; the session runs a single locked-down browser (no shell, no nav). Applies to kiosk builds only; non-kiosk builds don't install the GUI stack. |