sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs: TLS audit offload bench-verified (poam-hardening-5bc6d27) — all gates passed

Browse Source
This commit is contained in:
Audiobuzz
2026-07-12 06:28:18 +00:00
parent 4fe6a5ae16
commit 0fc54c64b7
3 changed files with 37 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/TODO.md
+25 -13
View File
@@ -228,7 +228,8 @@ firewall, per-host/rotatable admin access. **Remote audit offload — WIRED both
ends** (2026-06-19): receiver `serving/audit-collector/` (rsyslog TCP/514,
per-source-host files) + sender in the image (provisioner 2f, `audit_host` var:
audisp-syslog→LOCAL6 + rsyslog `omfwd` to `audit.fleet.lab`). **UPGRADED TO TLS
2026-07-12** (gtls/6514, fleet-CA x509/name; see #8 — BENCH-VERIFY pending; the
2026-07-12 AND BENCH-VERIFIED same day** (gtls/6514, fleet-CA x509/name; full
results in #8 — incl. evil-twin rejection + lossless spool drain; the
plaintext-era notes below record the original bring-up). **VERIFIED END-TO-END ON THE BENCH
2026-06-19** — booted host `cygnus-cruiser-99` (192.168.50.148) forwards to the
collector, which writes `audit-collector/logs/192.168.50.148/{audit,messages}.log`.
@@ -952,10 +953,11 @@ smoke test.
secure `nvme connect` as the test path has.
- **Future hardening waived for now** (from the STIG register): FIPS, firewall,
per-host/rotatable admin (SSH CA / config-agent).
- **[x] TLS-encrypted audit/log offload — IMPLEMENTED 2026-07-12 (awaiting
bench).** The host→collector hop is now syslog-over-TLS; the plaintext `2f`
forward and the three `rsyslog_encrypt_offload_*` waivers are gone. As built
(followed the original 5-step plan):
- **[x] TLS-encrypted audit/log offload — VERIFIED ON THE BENCH 2026-07-12**
(build `poam-hardening-5bc6d27`, host `comet-beacon-54` 192.168.50.194 →
collector s3). The host→collector hop is now syslog-over-TLS; the plaintext
`2f` forward and the three `rsyslog_encrypt_offload_*` waivers are gone. As
built (followed the original 5-step plan):
- **CA reused, not new:** the sender trusts the collector via the fleet CA
already baked at `/etc/dot1x/radius-ca.pem` (`var.fleet_ca` — now the trust
anchor for RADIUS EAP-TLS, fleet-agent AND log offload). Collector server
@@ -987,14 +989,24 @@ smoke test.
- **Firewall:** serving host now needs **6514/tcp** open on the boot NIC
(same host-networking trap as 514 — see audit-collector/README.md); the
future workstation egress rule is 6514 too.
- **BENCH-VERIFY (the gate):** build with the real fleet CA + run
`issue-cert.sh` + `docker compose up -d --build audit`; on a booted host
confirm records land in `audit-collector/logs/<ip>/audit.log`, `ss -tnp`
on the serving host shows the sender ESTABLISHED to **:6514** (not :514),
a tcpdump of :6514 shows TLS (no cleartext syslog), a wrong/placeholder CA
is REJECTED (sender spools, `rsyslogd` logs a cert-validation error — proves
x509/name is actually enforced), and the STIG report shows the three
`rsyslog_encrypt_offload_*` rules PASS (0 new REVIEW rows).
- **BENCH RESULTS (all gates passed, 2026-07-12):** sender ESTABLISHED to
:6514 only (nothing on :514); records land in
`audit-collector/logs/192.168.50.194/audit.log` AND surface in Wazuh
(USER_CMD decoded, `staff_u:sysadm_r:sysadm_t` sudo confinement visible);
wire check clean (tcpdump canary: 31 packets, 0 cleartext matches, canary
decrypted only at the collector); **evil-twin rejected** — a self-signed
cert with the SAME CN (`audit.fleet.lab`) was refused with `certificate
invalid: signer not found`, the omfwd action suspended, and the spooled
record **drained losslessly** after the real cert was restored (original
timestamp preserved); STIG scan of record: all three
`rsyslog_encrypt_offload_*` rules **pass**, 401 pass / 1 fail, 0 new
REVIEW rows (the 1 remaining REVIEW is the pre-existing
`selinux_context_elevation_for_sudo` — runtime behaviour verified working
on the same host, likely an OVAL word-order artifact: the check may want
`ROLE=... TYPE=...` where 2c-STIG writes `TYPE=... ROLE=...` — follow-up).
Bench gotcha worth keeping: the smallstep password file location varies by
image version (`$STEPPATH/password` vs `$STEPPATH/secrets/password`) —
issue-cert.sh probes both (fixed 2026-07-12 after hitting it live).
(RELP+TLS via `omrelp`/`imrelp` remains the alternative if guaranteed delivery
is wanted alongside encryption.)
- **fleet-hostapi: scope CORS to the kiosk origin.** The host-info agent ships