Adding rsyslog tls

2026-07-12 14:04:19 +09:30
parent 28d31e436c
commit 5bc6d27f77
13 changed files with 542 additions and 135 deletions
@@ -32,7 +32,10 @@ flipped back for a secure/production build (consolidated as item #8):
  assigns a stable creative starship name per MAC (e.g. `nebula-vanguard-07`) via
  DHCP option 12 + DNS A/PTR. Host picks it up on next DHCP renewal/reboot.
 - **Serving `.env`:** must set `AUDIT_HOST=audit.fleet.lab` (+ `docker compose up
-  -d dnsmasq` to reload) for remote log offload to resolve/flow.
+  -d dnsmasq` to reload) for remote log offload to resolve/flow. Since the TLS
+  upgrade (#8, 2026-07-12) the collector also needs its server cert issued
+  (`audit-collector/issue-cert.sh`) + 6514/tcp open on the boot NIC, and the
+  image must be built with the real fleet CA (`fleet_ca`) or senders spool.

 What's working/verified vs awaiting bench is per-item below. Cross-cutting
 bench-verify checklist lives in `CLAUDE.md` → "Known bench-verify items".
@@ -152,7 +155,8 @@ was incomplete:**
  non-approved algo and would re-fail a STIG rule; prefer the ECDSA key.)
 - **rsyslog TLS-offload rules waived (lab):** `rsyslog_encrypt_offload_*` force
  gtls+x509+CA and broke the plaintext `2f` forward → unselected in the
-  tailoring; production TLS offload tracked under #8.
+  tailoring; production TLS offload tracked under #8. **(DONE 2026-07-12 — 2f is
+  now gtls/6514 and the three waivers are dropped; see #8.)**
 - Diagnosis tooling notes: SMBIOS cmdline-extra works only after a Proxmox VM
  **stop/start** (not `reset`); the debug-shell-on-tty2 never came up — the
  decisive diagnosis was **offline `rootfs.erofs` mount** + `ssh -vvv` +
@@ -205,8 +209,9 @@ Remaining (future hardening, currently waived — see the register): FIPS,
 firewall, per-host/rotatable admin access. **Remote audit offload — WIRED both
 ends** (2026-06-19): receiver `serving/audit-collector/` (rsyslog TCP/514,
 per-source-host files) + sender in the image (provisioner 2f, `audit_host` var:
-audisp-syslog→LOCAL6 + rsyslog `omfwd` to `audit.fleet.lab`). Lab is plaintext;
-TLS/RELP is the remaining hardening. **VERIFIED END-TO-END ON THE BENCH
+audisp-syslog→LOCAL6 + rsyslog `omfwd` to `audit.fleet.lab`). **UPGRADED TO TLS
+2026-07-12** (gtls/6514, fleet-CA x509/name; see #8 — BENCH-VERIFY pending; the
+plaintext-era notes below record the original bring-up). **VERIFIED END-TO-END ON THE BENCH
 2026-06-19** — booted host `cygnus-cruiser-99` (192.168.50.148) forwards to the
 collector, which writes `audit-collector/logs/192.168.50.148/{audit,messages}.log`.
 **Serving-host firewall gotcha hit + fixed:** the collector is host-networked so
@@ -218,7 +223,7 @@ sender's `action.resumeRetryCount="-1"` buffered the backlog and drained on
 reconnect — no records lost. Documented in
 [../serving/audit-collector/README.md](../serving/audit-collector/README.md).
 When the **workstation** firewall is re-enabled (#4 / register #4) it needs the
-reciprocal **egress** allow for 514/tcp to the collector.
+reciprocal **egress** allow for 6514/tcp (TLS; was 514/tcp) to the collector.

 **SIEM (Wazuh) added 2026-06-27 — [serving/siem/](../serving/siem/).** Upgrades the
 "Detect" pillar from file-collection-only to parse/search/correlate/alert.
@@ -241,7 +246,10 @@ and a live `sudo` on a booted host (`cygnus-cruiser-99`) surfaced `USER_CMD` →
 rule `100130` and `CRED_*`/`USER_ACCT` → rule `100110` (level 5) in the dashboard
 Threat Hunting view. Wazuh runs multi-node on `wazuh1.bitasylum.org`.
 **REMAINING (prod):** the relay→wazuh1 hop is **plaintext** — **TLS it** (gtls/6514,
-fleet CA; ISM protect-logs-in-transit) since it's now on the wire; rotate all Wazuh
+fleet CA; ISM protect-logs-in-transit) since it's now on the wire (NB: the
+host→collector hop is TLS since 2026-07-12, #8 — this is the separate
+collector→wazuh1 hop, and the collector-side `omfwd` must stay/`ptcp` until
+wazuh1 has a TLS listener); rotate all Wazuh
 creds; restrict dashboard/API to admin hosts; set `allowed-ips`→/32 of the serving
 host; ISM retention/archival; then update the SSP "Detect" + ISM event-logging
 controls.
@@ -917,28 +925,51 @@ smoke test.
  secure `nvme connect` as the test path has.
 - **Future hardening waived for now** (from the STIG register): FIPS, firewall,
  per-host/rotatable admin (SSH CA / config-agent).
- **TLS-encrypted audit/log offload (production).** The lab forwards logs to
-  `serving/audit-collector` in **plaintext**, and the STIG TLS-offload rules
-  (`rsyslog_encrypt_offload_defaultnetstreamdriver`,
-  `..._actionsendstreamdrivermode`, `..._actionsendstreamdriverauthmode`) are
-  **waived** in the tailoring because applying them forces `gtls` + x509 peer
-  auth + a CA file and breaks the plaintext `2f` forward. For production, do it
-  properly and DROP the waivers:
-  1. Stand up a CA (or reuse the boot-infra CA); issue the collector a server
-     cert (CN/SAN = `audit.fleet.lab`).
-  2. Configure the collector's rsyslog for TLS: `imtcp` with
-     `StreamDriver.Name="gtls"`, `StreamDriver.Mode="1"`, server cert/key + CA;
-     listen on the syslog-TLS port (6514) — add a TLS receiver to
-     `serving/audit-collector/rsyslog.conf` + compose.
-  3. Bundle the CA into the image (host-generic, no per-host state — same model
-     as the RADIUS CA) and point `$DefaultNetstreamDriverCAFile` at it.
-  4. Set the `2f` `omfwd` action to `StreamDriver="gtls" StreamDriverMode="1"
-     StreamDriverAuthMode="x509/name"` + the CA file, target port 6514.
-  5. Re-select the three `rsyslog_encrypt_offload_*` rules (remove from
-     `files/stig/diskless-tailoring.xml`) — they should then PASS, and update
-     `docs/stig-deviations.md` #6 to reflect encrypted offload.
-  (RELP+TLS via `omrelp`/`imrelp` is the alternative if guaranteed delivery is
-  wanted alongside encryption.)
+- **[x] TLS-encrypted audit/log offload — IMPLEMENTED 2026-07-12 (awaiting
+  bench).** The host→collector hop is now syslog-over-TLS; the plaintext `2f`
+  forward and the three `rsyslog_encrypt_offload_*` waivers are gone. As built
+  (followed the original 5-step plan):
+  - **CA reused, not new:** the sender trusts the collector via the fleet CA
+    already baked at `/etc/dot1x/radius-ca.pem` (`var.fleet_ca` — now the trust
+    anchor for RADIUS EAP-TLS, fleet-agent AND log offload). Collector server
+    cert (SAN = `${AUDIT_HOST}`) issued from the bench step-ca by
+    `serving/audit-collector/issue-cert.sh` → `tls/` (gitignored), mounted at
+    `/etc/rsyslog-tls`; renew by re-running it (720h default — expiry shows as
+    handshake errors + senders spooling).
+  - **Collector** (`serving/audit-collector/`): gtls listener on **6514**
+    (per-listener `streamDriver.*` params; `authMode="anon"` — hosts carry NO
+    client cert: fleet-generic, invariant #1; client mTLS with the TPM identity
+    was CONSIDERED + DEFERRED 2026-07-12 — rationale + revisit trigger in
+    audit-collector/README.md "Decision: no client mTLS"). Plaintext :514 kept as a LEGACY
+    listener for pre-TLS images during migration — close it once the fleet is on
+    TLS images. Deliberately no global `DefaultNetstreamDriver="gtls"` (would
+    silently flip the plaintext wazuh1 relay `omfwd` to TLS and break it).
+    Alpine image needs `rsyslog-tls` (ships `lmnsd_gtls.so`; verified v3.20).
+  - **Sender (2f):** `omfwd` → `$AUDIT_HOST:6514`, `StreamDriver="gtls"` mode 1
+    `StreamDriverAuthMode="x509/name"` + `StreamDriverPermittedPeers=$AUDIT_HOST`,
+    CA via `global(DefaultNetstreamDriverCAFile="/etc/dot1x/radius-ca.pem")`.
+    With the placeholder CA the handshake can't succeed → action suspends and the
+    disk-assisted queue spools (same lab posture as RADIUS). `rsyslog` +
+    `rsyslog-gnutls` moved to the step-2 baseline install so they're present at
+    STIG-scan time.
+  - **STIG:** the three `rsyslog_encrypt_offload_*` selects removed from
+    `files/stig/diskless-tailoring.xml` (rules now evaluated; SSG remediation
+    writes the legacy gtls/x509 globals, eval of record should PASS);
+    register #6 rewritten (encrypted offload; audisp-remote rules +
+    `rsyslog_remote_loghost` stay waived — intent met via rsyslog).
+  - **Firewall:** serving host now needs **6514/tcp** open on the boot NIC
+    (same host-networking trap as 514 — see audit-collector/README.md); the
+    future workstation egress rule is 6514 too.
+  - **BENCH-VERIFY (the gate):** build with the real fleet CA + run
+    `issue-cert.sh` + `docker compose up -d --build audit`; on a booted host
+    confirm records land in `audit-collector/logs/<ip>/audit.log`, `ss -tnp`
+    on the serving host shows the sender ESTABLISHED to **:6514** (not :514),
+    a tcpdump of :6514 shows TLS (no cleartext syslog), a wrong/placeholder CA
+    is REJECTED (sender spools, `rsyslogd` logs a cert-validation error — proves
+    x509/name is actually enforced), and the STIG report shows the three
+    `rsyslog_encrypt_offload_*` rules PASS (0 new REVIEW rows).
+  (RELP+TLS via `omrelp`/`imrelp` remains the alternative if guaranteed delivery
+  is wanted alongside encryption.)
 - **fleet-hostapi: scope CORS to the kiosk origin.** The host-info agent ships
  with `FLEET_HOSTAPI_ALLOW_ORIGIN=*` (lab). For prod set it to the exact kiosk
  origin (default `http://boot.fleet.lab`) via the unit's commented
@@ -0,0 +1,186 @@
+# OQE Collection Plan — Automated Objective Quality Evidence for the IRAP Assessment
+
+> **Protective marking:** `STARFLEET RESTRICTED — CLEARANCE LEVEL 2 — BRIDGE CREW / SECURITY DIVISION`
+> *(marking scheme per the [SAR](irap-sar.md) banner.)*
+>
+> **Status:** working plan (v0.1, 2026-07-11) — recorded from assessor guidance;
+> not yet implemented. Companion to the [SAR](irap-sar.md) and
+> [POA&M](irap-poam.md); feeds the continuous-monitoring plan (POA&M P-08 M2)
+> and the delta-assessment witness points (SAR §7.2).
+
+## 1. Purpose
+
+Define how Objective Quality Evidence (OQE) for the assessment is captured
+**automatically**, so that control effectiveness is demonstrated by
+machine-collected, attributable artifacts rather than screenshots and prose
+assertions — and so the delta assessment (and later, ongoing authorisation)
+can sample and re-verify evidence instead of regenerating it by hand.
+
+This system is unusually well-positioned for automated OQE because it already
+has the three prerequisites:
+
+1. **A digest that uniquely names the thing being assessed** (one release =
+   one OCI digest = one manifest commit).
+2. **An authenticated channel from every host** (`fleet-agent` over TPM-mTLS —
+   evidence is cryptographically attributable to a specific hardware host).
+3. **A CI pipeline that produces the security-relevant state** (signing, STIG
+   scan, verity coupling, content assertions).
+
+## 2. What makes an artifact OQE
+
+Every evidence artifact must answer four questions **without a human
+interpreting it**:
+
+| Question | Requirement |
+|---|---|
+| **What** does it demonstrate? | Mapped to a control/claim (ISM control ID + SSP/Annex A row + POA&M milestone). |
+| **Which** system produced it? | Exact attribution: OCI digest for builds; host serial (TPM cert serial) for hosts — never "the test box". |
+| **When** was it captured? | Timestamp from the authenticated time source (NTS, post-P-18). |
+| **How** was it produced? | The collection method is **in-repo and inspectable** — the assessor reads the collector before trusting its output. |
+
+Evidence strength ordering (prefer higher): **signed attestation** > raw
+command output with attribution > screenshot/prose assertion. Automation
+removes the human from the capture path — but only if the automation itself is
+auditable.
+
+## 3. The four collection planes
+
+### 3.1 Build-time evidence — attached to the OCI artifact
+
+CI already produces most of it. Formalise into a per-build **evidence bundle**,
+emitted as a CI artifact and (target state) attached to the OCI image as a
+**signed attestation** (cosign/in-toto via the registry referrers API), so OQE
+is *keyed to the digest*: assessing release `sha256:abc…` means pulling its
+evidence chain from the registry.
+
+| Evidence | Source | Exists today? |
+|---|---|---|
+| STIG ARF + HTML report + deviations register (0 unjustified REVIEW) | CI artifacts (`stig-report.html`, `stig-arf.xml`, `stig-deviations.md`) | Yes |
+| roothash coupling (UKI cmdline ↔ `verity.json`) | `build-oci.sh` hard gate result | Yes (gate; log it) |
+| Initramfs content assertions (drivers, module, nvmf unit, NM hook) | `lsinitrd` assertions in the template | Yes (assert; capture listing) |
+| SELinux labels survived export | `getfattr` build assertion | Yes (assert; capture output) |
+| UKI + iPXE signature verification | `sbverify` output | Add |
+| Extracted (immutable) cmdline + its hash | `extract-artifacts.sh` dump | Add |
+| RPM manifest (+ size manifest) | `rpm -qa` dump (size manifest exists) | Partial |
+| Reproducibility proof | second build → identical `verity.json` root hash | Add (CI job) |
+| Production-profile assertion (which toggles/gates were active) | CI Production build gate output | Partial (gate exists — emit a machine-readable record) |
+| Signed provenance over the whole bundle | cosign/in-toto attestation on the OCI image | Add (target state) |
+
+Supports: SAR §7.2 items 2 and 7; POA&M P-03 M2 (profile-tagged artifacts),
+P-04 M2, P-05.
+
+### 3.2 Bench evidence — the harness emits structured results
+
+Bench gates are witnessed live, but the harness should capture as it runs: a
+**JSON results file per run** — each pass criterion with its raw output,
+stamped with host serial, UKI digest, and timestamps. The assessor verifies the
+harness once, watches one live run, and keeps the bundle.
+
+| Bench gate | Captured criteria (raw outputs) | POA&M |
+|---|---|---|
+| Secure path (802.1X/MACsec) | `wpa_cli status` = `Authorized`; `ip macsec show`; macsec0 DHCP + renewal journal lines; `nvme list-subsys` (targeted NQN); supplicant PID alive post-switch-root | P-01 |
+| Application control | novel non-RPM binary in `/tmp` → fapolicyd `FAN_DENY` audit record | SAR §7.2(7) |
+| Device control | USB mass-storage block event (LinuxAudit) + console HID still functional | SAR §7.2(7) |
+| SSH host certificates | `ssh -v` host-cert offer; `@cert-authority` validation; broker signing log line | P-17 M3 |
+| Authenticated time | `chronyc authdata` (NTS cookies present); tcp/4460 handshake; cold-clock `nocerttimecheck` path | P-18 M3 |
+| Agent actuators inert | desired-state/command received → log-only, no mutation | P-23 / SAR §7.2(7) |
+
+### 3.3 Runtime/continuous evidence — the fleet-agent as evidence pipeline
+
+The agent already streams SELinux state, chrony health, image version, and
+cert serial over TPM-mTLS — continuous, hardware-attributed OQE for those
+controls. Extending it per POA&M P-21 (SAR F-07) makes the InfluxDB store a
+rolling posture record: **every host, hourly, attributed to its TPM.**
+
+Facts to add (P-21): Secure Boot state (`SecureBoot` EFI var), fapolicyd
+enforcement mode, kernel cmdline hash, USBGuard status.
+
+This time-series **is** the substance of the continuous-monitoring plan (P-08
+M2) and the ongoing-authorisation story; its retention follows the P-08/P-09
+log-retention policy so the evidence itself survives. It also provides
+machine-checkable closure for other items — e.g. P-05 M2 closes when telemetry
+shows `mokutil --sb-state` = enabled for 100% of enrolled hosts.
+
+### 3.4 Detect-pillar evidence — synthetic control tests
+
+Exercise the detection path on a schedule and record the result: a probe runs
+`sudo` on a canary host, then confirms the `USER_CMD` event (a) landed in the
+collector's per-host file and (b) fired the Wazuh `fleet_audit` rule, within N
+seconds. Log each probe result. A control tested weekly with recorded outcomes
+is far stronger OQE than "the rule existed at assessment time."
+
+Supports: Annex A §2.6 rows; POA&M P-09.
+
+## 4. The mapping layer (where automation usually fails)
+
+Evidence without a control map is a folder of files. Maintain a
+machine-readable matrix in-repo — `docs/oqe-matrix.yaml` (to be scaffolded) —
+one row per claim:
+
+```yaml
+- id: OQE-013
+  control: ISM-1542            # key against the ACSC OSCAL ISM edition
+  claim: "Only fleet-signed UKIs boot under Secure Boot"   # SSP/Annex A row
+  plane: build                  # build | bench | runtime | detect
+  collector: "sbverify --cert fleet-db.pem fleet-<ver>.efi"
+  frequency: per-build
+  closes: P-05                  # POA&M milestone this evidences
+```
+
+Two decisions recorded with it:
+
+1. **Key controls against the ACSC OSCAL edition of the ISM.** The ISM is
+   published in OSCAL; stable machine-readable identifiers per release make the
+   May-2026 renumbering reconciliation (P-10) a computable diff instead of a
+   manual crosswalk.
+2. **Define closure evidence per POA&M milestone.** Each M-milestone states
+   its machine-checkable "done" signal in the matrix, so POA&M status stops
+   being self-asserted.
+
+## 5. Integrity and chain of custody
+
+Evidence about a security system is itself a target. Proportionate measures at
+this classification:
+
+- **Build evidence:** covered by the CI attestation signature (target state);
+  until then, SHA256 manifests of each bundle **committed to git** — the
+  one-commit-per-release convention makes git history the tamper-evident
+  ledger.
+- **Runtime evidence:** inherently attributed by the agent's mTLS session +
+  TPM-bound identity.
+- **Bench bundles:** hashed into a committed manifest per run.
+- **Timestamps:** ride the NTS-verified clock (P-18).
+- Storage: append-only files on the collector + committed manifests. An
+  elaborate WORM store is **not** proportionate at STARFLEET RESTRICTED.
+
+## 6. What the assessor still does in person
+
+Automation changes the character of the SAR §7.2 witness points, it does not
+replace them. At the delta assessment the assessor will:
+
+1. **Read the collectors** — confirm they measure what they claim.
+2. **Watch one live run** of each critical bench (P-01 above all).
+3. **Independently re-run a sample** of collection commands and diff against
+   the automated bundles.
+
+If the automated evidence survives that sampling, everything it produced
+*between* assessments is credible — which is what makes ongoing authorisation
+cheap instead of an annual re-assessment.
+
+## 7. Implementation backlog (feeds TODO.md / POA&M)
+
+| # | Task | Plane | Pairs with |
+|---|---|---|---|
+| O-1 | CI `evidence` job: bundle existing artifacts + add `sbverify`/cmdline/rpm-manifest dumps; emit machine-readable production-gate record | Build | P-03 M2 |
+| O-2 | Reproducibility CI job (double build, compare root hash) | Build | SAR §7.2(7) |
+| O-3 | Signed attestation on the OCI image (cosign/in-toto, referrers API) | Build | P-03 M2 |
+| O-4 | Bench harness structured JSON output (`serving/dot1x-bench/` first) | Bench | P-01 |
+| O-5 | Agent posture facts: SB state, fapolicyd mode, cmdline hash, USBGuard | Runtime | P-21 |
+| O-6 | Synthetic detect probe (canary `sudo` → collector file + Wazuh alert, scheduled) | Detect | P-09 |
+| O-7 | Scaffold `docs/oqe-matrix.yaml` from current POA&M rows; adopt OSCAL ISM keys | Mapping | P-10, P-08 M2 |
+| O-8 | Define closure-evidence signal for every open POA&M milestone in the matrix | Mapping | all |
+
+---
+
+*End of OQE collection plan. Review alongside the POA&M at each monthly
+review; promote O-items into TODO.md as they are scheduled.*
@@ -26,7 +26,7 @@ Posture decisions (2026-06-18, lab phase):
 | 3 | **AIDE / file integrity** (`package_aide_installed`, `aide_build_database`, `aide_periodic_cron_checking`, `aide_scan_notification`, `aide_verify_*`) | The root is read-only and cryptographically verified; an on-disk AIDE db would also be non-deterministic and break the reproducible verity hash. | **dm-verity** verifies the whole root filesystem against a signed root hash on every read — continuous, hardware-backed integrity that supersedes AIDE's periodic scan. |
 | 4 | **Firewall** (`service_firewalld_enabled`, `package_firewalld_installed`, `set_firewalld_default_zone`) | Currently `firewall --disabled`; auto-enabling firewalld/nftables risks the NVMe/TCP (`:4420`) and NetworkManager paths during bring-up. | Isolated boot LAN; egress controlled at the serving-stack / network firewall layer. **Future hardening** — re-enable with explicit allow rules once the secure path is verified. |
 | 5 | **FIPS** (`enable_fips_mode`, `grub2_enable_fips_mode`, `package_dracut-fips_installed`) | Decision: off for the lab phase (interacts with the still-unsigned UKI / Secure Boot story). | Revisit with signing. No weakened crypto is configured in the meantime. |
-| 6 | **Remote audit offload** (`auditd_audispd_configure_remote_server`, `..._encrypt_sent_records`, `..._network_failure_action`, `rsyslog_remote_loghost`) **+ rsyslog TLS offload** (`rsyslog_encrypt_offload_defaultnetstreamdriver`, `..._actionsendstreamdrivermode`, `..._actionsendstreamdriverauthmode`) | Offload is done via **rsyslog over TCP** (simpler, container-friendly receiver); the `audisp-remote` native-protocol rules stay waived. The **TLS-offload rules are waived** because the isolated lab boot LAN is plaintext (mirrors HTTP boot / no MACsec) and applying them forces `gtls` + x509 peer auth + a CA file, which **breaks** the plaintext `2f` forward (no CA, plaintext `:514`). | **Wired both ends, plaintext.** Sender (image, provisioner 2f, `audit_host`): audisp-syslog → LOCAL6 + rsyslog `omfwd` (disk-assisted queue) → host-generic `audit.fleet.lab`. Receiver: `serving/audit-collector/` (rsyslog TCP/514, per-source-host files). No per-host state; isolated LAN. **Production (tracked in docs/TODO.md #2):** issue the collector a TLS cert, bundle the CA in the image, switch `2f` + the collector to `gtls`/6514, then **re-select** the three `rsyslog_encrypt_offload_*` rules (drop the waivers) so they pass. |
+| 6 | **Remote audit offload** (`auditd_audispd_configure_remote_server`, `..._encrypt_sent_records`, `..._network_failure_action`, `rsyslog_remote_loghost`) | Offload is done via **rsyslog over TLS** rather than the `audisp-remote` native protocol (simpler, container-friendly receiver), so the audisp-remote rules + `rsyslog_remote_loghost` (whose remediation would inject a bogus loghost) stay waived — the *intent* of all four is met by the rsyslog path. **The three `rsyslog_encrypt_offload_*` rules are NO LONGER waived** (re-selected 2026-07-12): the offload is now encrypted end-to-end and they are evaluated + expected to **pass** (rsyslog+rsyslog-gnutls installed before the scan; remediation writes the gtls/x509 globals). | **Wired both ends, TLS.** Sender (image, provisioner 2f, `audit_host`): audisp-syslog → LOCAL6 + rsyslog `omfwd` over **gtls :6514**, server verified `x509/name` against the baked fleet CA (`/etc/dot1x/radius-ca.pem`, `var.fleet_ca`), disk-assisted queue → host-generic `audit.fleet.lab`. Receiver: `serving/audit-collector/` (gtls listener :6514, server cert from the fleet step-ca via `issue-cert.sh`; legacy plaintext :514 kept only for pre-TLS images during migration — close it once the fleet is on TLS images). No client certs: hosts are fleet-generic (invariant #1 — a baked fleet-wide client key would be shared secret material), and client mTLS with the per-host **TPM identity was considered + deferred 2026-07-12** (redundant with 802.1X/MACsec on the secure path, which authenticates the same TPM credential at L2; rsyslog can't use a non-exportable TPM key without a delegated-cert or PKCS#11-tunnel contraption; hard-failing the forensic safety net on client-auth errors darkens exactly the hosts whose logs matter most — full rationale + revisit trigger in `serving/audit-collector/README.md`). Sender access constrained by the isolated boot LAN + serving-host firewall. No per-host state. |
 | 7 | **Smart card login** (`require_smart_card_login`, `sssd_enable_smartcard`, `install_smartcard_packages`) | Diskless hosts have no smartcard reader; admin access is SSH key-based. Enforcing smartcard login would lock the host out. | Admin auth is an SSH **key-only** account; root is locked; password auth disabled. |
 | 8 | **NOPASSWD sudo** (`sudo_remove_nopasswd`) | The baked admin is a **passwordless, key-only** account, so `sudo` cannot prompt for a password — NOPASSWD is required for it to function at all. | Single fleet-generic admin, key-only, `wheel`; no interactive password exists to protect. Tracked for the eventual per-host/rotatable access model (SSH CA / config-agent). |
 | 9 | **GUI / autologin / GDM** (gnome screensaver, GDM banner, automatic-login rules) | No GNOME/GDM is installed; the kiosk is an **intentional** autologin single-app (weston + Chromium) session on kiosk builds. | Kiosk user is unprivileged and passwordless; the session runs a single locked-down browser (no shell, no nav). Applies to kiosk builds only; non-kiosk builds don't install the GUI stack. |