From aab6c9919c0deaeaaa279392b559bd1dfdb0119a Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Sat, 11 Jul 2026 09:55:43 +0000 Subject: [PATCH] docs(ssp): flip F-02 SSH host certs to bench-verified (2026-07-11) F-02/P-17 (SSH host certificates, R-16) bench-verified end-to-end on comet-beacon-54: admin login by FQDN with no TOFU, per-boot auto-re-sign across reboot, SELinux confinement clean. Updates the SSP v0.4 status line + R-16 summary row and Annex A version note, the 2.4 host-key-trust row, the R-16 register row (treatment -> roll anchor + broker-side principal validation TODO) and the 3.1 narrative. F-03/P-18 (NTS, R-17) stays bench-verify pending -- not yet tested. Bench-surfaced code fixes are on branch poam-hardening (28d31e4). --- docs/ssp-annex-a-ism-residual-risk.md | 29 ++++++++++++++++-- docs/ssp.md | 42 ++++++++++++++++++++++++--- 2 files changed, 64 insertions(+), 7 deletions(-) diff --git a/docs/ssp-annex-a-ism-residual-risk.md b/docs/ssp-annex-a-ism-residual-risk.md index 37f2187..779c6eb 100644 --- a/docs/ssp-annex-a-ism-residual-risk.md +++ b/docs/ssp-annex-a-ism-residual-risk.md @@ -9,7 +9,12 @@ > **A&A framework:** ASD *Information Security Manual* (ISM) — engagement target > **May 2026 release**. > -> **Annex version:** 0.3 (updated 2026-07-10). v0.3 adds the **fleet-management +> **Annex version:** 0.4 (updated 2026-07-11). v0.4 adds two host-identity/time +> hardening features (both implemented 2026-07-11; SSH host certs **bench-verified 2026-07-11**, NTS bench-verify pending): +> broker-mediated **SSH host certificates** (per-boot host key signed by the fleet +> SSH CA via the enrol-broker host plane; closes F-02/P-17 — new **R-16**) and +> **NTS authenticated time** (RFC 8915 CA-signed NTP; closes F-03/P-18 — new +> **R-17**) — see §2.4, §2.9 and the register. v0.3 added the **fleet-management > plane**: the in-image **`fleet-agent`** (health telemetry over TPM-mTLS — > bench-verified on hardware 2026-07-10; new host interface (g)), the server-side > manager with **WebAuthn-passkey admin MFA** (first human-admin MFA — updates the @@ -110,6 +115,7 @@ ISM/PSPF style). Ratings are **pre-treatment** unless stated; the AO accepts the | Strong machine authentication | ISM-1546*, ISM-0974* | Mutual, certificate-based auth. | **802.1X EAP-TLS**, client key non-exportable in **TPM** (`0x81000100`), cert in TPM NV. The **management-plane agent reuses the same TPM identity** for mTLS (`RequireAndVerifyClientCert` to the fleet CA; server keys inventory off the verified cert serial). One non-exportable key = 802.1X + NVMe hostnqn + agent stream. | Partial | R-01 (not bench-verified; disabled in test builds), R-08 (placeholder CA), R-14 (mgmt plane = connected system) | | Privileged access restricted | ISM-1507*, ISM-0445* | Limit & control admin access. | Single key-only `wheel` admin; root login disabled; admin **confined to `staff_u`** with a sudo `sysadm_r`/`sysadm_t` role/type transition (SELinux context elevates on privilege use). | Partial | R-05 | | Secure remote administration | ISM-1506*, ISM-1232* | Hardened admin channel. | SSH **key-only**, password & keyboard-interactive off, hardened ciphers/MACs/KEX (STIG crypto policy; ECDSA/RSA keys — ed25519 excluded by policy). | Implemented | — | +| Administrative host-key trust (SSH host certs) | ISM-1506*, ISM-1091* | Admins can verify host identity (no persistent TOFU). | Ephemeral overlay ⇒ new sshd host keys each boot; each host's per-boot key is **signed into an OpenSSH host certificate by the fleet SSH CA** at boot, brokered via the **enrol-broker host plane** over **TPM-identity mTLS** (`fleet-ssh-hostcert`). Admins trust one **`@cert-authority`** line; step-ca stays behind the broker; client **fails open** to a bare key if unreachable (no admin lock-out). **Implemented + bench-verified 2026-07-11** (comet-beacon-54: FQDN login/no-TOFU, per-boot re-sign, SELinux clean). | Implemented | **R-16** | | No default/shared credentials | ISM-1304* | No baked credentials. | No per-host secrets in any artifact; identity from TPM at runtime; `machine-id` empty; host keys regenerated at first boot. | Implemented | — | | MFA for privileged users | ISM-1173*, ISM-1504* | MFA on privileged access. | Machine auth is cert+TPM (strong). **Human admin MFA on the management-plane UI now enforced via WebAuthn passkeys** (phishing-resistant, origin-bound, hardware-backed — the manager's admin plane, v0.3). Host **SSH** admin remains key-only (no separate human MFA). | Partial (host SSH) / Implemented (mgmt UI) | R-05 | | Passwordless appliance accounts | — (STIG #10) | Account lockout/aging. | `kiosk`/`fleetadmin` are key-only; password aging/faillock **exempted for these two only**, full policy system-wide otherwise. | Implemented | R-05 (folds into rotatable-access roadmap) | @@ -158,8 +164,9 @@ ISM/PSPF style). Ratings are **pre-treatment** unless stated; the AO accepts the |---|---|---|---|---|---| | ASD-Approved Cryptographic Algorithms (AACA) | ISM-0471*, ISM-1446* | Use approved algorithms. | STIG crypto policy (modern ciphers/MACs/KEX); EAP-TLS, MACsec-GCM. **Conformance to ISM AACA not formally asserted; FIPS off.** | Partial | **R-06** | | ASD-Approved Cryptographic Protocols (AACP) | ISM-1139*, ISM-1453* | Use approved protocols (TLS 1.2+/1.3). | EAP-TLS; **management-plane agent stream is mTLS 1.2+** (fleet CA) — encrypted, unlike NVMe/TCP & log transport which remain plaintext on the LAN. | Partial | R-04, R-06, R-07 | +| Authenticated time source | ISM-1453*, ISM-0472* | Trusted, authenticated time. | **NTS (RFC 8915)** — chrony syncs only from a source whose NTS-KE TLS cert is **fleet-CA-signed** (verified against `radius-ca.pem`); server name derived from the DHCP domain at runtime (no baked FQDN); the unauthenticated DHCP source is not mixed in. A DHCP/NTP/DNS spoofer can only **DoS**, never shift the clock (time feeds every cert-validity decision). `nocerttimecheck 1` bootstraps an RTC-less cold boot. **Implemented 2026-07-11, bench-verify pending.** | Implemented (bench-verify) | **R-17** | | Key protection / non-exportability | ISM-0501*, ISM-1091* | Protect keys in hardware where feasible. | EAP-TLS **and management-plane** private key **non-exportable in TPM** (one key, three uses); UKI signing keys in HSM/CI. The **fleet CA (step-ca)** that signs host/agent certs is a **connected-system** trust anchor — its key protection is assessed there. | Implemented (host) / R-14 (CA) | R-14 | -| Certificate lifecycle | ISM-1091*, ISM-0501* | Managed cert issuance/renewal. | Host identity cert minted at enrolment (step-ca, into TPM NV). The manager's **agent-plane server cert auto-renews** from the co-located CA (`step ca renew --daemon` + in-process hot-reload) — preserves SANs, no 90-day lapse. Server-side = connected system. | Partial (connected system) | R-14 | +| Certificate lifecycle | ISM-1091*, ISM-0501* | Managed cert issuance/renewal. | Host identity cert minted at enrolment (step-ca, into TPM NV). The manager's **agent-plane server cert auto-renews** from the co-located CA (`step ca renew --daemon` + in-process hot-reload) — preserves SANs, no 90-day lapse. The **SSH host certificate** is (re)issued **every boot** by the fleet SSH CA via the broker (short-lived, per-boot lifecycle). Server-side CA = connected system. | Partial (connected system) | R-14 | | Cryptographic equipment / module evaluation | ISM-0467*, ISM-1277* | Use evaluated crypto modules. | TPM 2.0 hardware; module-evaluation status to confirm; FIPS module not enabled. | Partial | R-06 | ### 2.10 Guidelines for ICT Equipment & Media @@ -201,6 +208,8 @@ asked to accept. Treatments map to [docs/TODO.md](TODO.md) (working POA&M). | **R-12** | **No formal Incident Response Plan**; volatile RAM overlay complicates live forensics. | 2.1, 2.6 (ISM-0043*/0109*) | Possible × Moderate → **Medium** | Inherent recovery (reboot → verified state; revert digest); centralised logs survive host wipe. | Author IRP + log-retention + break-glass/forensics procedure suited to stateless hosts. | **Low** | SecOps — *before production* | | **R-14** | **Management/enrolment plane is a connected system, built but not yet separately authorised.** The host now trusts + streams to the fleet-manager and enrols via the broker + **step-ca fleet CA** (a new trust anchor + key material); the broker exposes **one unauthenticated pre-auth CSR endpoint**; InfluxDB holds telemetry + a bearer token. These server-side controls (CA key protection, broker hardening, admin-plane exposure, data-at-rest) are outside this SSP's boundary. | 2.4, 2.5, 2.6, 2.9 (ISM-1546*/1483*/0501*) | Possible × Moderate → **Medium** | Host-side exposure is limited: **outbound-only** mTLS, TPM-bound identity, **read-only** telemetry (no user data), and **commands logged-not-applied in v1**. Broker enrolment is human-anchored (OOB fingerprint + admin mTLS approve; no auto-approval). Mgmt-plane admin UI behind passkey MFA. | Author a **separate SSP/authorisation** for the management plane (CA key protection, broker endpoint hardening + rate-limiting, InfluxDB token/data protection, admin-plane network exposure); TLS everywhere is already in place on this plane. | **Low–Medium** | Platform/SecOps — *before the mgmt plane is production* | | **R-15** | **Deferred agent reconcile actuators.** v1 receives `DesiredState`/`Command` but **only logs** them; when actuation (apply `kiosk_url` / `reboot` / drain) is built, `fleet-agent` becomes a **remote host-mutation channel**. | 2.5 (ISM-1483*/1509*) | Rare × Moderate → **Low** (v1) | v1 performs **no host mutation** — the receive path is inert; the command authZ path (server-authoritative desired-state, verified over mTLS) is designed but not exercised. | At build time, assess the command/authZ path (who can set desired-state, replay/authZ, blast radius of `reboot`/drain) before enabling actuators; keep it behind an explicit flag. | **Low** | Platform team — *at actuator build* | +| **R-16** | Per-boot SSH host keys made admin SSH **perpetual TOFU** — a host key can never be pinned, so a LAN MITM of admin SSH is client-undetectable. **Remediated 2026-07-11** (`poam-hardening`): broker-mediated **SSH host certificates**. | 2.4, 2.9 (ISM-1506*/1091*) | Possible × Moderate → **Medium** (pre-fix) | Each per-boot key is **signed by the fleet SSH CA** via the enrol-broker host plane (TPM-mTLS); admins trust one **`@cert-authority`** line; step-ca behind the single front door; client **fails open** to a bare key (no lock-out) if broker/CA unreachable. | **Bench-verified 2026-07-11** (comet-beacon-54: FQDN login/no-TOFU, per-boot re-sign across reboot, SELinux clean). Remaining: broker-side principal validation (defence-in-depth) + roll the `@cert-authority` anchor to admins. Design B deferred, not required. | **Low** | Platform team — *done; roll anchor* | +| **R-17** | **Time source was unauthenticated** (DHCP-handed NTP, no NTS) — an attacker spoofing DHCP/NTP could shift the clock to make expired/revoked certs validate (time feeds EAP-TLS, agent mTLS, future log TLS). **Remediated 2026-07-11** (`secure-ntp`): **NTS (RFC 8915)**. | 2.9 (ISM-1453*/1139*) | Possible × Moderate → **Low–Medium** (pre-fix) | Serving NTP presents a **fleet-CA-signed** NTS-KE cert; host (`secure_ntp=true`) verifies against `radius-ca.pem` and **no longer mixes in** the unauthenticated DHCP source; server name derived from the DHCP domain (no baked FQDN). A spoofer can only **DoS**, not shift time. Compensating meanwhile: isolated LAN + cert-serial inventory gate. | **Bench-verify** `chronyc authdata` NTS cookies, tcp/4460, cold-clock `nocerttimecheck`, STIG chrony compat; issue the per-environment NTS server cert (F-03/P-18 M3). | **Low** | Platform team — *bench-verify* | ### 3.1 Risk heatmap (post-treatment targets) @@ -211,6 +220,7 @@ Likelihood ↓ Likely R-10 R-01* Possible R-05 R-07 R-03 R-02* R-12 R-14 R-06 R-08 + R-16 R-17 Unlikely R-04 R-11 R-09 Rare R-15 @@ -227,7 +237,11 @@ connected system requiring its own authorisation) and **R-15** (deferred agent actuators — a future remote-mutation channel, inert in v1). Newly *strengthened* in v0.3: **human-admin MFA on the management plane** via WebAuthn passkeys (improves R-05's MFA clause), and **application control made effective on the -overlay root** (the 2026-07-04 fapolicyd `watch_fs` fix). Carried from v0.2: +overlay root** (the 2026-07-04 fapolicyd `watch_fs` fix). Newly recorded in **v0.4**: **R-16** +(per-boot SSH host keys were perpetual TOFU — now **broker-signed SSH host +certificates**) and **R-17** (time was unauthenticated — now **NTS**), both +remediated 2026-07-11 and rated **Low** post-fix — R-16 **bench-verified 2026-07-11**, R-17 (NTS) bench-verify pending. +Carried from v0.2: USBGuard device control, admin SELinux confinement, STIG applied+verified, and Secure Boot signing verified enforcing on real hardware (R-13 Medium→Low).* @@ -273,6 +287,15 @@ Secure Boot signing verified enforcing on real hardware (R-13 Medium→Low).* did not guard the overlay root). 11. **Confirm actuators are inert (R-15):** the assessed build's `fleet-agent` **logs but does not apply** desired-state/commands (telemetry-only v1). +12. **Witness SSH host certificates (R-16):** on a booted + enrolled host, `sshd` + presents a **fleet-SSH-CA-signed host certificate** (`ssh-keygen -L -f` the + presented cert; principals/validity per policy); an admin with only the + `@cert-authority` line connects **without a TOFU prompt**; confirm the client + **fails open** to a bare key (no admin lock-out) if the broker/CA is down. +13. **Witness NTS authenticated time (R-17):** `chronyc -N authdata` shows the + source in **NTS** mode with cookies > 0; a rogue NTP/DHCP/DNS source is **not** + selected (NTS handshake fails ⇒ DoS only, no clock shift); a cold-clock boot + bootstraps via `nocerttimecheck 1`. --- diff --git a/docs/ssp.md b/docs/ssp.md index 569d1f4..6ae47f5 100644 --- a/docs/ssp.md +++ b/docs/ssp.md @@ -15,10 +15,10 @@ |---|---| | System name | Diskless Fleet Boot System ("the fleet") | | Document type | System Security Plan (SSP) | -| Version | 0.3 (DRAFT — pre-assessment) | -| Date | 2026-07-10 | +| Version | 0.4 (DRAFT — pre-assessment) | +| Date | 2026-07-11 | | Author / maintainer | System Owner (delegate) | -| Status | Lab / pre-production. STIG hardening applied + bench-verified; **UEFI Secure Boot signing verified enforcing on real hardware** (VM HTTP + EliteBook 820 PXE); secure path (802.1X/MACsec) not yet bench-verified. **v0.3 adds the fleet-management plane** (on-host `fleet-agent` telemetry over TPM-mTLS — bench-verified on hardware 2026-07-10; server-side manager with **WebAuthn-passkey** admin MFA + TPM enrolment broker) and July hardening changes (three local SELinux modules; fapolicyd overlay exec-guard fix). | +| Status | Lab / pre-production. STIG hardening applied + bench-verified; **UEFI Secure Boot signing verified enforcing on real hardware** (VM HTTP + EliteBook 820 PXE); secure path (802.1X/MACsec) not yet bench-verified. **v0.3 adds the fleet-management plane** (on-host `fleet-agent` telemetry over TPM-mTLS — bench-verified on hardware 2026-07-10; server-side manager with **WebAuthn-passkey** admin MFA + TPM enrolment broker) and July hardening changes (three local SELinux modules; fapolicyd overlay exec-guard fix). **v0.4** adds two host-identity/time hardening features (both implemented 2026-07-11): broker-mediated **SSH host certificates** (F-02/P-17 — **bench-verified 2026-07-11** on `comet-beacon-54`) and **NTS authenticated time** (F-03/P-18 — bench-verify pending). | | Companion documents | [Annex A — ISM control cross-reference & residual risk](ssp-annex-a-ism-residual-risk.md); [Architecture design v2](diskless-fleet-design-v2.pdf); [Design errata](design-v2-errata.md); [Fleet-management design](fleet-management-design.md); [TPM enrolment design](tpm-enrolment-design.md); [STIG deviation register](stig-deviations.md); [Backlog / POA&M source](TODO.md) | > **Currency caveat (read before relying on control numbers).** This SSP and its @@ -110,6 +110,13 @@ manifest. One commit = one release = one digest = one manifest entry. 7. `switch-root` into the real system; NetworkManager renews the DHCP lease so the network-mounted root stays alive; the host derives its NVMe `hostnqn` from the TPM certificate serial and (kiosk builds) launches the locked-down kiosk. + Early in the running system the host also (a) syncs **CA-authenticated time** + (NTS, RFC 8915 — the NTP source's TLS certificate is verified against the fleet + CA, so a DHCP/NTP/DNS spoofer can only DoS, never shift the clock) and (b) gets + its **per-boot SSH host key signed into an OpenSSH host certificate** by the + fleet SSH CA — brokered through the enrol-broker host plane over TPM-identity + mTLS — so administrators trust the fleet through a single `@cert-authority` line + instead of per-boot trust-on-first-use. 8. **Post-boot management (v0.3):** the hardened **`fleet-agent`** service dials the management plane and identifies with the **same TPM key/cert** used for 802.1X and the NVMe `hostnqn` ("one identity, three stages"), streaming host @@ -145,7 +152,11 @@ control point addressed in Annex A. audit-log offload currently **plaintext on an isolated lab LAN** (see residual risk R-04, R-07 in Annex A). The **management-plane** telemetry stream is **mTLS-encrypted** (fleet CA) end-to-end — unlike the NVMe/audit hops, it is not - plaintext. + plaintext. **NTP is now NTS-authenticated** (RFC 8915) — the time source's TLS + certificate is verified against the fleet CA, so the host clock cannot be spoofed + (F-03). Administrative **SSH host identity** is asserted by a **fleet-SSH-CA + certificate** (broker-signed at boot), replacing per-boot trust-on-first-use + (F-02). - **Management telemetry (v0.3):** the agent sends host **health** (load/cpu/temp/ memory/tmpfs, uptime, NVMe-root state, 802.1X/MACsec + SELinux state, chrony clock health, kiosk state) and **inventory facts** (image version, kernel, @@ -258,6 +269,15 @@ summarises the implementation posture. long-standing "no admin MFA" gap for management operations; host SSH admin remains key-only — R-05). - **Link protection:** **MACsec** on the access link. +- **Authenticated time (NTS — v0.4):** chrony syncs only from an **NTS** (RFC 8915) + source whose NTS-KE TLS certificate is **fleet-CA-signed** (verified against the + same `radius-ca.pem` the host already trusts). The server name is derived at + runtime from the DHCP domain (`ntp.` — no baked FQDN, so a site-domain + change needs no rebuild), and the unauthenticated DHCP option-42 source is **not** + mixed in. A DHCP/NTP/DNS spoofer can therefore only cause **no-sync (DoS)**, never + shift the clock — closing the "unauthenticated time feeds every certificate- + validity decision" gap (F-03/P-18). `nocerttimecheck 1` lets an RTC-less cold boot + bootstrap the first measurement. Toggle `secure_ntp` (default true). - **Boot & OS integrity:** **Secure Boot** + **signed UKI** with an **immutable cmdline**; **dm-verity** read-only root (continuous cryptographic integrity); **erofs** immutable filesystem; **reproducible** build (verity hash is a pure @@ -296,6 +316,18 @@ summarises the implementation posture. transition (`sysadm_r`/`sysadm_t`) so privilege elevation re-labels the SELinux context (STIG `selinux_context_elevation_for_sudo`). Still **NOPASSWD** (the account is passwordless/key-only) and fleet-generic — see R-05. +- **Administrative host-key trust (SSH host certificates — v0.4):** because the + overlay is ephemeral, sshd host keys are new every boot; rather than perpetual + trust-on-first-use, each host at boot gets its **per-boot host key signed into an + OpenSSH host certificate by the fleet SSH CA**, brokered through the + **enrol-broker host plane** over **TPM-identity mTLS** (the same non-exportable + TPM key that backs 802.1X and the NVMe `hostnqn`). Admins add **one + `@cert-authority` line** and thereafter verify every host against the fleet SSH + CA — no per-boot key pinning, and a LAN MITM of admin SSH becomes + client-detectable. step-ca stays behind the broker's single front door; the + client **fails open** to a bare (TOFU) key if the broker/CA is unreachable, so it + cannot brick admin access. Closes F-02/P-17. Toggle `enable_ssh_hostcert` + (default true). - **No persistent attack surface:** diskless; overlay discarded each boot; no per-host secrets in the image. - *Gaps / decisions:* **FIPS OFF** (lab phase); **host firewall disabled** (the @@ -378,6 +410,8 @@ production ATO: | R-13 | **Boot-chain signing not yet the standing default.** Signing + Secure Boot enforcement **verified end-to-end on hardware** (VM HTTP UKI 2026-06-20; 820 PXE signed iPXE→UKI 2026-06-22), but unsigned/SB-OFF lab builds are still possible (CI signs only when `SB_KEY`/`SB_CERT` are set) and not all hosts have `db` enrolled. | **Low** | Treat — make signed + Secure-Boot-on the default for all production builds/hosts (set CI secrets; enrol `db` fleet-wide). | | R-14 | **Management/enrolment plane is a connected system, built but not yet separately authorised.** The host now trusts + streams to the fleet-manager and enrols via the broker/**step-ca fleet CA** (a new trust anchor + key material) whose one **unauthenticated pre-auth CSR endpoint** is a new server-side surface. Host-side exposure is limited (outbound-only mTLS, read-only telemetry, commands logged-not-applied in v1). | **Medium** | Treat — separate SSP/authorisation for the management plane (CA key protection, broker endpoint hardening, InfluxDB token/data, admin-plane exposure). | | R-15 | **Deferred agent reconcile actuators.** v1 receives `DesiredState`/`Command` but only logs them; when actuation (apply kiosk_url / reboot / drain) is built, the agent becomes a **remote host-mutation channel** needing re-assessment. | **Low** (v1) | Treat at build time — assess the command/authZ path before enabling actuators. | +| R-16 | Per-boot SSH host keys made admin SSH perpetual **TOFU** (LAN MITM client-undetectable). **Remediated 2026-07-11**: broker-mediated **SSH host certificates** (`enable_ssh_hostcert=true`) — per-boot key signed by the fleet SSH CA via the enrol-broker host plane (TPM-mTLS); admins trust one `@cert-authority` line. **Bench-verified 2026-07-11** (comet-beacon-54: FQDN login, no TOFU; per-boot re-sign across reboot; SELinux clean). | **Low** | Treat — roll the `@cert-authority` anchor to admins; broker-side principal validation is a defence-in-depth TODO (F-02/P-17). | +| R-17 | Time source was **unauthenticated** (DHCP-handed NTP) — the clock feeds every certificate-validity decision. **Remediated 2026-07-11**: **NTS** (RFC 8915, `secure_ntp=true`) — fleet-CA-signed NTS-KE cert verified against `radius-ca.pem`; server name derived from the DHCP domain (no baked FQDN); a spoofer can only DoS. **Bench-verify pending.** | **Low** (once verified) | Treat — bench-verify `chronyc authdata` cookies + tcp/4460 + cold-clock + STIG chrony; issue the per-env NTS cert (F-03/P-18). | Each is detailed, ISM-cross-referenced, rated and assigned a treatment in Annex A.