docs(ssp): flip F-02 SSH host certs to bench-verified (2026-07-11)

F-02/P-17 (SSH host certificates, R-16) bench-verified end-to-end on
comet-beacon-54: admin login by FQDN with no TOFU, per-boot auto-re-sign across
reboot, SELinux confinement clean. Updates the SSP v0.4 status line + R-16
summary row and Annex A version note, the 2.4 host-key-trust row, the R-16
register row (treatment -> roll anchor + broker-side principal validation TODO)
and the 3.1 narrative. F-03/P-18 (NTS, R-17) stays bench-verify pending -- not
yet tested. Bench-surfaced code fixes are on branch poam-hardening (28d31e4).

docs/ssp-annex-a-ism-residual-risk.md

@@ -9,7 +9,12 @@
 > **A&A framework:** ASD *Information Security Manual* (ISM) — engagement target
 > **May 2026 release**.
 >
-> **Annex version:** 0.3 (updated 2026-07-10). v0.3 adds the **fleet-management
+> **Annex version:** 0.4 (updated 2026-07-11). v0.4 adds two host-identity/time
+> hardening features (both implemented 2026-07-11; SSH host certs **bench-verified 2026-07-11**, NTS bench-verify pending):
+> broker-mediated **SSH host certificates** (per-boot host key signed by the fleet
+> SSH CA via the enrol-broker host plane; closes F-02/P-17 — new **R-16**) and
+> **NTS authenticated time** (RFC 8915 CA-signed NTP; closes F-03/P-18 — new
+> **R-17**) — see §2.4, §2.9 and the register. v0.3 added the **fleet-management
 > plane**: the in-image **`fleet-agent`** (health telemetry over TPM-mTLS —
 > bench-verified on hardware 2026-07-10; new host interface (g)), the server-side
 > manager with **WebAuthn-passkey admin MFA** (first human-admin MFA — updates the
@@ -110,6 +115,7 @@ ISM/PSPF style). Ratings are **pre-treatment** unless stated; the AO accepts the
 | Strong machine authentication | ISM-1546*, ISM-0974* | Mutual, certificate-based auth. | **802.1X EAP-TLS**, client key non-exportable in **TPM** (`0x81000100`), cert in TPM NV. The **management-plane agent reuses the same TPM identity** for mTLS (`RequireAndVerifyClientCert` to the fleet CA; server keys inventory off the verified cert serial). One non-exportable key = 802.1X + NVMe hostnqn + agent stream. | Partial | R-01 (not bench-verified; disabled in test builds), R-08 (placeholder CA), R-14 (mgmt plane = connected system) |
 | Privileged access restricted | ISM-1507*, ISM-0445* | Limit & control admin access. | Single key-only `wheel` admin; root login disabled; admin **confined to `staff_u`** with a sudo `sysadm_r`/`sysadm_t` role/type transition (SELinux context elevates on privilege use). | Partial | R-05 |
 | Secure remote administration | ISM-1506*, ISM-1232* | Hardened admin channel. | SSH **key-only**, password & keyboard-interactive off, hardened ciphers/MACs/KEX (STIG crypto policy; ECDSA/RSA keys — ed25519 excluded by policy). | Implemented | — |
+| Administrative host-key trust (SSH host certs) | ISM-1506*, ISM-1091* | Admins can verify host identity (no persistent TOFU). | Ephemeral overlay ⇒ new sshd host keys each boot; each host's per-boot key is **signed into an OpenSSH host certificate by the fleet SSH CA** at boot, brokered via the **enrol-broker host plane** over **TPM-identity mTLS** (`fleet-ssh-hostcert`). Admins trust one **`@cert-authority`** line; step-ca stays behind the broker; client **fails open** to a bare key if unreachable (no admin lock-out). **Implemented + bench-verified 2026-07-11** (comet-beacon-54: FQDN login/no-TOFU, per-boot re-sign, SELinux clean). | Implemented | **R-16** |
 | No default/shared credentials | ISM-1304* | No baked credentials. | No per-host secrets in any artifact; identity from TPM at runtime; `machine-id` empty; host keys regenerated at first boot. | Implemented | — |
 | MFA for privileged users | ISM-1173*, ISM-1504* | MFA on privileged access. | Machine auth is cert+TPM (strong). **Human admin MFA on the management-plane UI now enforced via WebAuthn passkeys** (phishing-resistant, origin-bound, hardware-backed — the manager's admin plane, v0.3). Host **SSH** admin remains key-only (no separate human MFA). | Partial (host SSH) / Implemented (mgmt UI) | R-05 |
 | Passwordless appliance accounts | — (STIG #10) | Account lockout/aging. | `kiosk`/`fleetadmin` are key-only; password aging/faillock **exempted for these two only**, full policy system-wide otherwise. | Implemented | R-05 (folds into rotatable-access roadmap) |
@@ -158,8 +164,9 @@ ISM/PSPF style). Ratings are **pre-treatment** unless stated; the AO accepts the
 |---|---|---|---|---|---|
 | ASD-Approved Cryptographic Algorithms (AACA) | ISM-0471*, ISM-1446* | Use approved algorithms. | STIG crypto policy (modern ciphers/MACs/KEX); EAP-TLS, MACsec-GCM. **Conformance to ISM AACA not formally asserted; FIPS off.** | Partial | **R-06** |
 | ASD-Approved Cryptographic Protocols (AACP) | ISM-1139*, ISM-1453* | Use approved protocols (TLS 1.2+/1.3). | EAP-TLS; **management-plane agent stream is mTLS 1.2+** (fleet CA) — encrypted, unlike NVMe/TCP & log transport which remain plaintext on the LAN. | Partial | R-04, R-06, R-07 |
+| Authenticated time source | ISM-1453*, ISM-0472* | Trusted, authenticated time. | **NTS (RFC 8915)** — chrony syncs only from a source whose NTS-KE TLS cert is **fleet-CA-signed** (verified against `radius-ca.pem`); server name derived from the DHCP domain at runtime (no baked FQDN); the unauthenticated DHCP source is not mixed in. A DHCP/NTP/DNS spoofer can only **DoS**, never shift the clock (time feeds every cert-validity decision). `nocerttimecheck 1` bootstraps an RTC-less cold boot. **Implemented 2026-07-11, bench-verify pending.** | Implemented (bench-verify) | **R-17** |
 | Key protection / non-exportability | ISM-0501*, ISM-1091* | Protect keys in hardware where feasible. | EAP-TLS **and management-plane** private key **non-exportable in TPM** (one key, three uses); UKI signing keys in HSM/CI. The **fleet CA (step-ca)** that signs host/agent certs is a **connected-system** trust anchor — its key protection is assessed there. | Implemented (host) / R-14 (CA) | R-14 |
-| Certificate lifecycle | ISM-1091*, ISM-0501* | Managed cert issuance/renewal. | Host identity cert minted at enrolment (step-ca, into TPM NV). The manager's **agent-plane server cert auto-renews** from the co-located CA (`step ca renew --daemon` + in-process hot-reload) — preserves SANs, no 90-day lapse. Server-side = connected system. | Partial (connected system) | R-14 |
+| Certificate lifecycle | ISM-1091*, ISM-0501* | Managed cert issuance/renewal. | Host identity cert minted at enrolment (step-ca, into TPM NV). The manager's **agent-plane server cert auto-renews** from the co-located CA (`step ca renew --daemon` + in-process hot-reload) — preserves SANs, no 90-day lapse. The **SSH host certificate** is (re)issued **every boot** by the fleet SSH CA via the broker (short-lived, per-boot lifecycle). Server-side CA = connected system. | Partial (connected system) | R-14 |
 | Cryptographic equipment / module evaluation | ISM-0467*, ISM-1277* | Use evaluated crypto modules. | TPM 2.0 hardware; module-evaluation status to confirm; FIPS module not enabled. | Partial | R-06 |
 
 ### 2.10 Guidelines for ICT Equipment & Media
@@ -201,6 +208,8 @@ asked to accept. Treatments map to [docs/TODO.md](TODO.md) (working POA&M).
 | **R-12** | **No formal Incident Response Plan**; volatile RAM overlay complicates live forensics. | 2.1, 2.6 (ISM-0043*/0109*) | Possible × Moderate → **Medium** | Inherent recovery (reboot → verified state; revert digest); centralised logs survive host wipe. | Author IRP + log-retention + break-glass/forensics procedure suited to stateless hosts. | **Low** | SecOps — *before production* |
 | **R-14** | **Management/enrolment plane is a connected system, built but not yet separately authorised.** The host now trusts + streams to the fleet-manager and enrols via the broker + **step-ca fleet CA** (a new trust anchor + key material); the broker exposes **one unauthenticated pre-auth CSR endpoint**; InfluxDB holds telemetry + a bearer token. These server-side controls (CA key protection, broker hardening, admin-plane exposure, data-at-rest) are outside this SSP's boundary. | 2.4, 2.5, 2.6, 2.9 (ISM-1546*/1483*/0501*) | Possible × Moderate → **Medium** | Host-side exposure is limited: **outbound-only** mTLS, TPM-bound identity, **read-only** telemetry (no user data), and **commands logged-not-applied in v1**. Broker enrolment is human-anchored (OOB fingerprint + admin mTLS approve; no auto-approval). Mgmt-plane admin UI behind passkey MFA. | Author a **separate SSP/authorisation** for the management plane (CA key protection, broker endpoint hardening + rate-limiting, InfluxDB token/data protection, admin-plane network exposure); TLS everywhere is already in place on this plane. | **Low–Medium** | Platform/SecOps — *before the mgmt plane is production* |
 | **R-15** | **Deferred agent reconcile actuators.** v1 receives `DesiredState`/`Command` but **only logs** them; when actuation (apply `kiosk_url` / `reboot` / drain) is built, `fleet-agent` becomes a **remote host-mutation channel**. | 2.5 (ISM-1483*/1509*) | Rare × Moderate → **Low** (v1) | v1 performs **no host mutation** — the receive path is inert; the command authZ path (server-authoritative desired-state, verified over mTLS) is designed but not exercised. | At build time, assess the command/authZ path (who can set desired-state, replay/authZ, blast radius of `reboot`/drain) before enabling actuators; keep it behind an explicit flag. | **Low** | Platform team — *at actuator build* |
+| **R-16** | Per-boot SSH host keys made admin SSH **perpetual TOFU** — a host key can never be pinned, so a LAN MITM of admin SSH is client-undetectable. **Remediated 2026-07-11** (`poam-hardening`): broker-mediated **SSH host certificates**. | 2.4, 2.9 (ISM-1506*/1091*) | Possible × Moderate → **Medium** (pre-fix) | Each per-boot key is **signed by the fleet SSH CA** via the enrol-broker host plane (TPM-mTLS); admins trust one **`@cert-authority`** line; step-ca behind the single front door; client **fails open** to a bare key (no lock-out) if broker/CA unreachable. | **Bench-verified 2026-07-11** (comet-beacon-54: FQDN login/no-TOFU, per-boot re-sign across reboot, SELinux clean). Remaining: broker-side principal validation (defence-in-depth) + roll the `@cert-authority` anchor to admins. Design B deferred, not required. | **Low** | Platform team — *done; roll anchor* |
+| **R-17** | **Time source was unauthenticated** (DHCP-handed NTP, no NTS) — an attacker spoofing DHCP/NTP could shift the clock to make expired/revoked certs validate (time feeds EAP-TLS, agent mTLS, future log TLS). **Remediated 2026-07-11** (`secure-ntp`): **NTS (RFC 8915)**. | 2.9 (ISM-1453*/1139*) | Possible × Moderate → **Low–Medium** (pre-fix) | Serving NTP presents a **fleet-CA-signed** NTS-KE cert; host (`secure_ntp=true`) verifies against `radius-ca.pem` and **no longer mixes in** the unauthenticated DHCP source; server name derived from the DHCP domain (no baked FQDN). A spoofer can only **DoS**, not shift time. Compensating meanwhile: isolated LAN + cert-serial inventory gate. | **Bench-verify** `chronyc authdata` NTS cookies, tcp/4460, cold-clock `nocerttimecheck`, STIG chrony compat; issue the per-environment NTS server cert (F-03/P-18 M3). | **Low** | Platform team — *bench-verify* |
 
 ### 3.1 Risk heatmap (post-treatment targets)
 
@@ -211,6 +220,7 @@ Likelihood ↓
   Likely                    R-10           R-01*   
   Possible                  R-05 R-07      R-03     R-02*
                             R-12 R-14      R-06 R-08
+                            R-16 R-17
   Unlikely                                 R-04     
                                            R-11 R-09
   Rare                      R-15
@@ -227,7 +237,11 @@ connected system requiring its own authorisation) and **R-15** (deferred agent
 actuators — a future remote-mutation channel, inert in v1). Newly *strengthened*
 in v0.3: **human-admin MFA on the management plane** via WebAuthn passkeys
 (improves R-05's MFA clause), and **application control made effective on the
-overlay root** (the 2026-07-04 fapolicyd `watch_fs` fix). Carried from v0.2:
+overlay root** (the 2026-07-04 fapolicyd `watch_fs` fix). Newly recorded in **v0.4**: **R-16**
+(per-boot SSH host keys were perpetual TOFU — now **broker-signed SSH host
+certificates**) and **R-17** (time was unauthenticated — now **NTS**), both
+remediated 2026-07-11 and rated **Low** post-fix — R-16 **bench-verified 2026-07-11**, R-17 (NTS) bench-verify pending.
+Carried from v0.2:
 USBGuard device control, admin SELinux confinement, STIG applied+verified, and
 Secure Boot signing verified enforcing on real hardware (R-13 Medium→Low).*
 
@@ -273,6 +287,15 @@ Secure Boot signing verified enforcing on real hardware (R-13 Medium→Low).*
     did not guard the overlay root).
 11. **Confirm actuators are inert (R-15):** the assessed build's `fleet-agent`
     **logs but does not apply** desired-state/commands (telemetry-only v1).
+12. **Witness SSH host certificates (R-16):** on a booted + enrolled host, `sshd`
+    presents a **fleet-SSH-CA-signed host certificate** (`ssh-keygen -L -f` the
+    presented cert; principals/validity per policy); an admin with only the
+    `@cert-authority` line connects **without a TOFU prompt**; confirm the client
+    **fails open** to a bare key (no admin lock-out) if the broker/CA is down.
+13. **Witness NTS authenticated time (R-17):** `chronyc -N authdata` shows the
+    source in **NTS** mode with cookies > 0; a rogue NTP/DHCP/DNS source is **not**
+    selected (NTS handshake fails ⇒ DoS only, no clock shift); a cold-clock boot
+    bootstraps via `nocerttimecheck 1`.
 
 ---