docs(ssp): flip F-02 SSH host certs to bench-verified (2026-07-11)

F-02/P-17 (SSH host certificates, R-16) bench-verified end-to-end on
comet-beacon-54: admin login by FQDN with no TOFU, per-boot auto-re-sign across
reboot, SELinux confinement clean. Updates the SSP v0.4 status line + R-16
summary row and Annex A version note, the 2.4 host-key-trust row, the R-16
register row (treatment -> roll anchor + broker-side principal validation TODO)
and the 3.1 narrative. F-03/P-18 (NTS, R-17) stays bench-verify pending -- not
yet tested. Bench-surfaced code fixes are on branch poam-hardening (28d31e4).

docs/ssp.md

@@ -15,10 +15,10 @@
 |---|---|
 | System name | Diskless Fleet Boot System ("the fleet") |
 | Document type | System Security Plan (SSP) |
-| Version | 0.3 (DRAFT — pre-assessment) |
-| Date | 2026-07-10 |
+| Version | 0.4 (DRAFT — pre-assessment) |
+| Date | 2026-07-11 |
 | Author / maintainer | System Owner (delegate) |
-| Status | Lab / pre-production. STIG hardening applied + bench-verified; **UEFI Secure Boot signing verified enforcing on real hardware** (VM HTTP + EliteBook 820 PXE); secure path (802.1X/MACsec) not yet bench-verified. **v0.3 adds the fleet-management plane** (on-host `fleet-agent` telemetry over TPM-mTLS — bench-verified on hardware 2026-07-10; server-side manager with **WebAuthn-passkey** admin MFA + TPM enrolment broker) and July hardening changes (three local SELinux modules; fapolicyd overlay exec-guard fix). |
+| Status | Lab / pre-production. STIG hardening applied + bench-verified; **UEFI Secure Boot signing verified enforcing on real hardware** (VM HTTP + EliteBook 820 PXE); secure path (802.1X/MACsec) not yet bench-verified. **v0.3 adds the fleet-management plane** (on-host `fleet-agent` telemetry over TPM-mTLS — bench-verified on hardware 2026-07-10; server-side manager with **WebAuthn-passkey** admin MFA + TPM enrolment broker) and July hardening changes (three local SELinux modules; fapolicyd overlay exec-guard fix). **v0.4** adds two host-identity/time hardening features (both implemented 2026-07-11): broker-mediated **SSH host certificates** (F-02/P-17 — **bench-verified 2026-07-11** on `comet-beacon-54`) and **NTS authenticated time** (F-03/P-18 — bench-verify pending). |
 | Companion documents | [Annex A — ISM control cross-reference & residual risk](ssp-annex-a-ism-residual-risk.md); [Architecture design v2](diskless-fleet-design-v2.pdf); [Design errata](design-v2-errata.md); [Fleet-management design](fleet-management-design.md); [TPM enrolment design](tpm-enrolment-design.md); [STIG deviation register](stig-deviations.md); [Backlog / POA&M source](TODO.md) |
 
 > **Currency caveat (read before relying on control numbers).** This SSP and its
@@ -110,6 +110,13 @@ manifest. One commit = one release = one digest = one manifest entry.
 7. `switch-root` into the real system; NetworkManager renews the DHCP lease so
    the network-mounted root stays alive; the host derives its NVMe `hostnqn` from
    the TPM certificate serial and (kiosk builds) launches the locked-down kiosk.
+   Early in the running system the host also (a) syncs **CA-authenticated time**
+   (NTS, RFC 8915 — the NTP source's TLS certificate is verified against the fleet
+   CA, so a DHCP/NTP/DNS spoofer can only DoS, never shift the clock) and (b) gets
+   its **per-boot SSH host key signed into an OpenSSH host certificate** by the
+   fleet SSH CA — brokered through the enrol-broker host plane over TPM-identity
+   mTLS — so administrators trust the fleet through a single `@cert-authority` line
+   instead of per-boot trust-on-first-use.
 8. **Post-boot management (v0.3):** the hardened **`fleet-agent`** service dials
    the management plane and identifies with the **same TPM key/cert** used for
    802.1X and the NVMe `hostnqn` ("one identity, three stages"), streaming host
@@ -145,7 +152,11 @@ control point addressed in Annex A.
   audit-log offload currently **plaintext on an isolated lab LAN** (see residual
   risk R-04, R-07 in Annex A). The **management-plane** telemetry stream is
   **mTLS-encrypted** (fleet CA) end-to-end — unlike the NVMe/audit hops, it is not
-  plaintext.
+  plaintext. **NTP is now NTS-authenticated** (RFC 8915) — the time source's TLS
+  certificate is verified against the fleet CA, so the host clock cannot be spoofed
+  (F-03). Administrative **SSH host identity** is asserted by a **fleet-SSH-CA
+  certificate** (broker-signed at boot), replacing per-boot trust-on-first-use
+  (F-02).
 - **Management telemetry (v0.3):** the agent sends host **health** (load/cpu/temp/
   memory/tmpfs, uptime, NVMe-root state, 802.1X/MACsec + SELinux state, chrony
   clock health, kiosk state) and **inventory facts** (image version, kernel,
@@ -258,6 +269,15 @@ summarises the implementation posture.
   long-standing "no admin MFA" gap for management operations; host SSH admin
   remains key-only — R-05).
 - **Link protection:** **MACsec** on the access link.
+- **Authenticated time (NTS — v0.4):** chrony syncs only from an **NTS** (RFC 8915)
+  source whose NTS-KE TLS certificate is **fleet-CA-signed** (verified against the
+  same `radius-ca.pem` the host already trusts). The server name is derived at
+  runtime from the DHCP domain (`ntp.<domain>` — no baked FQDN, so a site-domain
+  change needs no rebuild), and the unauthenticated DHCP option-42 source is **not**
+  mixed in. A DHCP/NTP/DNS spoofer can therefore only cause **no-sync (DoS)**, never
+  shift the clock — closing the "unauthenticated time feeds every certificate-
+  validity decision" gap (F-03/P-18). `nocerttimecheck 1` lets an RTC-less cold boot
+  bootstrap the first measurement. Toggle `secure_ntp` (default true).
 - **Boot & OS integrity:** **Secure Boot** + **signed UKI** with an **immutable
   cmdline**; **dm-verity** read-only root (continuous cryptographic integrity);
   **erofs** immutable filesystem; **reproducible** build (verity hash is a pure
@@ -296,6 +316,18 @@ summarises the implementation posture.
   transition (`sysadm_r`/`sysadm_t`) so privilege elevation re-labels the SELinux
   context (STIG `selinux_context_elevation_for_sudo`). Still **NOPASSWD** (the
   account is passwordless/key-only) and fleet-generic — see R-05.
+- **Administrative host-key trust (SSH host certificates — v0.4):** because the
+  overlay is ephemeral, sshd host keys are new every boot; rather than perpetual
+  trust-on-first-use, each host at boot gets its **per-boot host key signed into an
+  OpenSSH host certificate by the fleet SSH CA**, brokered through the
+  **enrol-broker host plane** over **TPM-identity mTLS** (the same non-exportable
+  TPM key that backs 802.1X and the NVMe `hostnqn`). Admins add **one
+  `@cert-authority` line** and thereafter verify every host against the fleet SSH
+  CA — no per-boot key pinning, and a LAN MITM of admin SSH becomes
+  client-detectable. step-ca stays behind the broker's single front door; the
+  client **fails open** to a bare (TOFU) key if the broker/CA is unreachable, so it
+  cannot brick admin access. Closes F-02/P-17. Toggle `enable_ssh_hostcert`
+  (default true).
 - **No persistent attack surface:** diskless; overlay discarded each boot; no
   per-host secrets in the image.
 - *Gaps / decisions:* **FIPS OFF** (lab phase); **host firewall disabled** (the
@@ -378,6 +410,8 @@ production ATO:
 | R-13 | **Boot-chain signing not yet the standing default.** Signing + Secure Boot enforcement **verified end-to-end on hardware** (VM HTTP UKI 2026-06-20; 820 PXE signed iPXE→UKI 2026-06-22), but unsigned/SB-OFF lab builds are still possible (CI signs only when `SB_KEY`/`SB_CERT` are set) and not all hosts have `db` enrolled. | **Low** | Treat — make signed + Secure-Boot-on the default for all production builds/hosts (set CI secrets; enrol `db` fleet-wide). |
 | R-14 | **Management/enrolment plane is a connected system, built but not yet separately authorised.** The host now trusts + streams to the fleet-manager and enrols via the broker/**step-ca fleet CA** (a new trust anchor + key material) whose one **unauthenticated pre-auth CSR endpoint** is a new server-side surface. Host-side exposure is limited (outbound-only mTLS, read-only telemetry, commands logged-not-applied in v1). | **Medium** | Treat — separate SSP/authorisation for the management plane (CA key protection, broker endpoint hardening, InfluxDB token/data, admin-plane exposure). |
 | R-15 | **Deferred agent reconcile actuators.** v1 receives `DesiredState`/`Command` but only logs them; when actuation (apply kiosk_url / reboot / drain) is built, the agent becomes a **remote host-mutation channel** needing re-assessment. | **Low** (v1) | Treat at build time — assess the command/authZ path before enabling actuators. |
+| R-16 | Per-boot SSH host keys made admin SSH perpetual **TOFU** (LAN MITM client-undetectable). **Remediated 2026-07-11**: broker-mediated **SSH host certificates** (`enable_ssh_hostcert=true`) — per-boot key signed by the fleet SSH CA via the enrol-broker host plane (TPM-mTLS); admins trust one `@cert-authority` line. **Bench-verified 2026-07-11** (comet-beacon-54: FQDN login, no TOFU; per-boot re-sign across reboot; SELinux clean). | **Low** | Treat — roll the `@cert-authority` anchor to admins; broker-side principal validation is a defence-in-depth TODO (F-02/P-17). |
+| R-17 | Time source was **unauthenticated** (DHCP-handed NTP) — the clock feeds every certificate-validity decision. **Remediated 2026-07-11**: **NTS** (RFC 8915, `secure_ntp=true`) — fleet-CA-signed NTS-KE cert verified against `radius-ca.pem`; server name derived from the DHCP domain (no baked FQDN); a spoofer can only DoS. **Bench-verify pending.** | **Low** (once verified) | Treat — bench-verify `chronyc authdata` cookies + tcp/4460 + cold-clock + STIG chrony; issue the per-env NTS cert (F-03/P-18). |
 
 Each is detailed, ISM-cross-referenced, rated and assigned a treatment in Annex A.