sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Update SSP

Browse Source
This commit is contained in:
Audiobuzz
2026-06-25 23:46:42 +00:00
parent dea7ca451a
commit c3507cda6e
5 changed files with 232 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ssp.md
+20 -16
View File
@@ -16,9 +16,9 @@
| System name | Diskless Fleet Boot System ("the fleet") |
| Document type | System Security Plan (SSP) |
| Version | 0.2 (DRAFT — pre-assessment) |
| Date | 2026-06-20 |
| Date | 2026-06-22 |
| Author / maintainer | System Owner (delegate) |
| Status | Lab / pre-production. STIG hardening applied + bench-verified (unsigned, Secure Boot OFF); secure path (802.1X/MACsec) not yet bench-verified. |
| Status | Lab / pre-production. STIG hardening applied + bench-verified; **UEFI Secure Boot signing verified enforcing on real hardware** (VM HTTP + EliteBook 820 PXE); secure path (802.1X/MACsec) not yet bench-verified. |
| Companion documents | [Annex A — ISM control cross-reference & residual risk](ssp-annex-a-ism-residual-risk.md); [Architecture design v2](diskless-fleet-design-v2.pdf); [Design errata](design-v2-errata.md); [STIG deviation register](stig-deviations.md); [Backlog / POA&M source](TODO.md) |
> **Currency caveat (read before relying on control numbers).** This SSP and its
@@ -164,19 +164,23 @@ This system follows the ISM A&A lifecycle:
Milestones (POA&M)** (this repo's [TODO.md](TODO.md) is the working POA&M
source).
**Current status:** Pre-assessment **DRAFT (v0.2)**. The system is functional in a
lab configuration. **Progress since v0.1 (2026-06-20):** DISA STIG hardening
applied and **bench-verified** on a real build (kiosk, key-only SSH, audit
offload, DHCP-named host, NVMe/verity root all good with hardening on); USBGuard
device control enabled + verified; admin confined to `staff_u`; UKI signing wired
in CI + Secure Boot key/enrolment procedure documented; both **HTTP-boot and
PXE/iPXE** boot paths working (the latter verified on an EliteBook 820 G4).
Several controls remain **partial or deferred**, tracked as residual risks with
treatments (Annex A §3). The two largest gates on a production ATO: (a) the
secure path (**802.1X/MACsec**) is implemented but **not yet bench-verified** and
is disabled in test builds (`disable_dot1x=true`, R-01); (b) the lab runs
**unsigned with Secure Boot OFF** (R-13) and with a lab-only **passwordless-root
debug shell** that must be removed (R-02).
**Current status:** Pre-assessment **DRAFT (v0.2, updated 2026-06-22)**. The system
is functional in a lab configuration. **Progress since v0.1 (2026-06-20):** DISA
STIG hardening applied and **bench-verified** on a real build (kiosk, key-only SSH,
audit offload, DHCP-named host, NVMe/verity root all good with hardening on);
USBGuard device control enabled + verified; admin confined to `staff_u`; and —
newly — **UEFI Secure Boot signing verified enforcing end-to-end on real
hardware**: the CI-signed UKI boots under Secure Boot on a VM (HTTP boot), and the
signed iPXE→UKI chain boots under Secure Boot on an EliteBook 820 G4 (PXE boot),
with `db`/`KEK`/`PK` enrolled via the baked `fleet-sb-enroll` helper. Several
controls remain **partial or deferred**, tracked as residual risks with treatments
(Annex A §3). The largest remaining gates on a production ATO: (a) the secure path
(**802.1X/MACsec**) is implemented but **not yet bench-verified** and is disabled
in test builds (`disable_dot1x=true`, R-01); (b) a lab-only **passwordless-root
debug shell** must be removed (R-02). Boot-chain signing / Secure Boot — a major
v0.1 gate — is now **demonstrated on hardware**; the residual (R-13) is reduced to
making signed + Secure-Boot-on the **standing default** for every production
host/build.
## 5. Security control implementation — by ISM cyber security principle
@@ -281,7 +285,7 @@ production ATO:
| R-07 | Audit-log offload **plaintext** (bench-verified working), single-site, no SIEM alerting. | **Medium** | Treat — TLS offload + monitoring on roadmap. |
| R-08 | **Placeholder RADIUS CA** in the repo; real trust anchor not yet provisioned. | **Medium** | Treat — environment-specific, before production. |
| R-09 | Host **firewall disabled** (workstation). | **Low–Medium** | Accept (isolated LAN) / treat with explicit allow-rules. |
| R-13 | **Boot chain unsigned / Secure Boot OFF** in the lab (UKI + iPXE); CI signing wired but not enforced. | **Medium** | Treat — enrol `db`, enforce SB + sign UKI & iPXE before production. |
| R-13 | **Boot-chain signing not yet the standing default.** Signing + Secure Boot enforcement **verified end-to-end on hardware** (VM HTTP UKI 2026-06-20; 820 PXE signed iPXE→UKI 2026-06-22), but unsigned/SB-OFF lab builds are still possible (CI signs only when `SB_KEY`/`SB_CERT` are set) and not all hosts have `db` enrolled. | **Low** | Treat — make signed + Secure-Boot-on the default for all production builds/hosts (set CI secrets; enrol `db` fleet-wide). |
Each is detailed, ISM-cross-referenced, rated and assigned a treatment in Annex A.