sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Add SIEM

Browse Source
This commit is contained in:
Audiobuzz
2026-06-27 08:52:17 +00:00
parent 4d51fa97c2
commit ce5af959ad
15 changed files with 414 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/TODO.md
+26
View File
@@ -220,6 +220,32 @@ reconnect — no records lost. Documented in
When the **workstation** firewall is re-enabled (#4 / register #4) it needs the
reciprocal **egress** allow for 514/tcp to the collector.
**SIEM (Wazuh) added 2026-06-27 — [serving/siem/](../serving/siem/).** Upgrades the
"Detect" pillar from file-collection-only to parse/search/correlate/alert.
**Runs on a DEDICATED node — `wazuh1.bitasylum.org`** (managed independently),
keeping the memory-hungry indexer JVM **off** the serving host so it can't OOM SPDK
(the fleet's root disk / SPOF, #6/#7). **Agentless** (diskless hosts stay stateless,
invariant #1): the serving-host audit-collector **relays a copy** to wazuh1's
manager syslog listener (`omfwd` → `wazuh1.bitasylum.org:514` in
`audit-collector/rsyslog.conf`; rebuild the collector to apply) while still writing
durable per-host files. `serving/siem/` is the INTEGRATION (the `<remote>` syslog
block to add on wazuh1 + reference deploy overlay), not a local deployment.
**DECODING BENCH-VERIFIED 2026-06-27** (`wazuh-logtest`): the audisp-syslog records
carry a `node=<host>` prefix (STIG `name_format=hostname`, SSG `auditd_name_format`
— kept, it's compliance) that breaks Wazuh's built-in auditd decoder, so a custom
**`fleet-auditd`** decoder + rules (`serving/siem/config/local_decoder.xml` +
`local_rules.xml`, mounted declaratively via `/wazuh-config-mount`) decode them
into the **`fleet_audit`** group. **Decode + alert confirmed:** `wazuh-logtest`
shows `decoder.name=fleet-auditd` + `audit.type` extracted (base rule `100100`);
and a live `sudo` on a booted host (`cygnus-cruiser-99`) surfaced `USER_CMD` →
rule `100130` and `CRED_*`/`USER_ACCT` → rule `100110` (level 5) in the dashboard
Threat Hunting view. Wazuh runs multi-node on `wazuh1.bitasylum.org`.
**REMAINING (prod):** the relay→wazuh1 hop is **plaintext** — **TLS it** (gtls/6514,
fleet CA; ISM protect-logs-in-transit) since it's now on the wire; rotate all Wazuh
creds; restrict dashboard/API to admin hosts; set `allowed-ips`→/32 of the serving
host; ISM retention/archival; then update the SSP "Detect" + ISM event-logging
controls.
### Original spec (retained for reference)
OpenSCAP + SCAP Security Guide (`xccdf_org.ssgproject.content_profile_stig`), run
docs/ssp-annex-a-ism-residual-risk.md
+10 -7
View File
@@ -14,7 +14,10 @@
> confinement, audit offload verified, PXE/iPXE boot path added, and **UEFI Secure
> Boot signing verified enforcing on real hardware** (VM HTTP + 820 PXE) — R-13
> reduced from Medium to Low (residual is making signed + SB-on the standing
> default).
> default); and (2026-06-27) a **Wazuh SIEM** (dedicated multi-node, agentless)
> now decodes + alerts on the fleet auditd stream — "event log analysis/alerting"
> moves Planned → Implemented, R-07 reduced toward Low (residual = TLS transport +
> retention).
---
@@ -67,7 +70,7 @@ ISM/PSPF style). Ratings are **pre-treatment** unless stated; the AO accepts the
|---|---|---|---|---|---|
| System Security Plan | ISM-0041* | An SSP is developed and maintained. | This document set ([SSP](ssp.md) + this annex). | Partial | Formal sign-off, role appointment pending. |
| Incident Response Plan | ISM-0043* | An IRP is developed, maintained, exercised. | Not yet authored; inherent recovery via reboot/redeploy. | Planned | R-12 |
| Continuous monitoring plan | ISM-1163* | Continuous monitoring strategy documented. | auditd + log offload exist; plan not formalised. | Partial | R-07 |
| Continuous monitoring plan | ISM-1163* | Continuous monitoring strategy documented. | auditd + centralised offload + **Wazuh SIEM** (analysis/alerting) exist; formal monitoring *plan/runbook* not yet documented. | Partial | R-07 |
| Strategies maintained & approved | ISM-0027* | Documentation approved by the authorising authority. | Pending AO appointment & approval. | Planned | — |
### 2.2 Guidelines for Cyber Security Roles
@@ -117,11 +120,11 @@ ISM/PSPF style). Ratings are **pre-treatment** unless stated; the AO accepts the
| Topic | ISM (rep.) | Requirement intent | System implementation | Status | Residual |
|---|---|---|---|---|---|
| Centralised event logging | ISM-0988*, ISM-1405* | Logs centrally collected. | `audisp-syslog`→rsyslog `omfwd` (disk-assisted queue) → dedicated collector (`serving/audit-collector/`); **bench-verified end-to-end 2026-06-20**. auditd `space_left_action`→syslog (no MTA). | Partial | R-07 |
| Centralised event logging | ISM-0988*, ISM-1405* | Logs centrally collected. | `audisp-syslog`→rsyslog `omfwd` (disk-assisted queue) → dedicated collector (`serving/audit-collector/`), which **relays to a dedicated multi-node Wazuh SIEM** (`wazuh1.bitasylum.org`). **Agentless** (no agent/state on hosts, invariant #1). Bench-verified end-to-end 2026-06-20 (collector) + 2026-06-27 (Wazuh). | Implemented | R-07 (transport/retention) |
| Required events logged | ISM-0582*, ISM-1537* | Log security-relevant events. | STIG auditd rule set; kernel `audit=1`, `audit_backlog_limit=8192`. | Implemented | — |
| Protect logs in transit | ISM-1432*, ISM-0407* | Encrypt/authenticate log transport. | **Plaintext** offload on isolated LAN (rsyslog TLS rules waived — see [STIG #6](stig-deviations.md)). | Waived (lab) | **R-07** |
| Log retention & integrity | ISM-0859*, ISM-1815* | Retain & protect logs. | Per-source-host files on collector; retention policy & tamper-protection not yet defined. | Planned | R-07 |
| Event log analysis / alerting | ISM-0109*, ISM-1228* | Review logs; alert on incidents. | No SIEM correlation/alerting defined. | Planned | R-07, R-12 |
| Protect logs in transit | ISM-1432*, ISM-0407* | Encrypt/authenticate log transport. | **Plaintext** on both hops (host→collector, collector→Wazuh across a routed mgmt LAN); rsyslog TLS rules waived (see [STIG #6](stig-deviations.md)). | Waived (lab) | **R-07** |
| Log retention & integrity | ISM-0859*, ISM-1815* | Retain & protect logs. | Per-source-host files on collector; Wazuh indexer available for retention/ISM but **archival/retention policy not yet configured**. | Planned | R-07 |
| Event log analysis / alerting | ISM-0109*, ISM-1228* | Review logs; alert on incidents. | **Wazuh SIEM** with a custom **`fleet-auditd`** decoder + severity-tiered rules (`fleet_audit` group; auth, privilege/`USER_CMD`, SELinux). **Decode + alert bench-verified 2026-06-27** (`wazuh-logtest` + live `sudo` in the dashboard). Detection content to expand. | Implemented (content to mature) | R-07 |
### 2.7 Guidelines for Networking
@@ -177,7 +180,7 @@ asked to accept. Treatments map to [docs/TODO.md](TODO.md) (working POA&M).
| **R-04** | NVMe/TCP **root traffic plaintext** on the LAN — exposure of OS content / injection if the segment is compromised. | 2.9 (ISM-1139*/1453*) | Unlikely × Major → **Medium** | Isolated boot LAN; MACsec on the access link (once R-01 done) protects the first hop; dm-verity makes injected root blocks fail verification (integrity preserved even if confidentiality isn't). | Production: TLS/IPsec for the storage transport, or rely on MACsec end-to-end across the fabric; document the decision. | **Low–Medium** | Platform/network — *production* |
| **R-05** | **NOPASSWD key-only admin**; no per-host or rotatable access model; human admin MFA on the mgmt plane not enforced. | 2.4 (ISM-1507*/1173*) | Possible × Moderate → **Medium** | Single fleet-generic admin, key-only, root disabled, ECDSA/RSA key, **now SELinux-confined to `staff_u`** with sudo role/type elevation, fully audited; no interactive password to attack. | Per-host/rotatable access (SSH CA / config-agent) + admin MFA on the management plane. | **Low–Medium** | Platform team — *roadmap* |
| **R-06** | **FIPS off**; ISM **AACA/AACP conformance not formally asserted**; crypto-module evaluation status unconfirmed. | 2.9 (ISM-0471*/1139*/1277*) | Possible × Major → **Medium** | Modern STIG crypto policy; non-exportable TPM key; no deliberately weak algorithms. Acceptable at OFFICIAL; **mandatory to resolve for PROTECTED+.** | Assert AACA/AACP conformance; decide on FIPS module / evaluated crypto alongside Secure Boot signing. | **Low** (at appropriate classification) | Security + Platform — *before PROTECTED+* |
| **R-07** | Audit-log **offload plaintext**, **single-site**, **no SIEM alerting**; logs interceptable/repudiable and not actively reviewed. (Transport **bench-verified working** 2026-06-20.) | 2.6 (ISM-1432*/0109*/0859*) | Possible × Moderate → **Medium** | Isolated LAN; disk-assisted queue (no loss on collector blip); auditd local copy; per-source files; LinuxAudit captures USBGuard events. | rsyslog **TLS** (gtls/6514) + bundle CA in image (re-select the 3 waived `rsyslog_encrypt_offload_*` rules); define retention + integrity; forward to SIEM with alerting. | **Low** | Platform/SecOps — *production* |
| **R-07** | Audit-log **offload plaintext** on both hops (host→collector, collector→Wazuh) and **log retention/archival not yet configured** — logs interceptable in transit and retention/tamper-protection undefined. (**SIEM analysis + alerting now in place** — Wazuh, decode+alert bench-verified 2026-06-27; transport bench-verified 2026-06-20.) | 2.6 (ISM-1432*/0109*/0859*) | Possible × Moderate → **Low–Medium** | Isolated/mgmt LAN; disk-assisted queue (no loss on collector/SIEM blip); auditd local copy; per-source files; **Wazuh now actively decodes + alerts** (`fleet_audit`). | rsyslog **TLS** (gtls/6514) on both hops + bundle CA in image (re-select the 3 waived `rsyslog_encrypt_offload_*` rules); configure Wazuh **retention/archival** (ISM) + rotate default creds + restrict dashboard/API. | **Low** | Platform/SecOps — *production* |
| **R-13** | **Boot-chain signing not yet the standing default** — signing + Secure Boot enforcement are **verified end-to-end on real hardware** (VM HTTP UKI 2026-06-20; 820 PXE signed iPXE→UKI 2026-06-22, SB enforcing, `db` enrolled), but unsigned/SB-OFF lab builds remain possible (CI signs only when `SB_KEY`/`SB_CERT` are set) and not every host has `db` enrolled, so a substituted artifact could still boot on an un-enrolled/unsigned host. | 2.10 (ISM-1542*/0312*) | Unlikely × Major → **Low** | Capability **proven on hardware**; dm-verity rejects a tampered *root* regardless; isolated lab LAN. | Make signed + Secure-Boot-on the **default for all production builds/hosts**: keep `SB_KEY`/`SB_CERT` CI secrets set; enrol `db` fleet-wide; treat an unsigned build as lab-only. | **Low** | Platform team — *before production* |
| **R-08** | **Placeholder RADIUS CA** (`files/etc/dot1x/radius-ca.pem`) — real EAP-TLS trust anchor not provisioned; auth cannot succeed and trust is unestablished. | 2.4 (ISM-1546*) | Certain (lab) × Major → **Medium** | Documented as a placeholder; environment-specific provisioning is the intended path; no real CA committed. | Provision the environment's real RADIUS CA out-of-band (not committed unless classification permits). | **Low** | Environment owner — *before production* |
| **R-09** | **Host firewall disabled**; host exposes more network surface than necessary. | 2.7 (ISM-1416*) | Possible × Moderate → **Low–Medium** | Isolated LAN; minimal services; egress controlled at the network/serving layer; no kiosk inbound. | Re-enable firewalld with explicit allow rules (NVMe/TCP `:4420`, DHCP, log offload, SSH) once the secure path is verified. | **Low** | Platform/network — *after R-01* |
docs/ssp.md
+22 -10
View File
@@ -16,7 +16,7 @@
| System name | Diskless Fleet Boot System ("the fleet") |
| Document type | System Security Plan (SSP) |
| Version | 0.2 (DRAFT — pre-assessment) |
| Date | 2026-06-22 |
| Date | 2026-06-27 |
| Author / maintainer | System Owner (delegate) |
| Status | Lab / pre-production. STIG hardening applied + bench-verified; **UEFI Secure Boot signing verified enforcing on real hardware** (VM HTTP + EliteBook 820 PXE); secure path (802.1X/MACsec) not yet bench-verified. |
| Companion documents | [Annex A — ISM control cross-reference & residual risk](ssp-annex-a-ism-residual-risk.md); [Architecture design v2](diskless-fleet-design-v2.pdf); [Design errata](design-v2-errata.md); [STIG deviation register](stig-deviations.md); [Backlog / POA&M source](TODO.md) |
@@ -164,15 +164,17 @@ This system follows the ISM A&A lifecycle:
Milestones (POA&M)** (this repo's [TODO.md](TODO.md) is the working POA&M
source).
**Current status:** Pre-assessment **DRAFT (v0.2, updated 2026-06-22)**. The system
**Current status:** Pre-assessment **DRAFT (v0.2, updated 2026-06-27)**. The system
is functional in a lab configuration. **Progress since v0.1 (2026-06-20):** DISA
STIG hardening applied and **bench-verified** on a real build (kiosk, key-only SSH,
audit offload, DHCP-named host, NVMe/verity root all good with hardening on);
USBGuard device control enabled + verified; admin confined to `staff_u`; and —
newly — **UEFI Secure Boot signing verified enforcing end-to-end on real
hardware**: the CI-signed UKI boots under Secure Boot on a VM (HTTP boot), and the
signed iPXE→UKI chain boots under Secure Boot on an EliteBook 820 G4 (PXE boot),
with `db`/`KEK`/`PK` enrolled via the baked `fleet-sb-enroll` helper. Several
USBGuard device control enabled + verified; admin confined to `staff_u`; **UEFI
Secure Boot signing verified enforcing end-to-end on real hardware** (CI-signed UKI
under SB on a VM/HTTP, and the signed iPXE→UKI chain under SB on an EliteBook 820
G4/PXE, with `db`/`KEK`/`PK` enrolled via `fleet-sb-enroll`); and — newly — a
**Wazuh SIEM** (dedicated multi-node, agentless) ingesting the fleet auditd stream
with a custom decoder/rules, **decode + alert bench-verified 2026-06-27**, lifting
the "Detect" pillar from log-collection-only to analysis + alerting. Several
controls remain **partial or deferred**, tracked as residual risks with treatments
(Annex A §3). The largest remaining gates on a production ATO: (a) the secure path
(**802.1X/MACsec**) is implemented but **not yet bench-verified** and is disabled
@@ -241,8 +243,18 @@ summarises the implementation posture.
disk-assisted queue) to a dedicated **audit collector** (`serving/audit-collector/`).
**Bench-verified end-to-end 2026-06-20** (records reach the collector,
per-source-host files).
- *Gaps:* offload currently **plaintext** (TLS planned, R-07); offload is
**local site only**; no SIEM correlation/alerting defined yet.
- **SIEM analysis + alerting (Wazuh)** — the collector **relays** the auditd
stream to a **dedicated multi-node Wazuh** instance (`wazuh1.bitasylum.org`);
ingestion is **agentless** (no agent/state in the diskless image, invariant #1).
A custom **`fleet-auditd`** decoder + rules handle the STIG `name_format=hostname`
(`node=` prefix) and surface events in the `fleet_audit` group with severity by
type (auth, privilege/`USER_CMD`, SELinux/AVC). **Decode + alert bench-verified
2026-06-27** (`wazuh-logtest` + a live `sudo` surfacing `USER_CMD`/`CRED_*` in
the dashboard). Config is declarative (`serving/siem/`, mounted via
`/wazuh-config-mount`).
- *Gaps:* both offload hops (host→collector, collector→Wazuh) currently
**plaintext** (TLS planned, R-07); **log retention/archival** (ISM) not yet
configured; default Wazuh credentials to be rotated before production.
### 5.4 Respond
- Known-good recovery is **inherent**: a host returns to a verified state on
@@ -282,7 +294,7 @@ production ATO:
| R-04 | NVMe/TCP root traffic **plaintext** on the lab LAN. | **Medium** | Accept (isolated LAN) / treat for production. |
| R-05 | NOPASSWD key-only admin (now `staff_u`-confined); no per-host/rotatable access model or admin-MFA. | **Medium** | Accept with compensating controls / roadmap. |
| R-06 | **FIPS off**; ASD-approved-cryptography conformance not yet asserted. | **Medium** | Treat — required for PROTECTED+; revisit with signing. |
| R-07 | Audit-log offload **plaintext** (bench-verified working), single-site, no SIEM alerting. | **Medium** | Treat — TLS offload + monitoring on roadmap. |
| R-07 | Audit-log offload **plaintext** on both hops (host→collector, collector→Wazuh); **log retention not yet configured**. SIEM **analysis + alerting now in place** (Wazuh, decode+alert bench-verified 2026-06-27). | **Low–Medium** | Treat — TLS both hops + ISM retention/archival + rotate Wazuh creds before production. |
| R-08 | **Placeholder RADIUS CA** in the repo; real trust anchor not yet provisioned. | **Medium** | Treat — environment-specific, before production. |
| R-09 | Host **firewall disabled** (workstation). | **Low–Medium** | Accept (isolated LAN) / treat with explicit allow-rules. |
| R-13 | **Boot-chain signing not yet the standing default.** Signing + Secure Boot enforcement **verified end-to-end on hardware** (VM HTTP UKI 2026-06-20; 820 PXE signed iPXE→UKI 2026-06-22), but unsigned/SB-OFF lab builds are still possible (CI signs only when `SB_KEY`/`SB_CERT` are set) and not all hosts have `db` enrolled. | **Low** | Treat — make signed + Secure-Boot-on the default for all production builds/hosts (set CI secrets; enrol `db` fleet-wide). |