74 lines
2.6 KiB
Markdown
74 lines
2.6 KiB
Markdown
---
|
|
id: TECH-SECURITY
|
|
type: technical
|
|
status: active
|
|
title: Security
|
|
created: '2026-09-09'
|
|
updated: '2026-10-11'
|
|
tags:
|
|
- technical
|
|
- security
|
|
related:
|
|
- ALERT-20260909-001
|
|
- ALERT-20260909-002
|
|
- NFR-002
|
|
- MOD-003
|
|
- MOD-007
|
|
source_paths:
|
|
- vault.yml
|
|
- roles/monitoring/tasks/configure-psk.yml
|
|
- roles/bootstrap/defaults/main.yml
|
|
- ansible.cfg
|
|
- execute.sh
|
|
confidence: confirmed
|
|
---
|
|
|
|
# Security
|
|
|
|
## Secrets Handling
|
|
|
|
- `vault.yml` (tracked, encrypted) holds `admin_password` (SHA-512 hash),
|
|
`monitoring_zabbix_api_password`, and Proxmox credentials
|
|
(`PROXMOX_USER_NAME`, `PROXMOX_USER_PASS`); it is loaded via playbook-level
|
|
`vars_files` in `bootstrap.yml` and `playbooks/monitoring.yml`.
|
|
- Git-ignored (verified): `.vault_pass`, `setenv.sh` (Proxmox credentials),
|
|
`.zabbix-psk/` (per-host PSKs), `logs/`.
|
|
- Resolved 2026-09-09: the `admin_password` SHA-512 hash that was committed
|
|
in plaintext in `roles/bootstrap/defaults/main.yml` and
|
|
`inventory/group_vars/external.yml` was moved to encrypted `vault.yml`
|
|
(see [ALERT-20260909-001](../alerts/ALERT-20260909-001.md)).
|
|
|
|
## SSH Posture
|
|
|
|
- Runtime key access: `execute.sh` bind-mounts the caller's `$HOME/.ssh`
|
|
(or `SSH_KEY_DIR`) read-only at `/root/.ssh`. It does not rewrite the host
|
|
SSH configuration or permissions. Private keys are not baked into the image.
|
|
- Controller/transport: `host_key_checking = False`,
|
|
`StrictHostKeyChecking=no`, `UserKnownHostsFile=/dev/null` (ansible.cfg,
|
|
execute.sh, Dockerfile). Deliberate for first-time provisioning; README
|
|
explicitly warns to restrict this in production.
|
|
- Host hardening: `manage-ssh-keys` role enforces allow/deny key lists;
|
|
bootstrap deploys hardened `sshd.conf.j2` and per-host authorized keys.
|
|
- Per-host exceptions: `ssh_service_name: ssh` on `gitea`/`ipam`.
|
|
|
|
## Zabbix Agent TLS
|
|
|
|
- PSK-only encryption (TLS connect + accept), 256-bit PSKs generated with
|
|
`openssl rand -hex 32` on the controller, persisted with umask 077 in a
|
|
0700 directory, deployed 0600 to the agent host. Identity = host name.
|
|
|
|
## Risky Defaults (documented trade-offs)
|
|
|
|
- `hawser_allow_insecure_no_auth: true` - Hawser standard mode without token
|
|
on non-loopback addresses; comment in defaults demands other network
|
|
protections.
|
|
- `execute.sh` disables host key checking inside the runtime container.
|
|
- Mirror rewrite runs with `ignore_errors: true` in os-updates.
|
|
|
|
## Git Hygiene
|
|
|
|
- Resolved 2026-09-09: the previously uncommitted change set (including the
|
|
`dmc12` → `cloudlorean` inventory rename and stale documentation) was
|
|
committed as one coherent change; see
|
|
[ALERT-20260909-002](../alerts/ALERT-20260909-002.md).
|