47 lines
1.7 KiB
Markdown
47 lines
1.7 KiB
Markdown
|
# Security
|
||
|
|
|
||
|
|
Lab-oriented controls. This is **not** a hardened public multi-tenant SaaS.
|
||
|
|
|
||
|
|
## Secrets
|
||
|
|
|
||
|
|
| Secret | Location | Git |
|
||
|
|
|--------|----------|-----|
|
||
|
|
| OME password | `.env` | **Excluded** |
|
||
|
|
| Open WebUI service password | `.env` | **Excluded** |
|
||
|
|
| Ticket DB | `/data/ops.db` | **Excluded** |
|
||
|
|
| SSH user passwords | Never stored server-side; transient WS auth only | N/A |
|
||
|
|
|
||
|
|
Use `.env.example` as a template with `CHANGE_ME` placeholders.
|
||
|
|
|
||
|
|
## Network exposure
|
||
|
|
|
||
|
|
- Cockpit has **no application auth** in the current lab build — rely on ATC network segmentation / VPN / reverse proxy if exposed beyond trusted LAN.
|
||
|
|
- Prefer binding publish ports to trusted interfaces only in stricter environments.
|
||
|
|
|
||
|
|
## SSH bridge
|
||
|
|
|
||
|
|
- Destination host must match a **current fleet management IP**
|
||
|
|
- Concurrency caps: 25 global, 3 per client IP
|
||
|
|
- `known_hosts=None` for lab self-signed/changing keys — tighten for production
|
||
|
|
- Idle timeout terminates abandoned sessions
|
||
|
|
- Passwords are not logged; avoid verbose debug of auth payloads
|
||
|
|
|
||
|
|
## Chat / LLM
|
||
|
|
|
||
|
|
- Fleet context is sent to vLLM / Open WebUI — treat as sensitive operational data
|
||
|
|
- Service account for Open WebUI should be least-privilege if possible
|
||
|
|
|
||
|
|
## Multi-user stability (related)
|
||
|
|
|
||
|
|
- Single worker process shares STATE safely for reads with asyncio
|
||
|
|
- SSH sessions are isolated per WebSocket
|
||
|
|
- OME poll uses short-lived API sessions and deletes them after fetch
|
||
|
|
|
||
|
|
## Recommendations for hardening (future)
|
||
|
|
|
||
|
|
1. Add OIDC / reverse-proxy auth in front of `:3090`
|
||
|
|
2. Persist SSH host key policy / CA trust
|
||
|
|
3. Audit log for SSH session start/stop (user, target, client IP)
|
||
|
|
4. Encrypt ticket DB at rest if tickets contain sensitive notes
|
||
|
|
5. Rotate lab service passwords regularly
|