ome-cockpit/docs/SECURITY.md

Security

Lab-oriented controls. This is not a hardened public multi-tenant SaaS.

Secrets

Secret	Location	Git
OME password	.env	Excluded
Open WebUI service password	.env	Excluded
Ticket DB	/data/ops.db	Excluded
SSH user passwords	Never stored server-side; transient WS auth only	N/A

Use .env.example as a template with CHANGE_ME placeholders.

Network exposure

• Cockpit has no application auth in the current lab build — rely on ATC network segmentation / VPN / reverse proxy if exposed beyond trusted LAN.
• Prefer binding publish ports to trusted interfaces only in stricter environments.

SSH bridge

• Destination host must match a current fleet management IP
• Concurrency caps: 25 global, 3 per client IP
• known_hosts=None for lab self-signed/changing keys — tighten for production
• Idle timeout terminates abandoned sessions
• Passwords are not logged; avoid verbose debug of auth payloads

Chat / LLM

• Fleet context is sent to vLLM / Open WebUI — treat as sensitive operational data
• Service account for Open WebUI should be least-privilege if possible

Multi-user stability (related)

• Single worker process shares STATE safely for reads with asyncio
• SSH sessions are isolated per WebSocket
• OME poll uses short-lived API sessions and deletes them after fetch

Recommendations for hardening (future)

1. Add OIDC / reverse-proxy auth in front of :3090
2. Persist SSH host key policy / CA trust
3. Audit log for SSH session start/stop (user, target, client IP)
4. Encrypt ticket DB at rest if tickets contain sensitive notes
5. Rotate lab service passwords regularly