mrcharles
6b6a8ff021
Split docs/ into project-based subdirectories:
- docs/proxmox/ fleet ops, hardware, k8s (PROJECT.md, TODO.md, K8S.md)
- docs/server-build/ provisioning, security, DNS (SECURITY.md, tailscale.md,
DEPLOYMENT.md, TSYS-2FA-GUIDE.md, DEVELOPMENT-GUIDELINES.md)
- docs/archive/ historical AI reviews, completed todos, pre-refactor docs
docmap.md rewritten with new paths. All cross-references in AGENTS.md,
README.md, STATUS.md, and dns-cluster-setup/README.md updated.
Code directories unchanged — scripts stay where BASH_SOURCE expects them.
🤖 Generated with [Crush](https://github.com/charmassociates/crush)
Assisted-by: GLM-5 via Crush <crush@charm.land>
4.4 KiB
4.4 KiB
Charles TODO - PFVCluster Security Improvements
Priority Order: High → Medium → Low
Target: Address security vulnerabilities and operational improvements
🚨 HIGH PRIORITY (Security Critical)
✅ 1. Replace Insecure Deployment Method - RESOLVED
Previous Issue: curl https://dl.knownelement.com/KNEL/FetchApply/SetupNewSystem.sh | bash
Status: Fixed in README.md - now uses secure git clone approach
Current Method: git clone this repo → cd PFVCluster/provisioning → bash SetupNewSystem.sh
Remaining considerations:
- Consider implementing GPG signature verification for tagged releases
- Add cryptographic checksums for external downloads within scripts
✅ 2. Enforce HTTPS for All Downloads - RESOLVED
Previous Issue: HTTP URLs in Dell OMSA and some repository setups Status: All HTTP URLs converted to HTTPS across:
provisioning/Dell/Server/omsa.sh- Ubuntu archive and Dell repo URLsprovisioning/legacy/prox7.sh- Proxmox download URLsprovisioning/Modules/RandD/sslStackFromSource.sh- Apache source URLs
Remaining considerations:
- SSL certificate validation is enabled by default in wget/curl
- Consider adding retry logic for certificate failures
3. Implement Secrets Management
Current Issue: SSH keys committed to repository, no secrets rotation Action Required:
- Deploy Bitwarden CLI or HashiCorp Vault integration
- Remove SSH public keys from repository
- Create secure key distribution mechanism
- Implement key rotation procedures
- Add environment variable support for sensitive data
Files to secure:
provisioning/ConfigFiles/SSH/AuthorizedKeys/(entire directory)- Hard-coded hostnames in various scripts
🔶 MEDIUM PRIORITY (Operational Security)
4. Add Script Integrity Verification
Action Required:
- Generate SHA256 checksums for all scripts
- Create checksum verification function in Framework-Includes
- Add signature verification for external downloads
- Implement rollback capability on verification failure
5. Enhanced Error Recovery
Action Required:
- Add state tracking for partial deployments
- Implement resume functionality for interrupted installations
- Create system restoration points before major changes
- Add dependency checking before module execution
6. Security Testing Framework
Action Required:
- Create integration tests for security configurations
- Add compliance validation (CIS benchmarks, STIG)
- Implement automated security scanning post-deployment
- Create test environments for validation
7. Configuration Validation
Action Required:
- Add pre-flight checks for system compatibility
- Validate network connectivity to required services
- Check for conflicting software before installation
- Verify sufficient disk space and system resources
🔹 LOW PRIORITY (Quality Improvements)
8. Documentation Enhancement
Action Required:
- Create detailed security architecture documentation
- Add troubleshooting guides for common issues
- Document security implications of each module
- Create deployment runbooks for different environments
9. Monitoring and Alerting
Action Required:
- Add deployment success/failure reporting
- Implement centralized logging for all installations
- Create dashboards for deployment status
- Add alerting for security configuration drift
10. User Experience Improvements
Action Required:
- Create web-based deployment interface
- Add progress indicators for long-running operations
- Implement dry-run mode for testing configurations
- Add interactive configuration selection
Implementation Timeline
✅ COMPLETED: Item 1 (Secure deployment method)
✅ COMPLETED: Item 2 (HTTPS enforcement)
Week 1: Item 3 (Secrets management)
Week 2-3: Items 4-5 (Operational improvements)
Month 2: Items 6-10 (Quality and monitoring)
Success Criteria
- No plaintext secrets in repository
- All downloads use HTTPS with verification ✅
- Deployment method is cryptographically secure ✅
- Automated testing validates security configurations
- Rollback capability exists for all changes
- Comprehensive documentation covers security implications
Resources Needed
- Access to package repository for signed distributions
- GPG key infrastructure for signing
- Secrets management service (Vault/Bitwarden)
- Test environment infrastructure
- Security scanning tools integration