mrcharles
a7fbad60ab
Comprehensive documentation gardening across the merged repo: - tailscale.md: fully rewritten with current ground truth. The netinfra pair now runs production Technitium with all knel.net records replicated. Both LAN IPs resolve knel.net device names and recurse externally. The old "NXDOMAIN / zone is stale" findings are replaced with the resolved state and current recommendations. - AGENTS.md: rewritten with Gitea-compatible clickable relative links to all key scripts and docs. Autonomous commit/push policy prominently documented. SSH user corrected to localuser. - README.md: directory table and docs table now use clickable links. - All .md cross-references converted to Gitea-renderable relative links. - Stale path references (ProjectCode/, Project-Tests/, ProjectDocs/) updated to current names (provisioning/, tests/) across all docs. - Stale repo name "FetchApply" / "KNELServerBuild" updated to "PFVCluster" in actionable docs; historical AI-review docs tagged with an HTML comment notice. - REFACTORING-EXAMPLES.md: tagged as historical (pre-refactor patterns). - tests/README.md, dns-cluster-setup/README.md, docs/DEPLOYMENT.md, docs/SECURITY.md: path references fixed to current structure. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
4.4 KiB
4.4 KiB
Charles TODO - PFVCluster Security Improvements
Priority Order: High → Medium → Low
Target: Address security vulnerabilities and operational improvements
🚨 HIGH PRIORITY (Security Critical)
✅ 1. Replace Insecure Deployment Method - RESOLVED
Previous Issue: curl https://dl.knownelement.com/KNEL/FetchApply/SetupNewSystem.sh | bash
Status: Fixed in README.md - now uses secure git clone approach
Current Method: git clone this repo → cd PFVCluster/provisioning → bash SetupNewSystem.sh
Remaining considerations:
- Consider implementing GPG signature verification for tagged releases
- Add cryptographic checksums for external downloads within scripts
✅ 2. Enforce HTTPS for All Downloads - RESOLVED
Previous Issue: HTTP URLs in Dell OMSA and some repository setups Status: All HTTP URLs converted to HTTPS across:
provisioning/Dell/Server/omsa.sh- Ubuntu archive and Dell repo URLsprovisioning/legacy/prox7.sh- Proxmox download URLsprovisioning/Modules/RandD/sslStackFromSource.sh- Apache source URLs
Remaining considerations:
- SSL certificate validation is enabled by default in wget/curl
- Consider adding retry logic for certificate failures
3. Implement Secrets Management
Current Issue: SSH keys committed to repository, no secrets rotation Action Required:
- Deploy Bitwarden CLI or HashiCorp Vault integration
- Remove SSH public keys from repository
- Create secure key distribution mechanism
- Implement key rotation procedures
- Add environment variable support for sensitive data
Files to secure:
provisioning/ConfigFiles/SSH/AuthorizedKeys/(entire directory)- Hard-coded hostnames in various scripts
🔶 MEDIUM PRIORITY (Operational Security)
4. Add Script Integrity Verification
Action Required:
- Generate SHA256 checksums for all scripts
- Create checksum verification function in Framework-Includes
- Add signature verification for external downloads
- Implement rollback capability on verification failure
5. Enhanced Error Recovery
Action Required:
- Add state tracking for partial deployments
- Implement resume functionality for interrupted installations
- Create system restoration points before major changes
- Add dependency checking before module execution
6. Security Testing Framework
Action Required:
- Create integration tests for security configurations
- Add compliance validation (CIS benchmarks, STIG)
- Implement automated security scanning post-deployment
- Create test environments for validation
7. Configuration Validation
Action Required:
- Add pre-flight checks for system compatibility
- Validate network connectivity to required services
- Check for conflicting software before installation
- Verify sufficient disk space and system resources
🔹 LOW PRIORITY (Quality Improvements)
8. Documentation Enhancement
Action Required:
- Create detailed security architecture documentation
- Add troubleshooting guides for common issues
- Document security implications of each module
- Create deployment runbooks for different environments
9. Monitoring and Alerting
Action Required:
- Add deployment success/failure reporting
- Implement centralized logging for all installations
- Create dashboards for deployment status
- Add alerting for security configuration drift
10. User Experience Improvements
Action Required:
- Create web-based deployment interface
- Add progress indicators for long-running operations
- Implement dry-run mode for testing configurations
- Add interactive configuration selection
Implementation Timeline
✅ COMPLETED: Item 1 (Secure deployment method)
✅ COMPLETED: Item 2 (HTTPS enforcement)
Week 1: Item 3 (Secrets management)
Week 2-3: Items 4-5 (Operational improvements)
Month 2: Items 6-10 (Quality and monitoring)
Success Criteria
- No plaintext secrets in repository
- All downloads use HTTPS with verification ✅
- Deployment method is cryptographically secure ✅
- Automated testing validates security configurations
- Rollback capability exists for all changes
- Comprehensive documentation covers security implications
Resources Needed
- Access to package repository for signed distributions
- GPG key infrastructure for signing
- Secrets management service (Vault/Bitwarden)
- Test environment infrastructure
- Security scanning tools integration