KNEL/football
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: fix PRD consistency and align all docs with SSH client-only (FR-006)

Browse Source 
PRD fixes:
- Remove duplicate 'Installation Behavior' section
- Fix malformed terminology table (missing pipe separator)

Documentation alignment with FR-006:
- README.md: Change SSH/firewall to client-only, no inbound access
- TEST-COVERAGE.md: Remove 'Firewall allows SSH inbound'
- VERIFICATION-REPORT.md: Fix password config docs to match preseed.cfg
- COMPLIANCE.md: Change 'SSH Hardening' to 'SSH Client-Only'

Test enhancements:
- Expand unit tests for encryption, firewall, security hardening
- Add comprehensive coverage for FR-001 through FR-009 requirements

All changes ensure documentation and tests align with PRD.md FR-006
which requires SSH client-only with no server or inbound access.

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>
This commit is contained in:
Charles N Wyble
2026-02-19 16:04:38 -05:00
parent f13bb8577a
commit d4c64b85fa
17 changed files with 335 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/COMPLIANCE.md
View File

@@ -29,7 +29,7 @@ This document maps security compliance requirements to implementation components
| Control | STIG ID | CIS Control | Implementation | Hook/Script | Status |
|---------|----------|-------------|----------------|-------------|--------|
| SSH Hardening | RHEL-08-010000 | 5.2 | Secure SSH configuration | `src/security-hardening.sh` | ✅ |
| SSH Client-Only | RHEL-08-010000 | 5.2 | Client config, no server | `src/security-hardening.sh` | ✅ |
| Password Policy | RHEL-08-020200 | 5.1 | pwquality.conf with 14-char minimum | `src/security-hardening.sh` | ✅ |
| System Resource Limits | RHEL-08-040123 | 5.3 | limits.d/security.conf | `src/security-hardening.sh` | ✅ |
| File Permissions | RHEL-08-040040 | 3.3 | Secure file permissions | `src/security-hardening.sh` | ✅ |
@@ -117,7 +117,7 @@ The built ISO includes test capabilities for post-installation validation:
- ✅ USB automount support for secure configuration transfer
- ✅ Minimal desktop with IceWM and privacy-focused LightDM
- ✅ SSH hardening with restricted access
- ✅ SSH client-only (no server, no inbound access)
- ✅ Strong password policy (14 characters minimum)
- ✅ Comprehensive audit logging with auditd
- ✅ Package management disabled for immutable system