reachableceo
e80725005f
DeepReport-2026-05-08.md: Full security audit with 39 findings (6 CRITICAL, 9 HIGH, 12 MEDIUM, 7 LOW, 5 INFO). STATUS.md: Updated to reflect actual audit state with honest assessment of gaps. Removed inflated compliance claims. Added remediation progress tracker. Compliance claims acknowledged as aspirational by project owner. Session 8 will focus on fixing all technical findings. 💘 Generated with Crush Assisted-by: GLM-5.1 via Crush <crush@charm.land>
130 lines
5.2 KiB
Markdown
130 lines
5.2 KiB
Markdown
# KNEL-Football Project Status Report
|
|
|
|
> **Last Updated**: 2026-05-08 (Session 8 - Post-Audit Remediation)
|
|
> **Maintained By**: AI Agent (Crush)
|
|
> **Purpose**: Quick-glance status for project manager
|
|
|
|
---
|
|
|
|
## Current Status: 🔧 REMEDIATION IN PROGRESS
|
|
|
|
### Executive Summary
|
|
Deep audit completed (2026-05-08). Report: `DeepReport-2026-05-08.md`. 39 findings total (6 CRITICAL, 9 HIGH, 12 MEDIUM, 7 LOW, 5 INFO). Now executing Phase 1 & 2 remediation. Compliance claims acknowledged as aspirational — technical controls being fixed now.
|
|
|
|
---
|
|
|
|
## Remediation Progress
|
|
|
|
| # | Finding | Severity | Status |
|
|
|---|---------|----------|--------|
|
|
| C-01 | Argon2id KDF not enforced | CRITICAL | ⬜ Pending |
|
|
| C-02 | Host FDE check never called | CRITICAL | ⬜ Pending |
|
|
| C-03 | Docker --privileged | CRITICAL | ⬜ Pending |
|
|
| C-04 | SB keys unencrypted (-nodes) | CRITICAL | ⬜ Pending |
|
|
| C-05 | USB automount noexec/nosuid/nodev | CRITICAL | ⬜ Pending |
|
|
| C-06 | Plaintext creds in git history | CRITICAL | ⬜ Pending (requires git scrub) |
|
|
| H-01 | StrictHostKeyChecking ask | HIGH | ⬜ Pending |
|
|
| H-02 | sshd_config written | HIGH | ⬜ Pending |
|
|
| H-03 | src/firewall missing ct state | HIGH | ⬜ Pending |
|
|
| H-04 | QR code temp file insecure | HIGH | ⬜ Pending |
|
|
| H-05 | cryptsetup broken syntax | HIGH | ⬜ Pending |
|
|
| H-06 | Hardcoded /dev/sda3 | HIGH | ⬜ Pending |
|
|
| H-07 | sbverify returns success on fail | HIGH | ⬜ Pending |
|
|
| H-08 | Missing module.sig_enforce | HIGH | ⬜ Pending |
|
|
| H-09 | Build cache no integrity | HIGH | ⬜ Pending |
|
|
| M-01 | apply_security_hardening missing calls | MEDIUM | ⬜ Pending |
|
|
| M-02 | Sudo group conflict | MEDIUM | ⬜ Pending |
|
|
| M-03 | PAM not configured | MEDIUM | ⬜ Pending |
|
|
| M-04 | Recovery key plaintext | MEDIUM | ⬜ Pending |
|
|
| M-05 | Firewall allows any WG endpoint | MEDIUM | ⬜ Pending |
|
|
| M-06 | AIDE not initialized | MEDIUM | ⬜ Pending |
|
|
| M-07 | Mount hardening existing fstab only | MEDIUM | ⬜ Pending |
|
|
| M-08 | USB no audit logging | MEDIUM | ⬜ Pending |
|
|
| M-09 | Build not reproducible | MEDIUM | ⬜ Deferred (post-deployment) |
|
|
| M-10 | No GPG signing | MEDIUM | ⬜ Deferred (post-deployment) |
|
|
| M-11 | Docker base not digest-pinned | MEDIUM | ⬜ Pending |
|
|
| M-12 | WiFi blacklist incomplete | MEDIUM | ⬜ Pending |
|
|
|
|
**Legend**: ✅ Done | 🔧 In Progress | ⬜ Pending | ⏭ Deferred
|
|
|
|
---
|
|
|
|
## PRD → Code → Tests Alignment Matrix
|
|
|
|
|| PRD Requirement | Code | Tests | Audit Status |
|
|
||-----------------|------|-------|-------------|
|
|
|| FR-001: FDE (Argon2id) | encryption-*.sh | 10 files | 🔧 KDF defaults to PBKDF2 |
|
|
|| FR-002: Debian Base | preseed.cfg | config tests | ✅ |
|
|
|| FR-003: Desktop | desktop-environment.sh | 5 files | ✅ |
|
|
|| FR-004: Network/Firewall | firewall-setup.sh | 7 files | 🔧 Missing ct state in src/ |
|
|
|| FR-005: Hardware Control | security-hardening.sh | 5 files | 🔧 Blacklist incomplete |
|
|
|| FR-006: SSH Client | security-hardening.sh | 5 files | 🔧 StrictHostKeyChecking ask |
|
|
|| FR-007: System Hardening | hardening hooks | 12 files | 🔧 PAM not enforced |
|
|
|| FR-008: USB Automount | usb-automount.sh | 5 files | 🔧 Missing noexec/nosuid/nodev |
|
|
|| FR-009: Immutability | disable-pkg-mgmt.sh | 6 files | ✅ |
|
|
|| FR-010: ISO Build | build-iso.sh, Dockerfile | 8 files | ✅ |
|
|
|| FR-011: Host FDE | run.sh check | system tests | 🔧 Check never called |
|
|
|| FR-012: Secure Boot/UKI | run.sh | secureboot tests | 🔧 Keys unencrypted |
|
|
|
|
---
|
|
|
|
## Build Information
|
|
|
|
|| Item | Value |
|
|
||------|-------|
|
|
|| Docker Image | `knel-football-dev:latest` |
|
|
|| Build Command | `./run.sh iso` |
|
|
|| Output Location | `output/knel-football-secure.iso` |
|
|
|| ISO Status | ✅ BUILT (824 MB, 2026-05-07) |
|
|
|| Validation Command | `./run.sh validate` |
|
|
|
|
---
|
|
|
|
## Compliance Status
|
|
|
|
> **Note**: Compliance claims are aspirational targets for future production release.
|
|
> Current focus is on implementing correct technical controls.
|
|
|
|
| Standard | Technical Controls | Org Controls | Status |
|
|
|----------|-------------------|-------------|--------|
|
|
| NIST SP 800-111 | 🔧 In progress | N/A | Technical only |
|
|
| NIST SP 800-53 (partial) | 🔧 In progress | N/A | Technical only |
|
|
| CIS Benchmarks | 🔧 In progress | N/A | Technical only |
|
|
| CMMC L3 | ⏭ Future | ⏭ Future | Aspirational |
|
|
| FedRAMP | ⏭ Future | ⏭ Future | Aspirational |
|
|
| ISO 27001 | ⏭ Future | ⏭ Future | Aspirational |
|
|
|
|
---
|
|
|
|
## Known Limitations
|
|
|
|
| Item | Status | Notes |
|
|
|------|--------|-------|
|
|
| Compliance claims | Aspirational | Org controls require dedicated future session |
|
|
| GRUB Serial Output | Not configured | GRUB uses VGA; serial boot detection limited |
|
|
| End-to-end Install Test | Not done | Full install + encryption prompt needs manual testing |
|
|
| Build Reproducibility | Deferred | Requires SOURCE_DATE_EPOCH, fixed mirrors |
|
|
| GPG Artifact Signing | Deferred | Requires key management infrastructure |
|
|
|
|
---
|
|
|
|
## Architecture
|
|
|
|
```
|
|
KNEL-Football OS (this image)
|
|
│
|
|
│ WireGuard VPN (outbound only)
|
|
▼
|
|
Privileged Access Workstation (Windows 11)
|
|
│
|
|
│ Direct access
|
|
▼
|
|
Tier0 Infrastructure
|
|
```
|
|
|
|
**No inbound services** - SSH client, RDP client (Remmina), WireGuard client only.
|
|
|
|
---
|
|
|
|
*This file is maintained by the AI agent. For AI memory and insights, see JOURNAL.md.*
|