51 lines
4.8 KiB
Markdown
51 lines
4.8 KiB
Markdown
# Security review 2026-10-12 — findings (short form, operator option A)
|
||
|
||
Reviewed: controller `dcd89364a4` · agent `86adbcaf8a` · felhom.eu `c9b9432986` · catalog `1a642b43e7`.
|
||
For a finding that is still open, this page names the missing check only. Code paths, evidence and proposed tests for
|
||
open findings are held off-git on DooPlex: `/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`.
|
||
`second read` = a fresh subagent traced the claim on its own (holds / partly); `self` = re-read by the session.
|
||
|
||
| ID | area | finding | static / measured | tech sev | Sev | second read | row |
|
||
|---|---|---|---|---|---|---|---|
|
||
| SR-01 | hub | The hub's operator key was readable in public git history and still worked | measured | Critical | P1 | holds | R-950 (CLOSED: rotated) |
|
||
| SR-02 | hub | Three hub read routes needed no credential | measured | High | P1 | holds | R-951 (CLOSED: hub 0.148.0) |
|
||
| SR-03 | box | A box's own hub key can read and replace the box's settings file; no signature | static | High | P2 | holds | R-970 |
|
||
| SR-04 | catalog | A catalog push reaches every box; the box does not check container privileges | static | High | P2 | holds | R-971 (decision) |
|
||
| SR-05 | build | Shipped binaries on an unsupported Go; base images with fixable criticals | measured | High | P2 | self | R-972 |
|
||
| SR-06 | agent | A compromised controller can force backups that prune older restore points | static | Medium | P3 | partly (local holds) | R-973 |
|
||
| SR-07 | host | The PBS root wrapper acts as root on a folder the agent controls | static | Medium | P3 | self | R-974 |
|
||
| SR-08 | hub | Customer tunnel, Cloudflare and git tokens unsealed in the hub database | static | Medium | P3 | self | R-975 |
|
||
| SR-09 | box | Family session copied to apps; a password reset does not end family/gate sessions | static | Medium | P3 | self | R-976 |
|
||
| SR-10 | box | FileBrowser default password can return; tunnel may start before the claim | static | Medium | P3 | self | R-977 |
|
||
| SR-11 | agent | Re-running the escrow ceremony can void the written recovery code | static | Medium | P3 | self | R-978 |
|
||
| SR-12 | updates | Controller updates trusted by tag only; unvouched tags offered | static | Medium | P3 | self | R-979 |
|
||
| SR-13 | install | The installer and ISO cannot be checked as ours | static | Medium | P3 | self | R-980 |
|
||
| SR-14 | catalog | homepage has the Docker socket and no login or gate | static | Medium | P3 | self | R-981 |
|
||
| SR-15 | host | Root password SSH from the LAN | measured | Medium | P3 | self | R-982 |
|
||
| SR-16 | box | Seven small dashboard weaknesses (redirect, GET reboot, framing, limiter, …) | static | Low | P3 | self | R-983 |
|
||
| SR-17 | host | Nine small host/agent hardening items | static + measured | Low | P4 | self | R-984 |
|
||
| SR-18 | promise | Zero-knowledge wording is stronger than a live box allows | static | Medium | P3 | self | R-985 (decision) |
|
||
| SR-19 | process | No scanner on any push; catalog images never scanned | measured | Medium | P3/P4 | self | R-986, R-987 |
|
||
| SR-20 | hub | The exposure window cannot be seen in the logs | measured | — | P2 | self | R-954 (decision) |
|
||
| SR-21 | process | A gate test writes into the real repo when pushed from a worktree | measured | Low | — | self | note on R-935 |
|
||
| SR-22 | hub | Nothing fails when a new hub route has no login decision | static | Medium | P3 | — | R-952 |
|
||
| SR-23 | hub | A full ArgoCD sync with prune would delete three live Secrets | measured | Medium | P3 | — | R-953 |
|
||
| SR-24 | hub | Cross-box check: holds in source and tests; not fully proven | static + tests | — | P4 | — | R-955 |
|
||
|
||
**SR-01 (closed).** The key was rotated on 2026-10-12 with the operator's go; the old value now gets 403/401.
|
||
Whether it was used before is SR-20.
|
||
**SR-02 (closed).** Hub 0.148.0: operator key only; test plus red-proof; live check in `evidence/hub-0.148.0-live-check.txt`.
|
||
**SR-03 – SR-05.** Open Highs; see the next-task list.
|
||
|
||
## Next tasks, ranked
|
||
|
||
1. **R-954 — the operator decides about the box root passwords** (the exposure window is not visible in the logs).
|
||
2. **R-970 — remove the box's settings-file route** (nothing calls it), with a test that it is gone.
|
||
3. **R-972 — rebuild the controller, hub and agent on a supported, patched Go**, update x/crypto, refresh the base
|
||
images. Today Go 1.27 and 1.26 are supported; the shipped controller and hub use 1.24.13 (unsupported) and the agent
|
||
1.26.0 (supported line, missing nine patch releases). Source: the Go release policy and the scanner output above.
|
||
4. **R-971 — the operator decides on the catalog privilege check; then build the box-side check.**
|
||
5. **R-952 — the hub route guard test.**
|
||
6. **R-953 — stop ArgoCD from wanting to prune the three live Secrets.**
|
||
7. Then the Medium rows in order: R-973, R-974, R-975, R-976, R-977, R-978, R-979, R-980, R-981, R-982, R-985.
|