felhom.eu/REPORT-offsite-append-only-2026-10-03.md

# REPORT — off-site backup safety, step 1: the append-only lock measured on the provider (2026-10-03)

A spike. No product code changed, no release. Evidence, exit test and design:
`documentation/audits/offsite-append-only-2026-10-03/`. Architecture read: `07-backup-architecture.md`
§8a, threat row 10, §D; `06-offsite-connectivity.md` (PBS/tunnel only — it does not describe the restic
tier, so the facts went to `07` §D). Baselines (re-verified): felhom.eu `f4c5466`, controller `0945332`
(v0.288.0), register 326 rows, highest id R-819.

## The Part table

| Part | done / not done / changed | why |
|---|---|---|
| 0 — venue | **changed** — `u629488-sub4` (tester-1) instead of a new scratch customer | operator ruled "use Tester1" in-session. tester-1's box was deleted 2026-09-30; nothing writes there. Credential: the hub's stored tester-1 value, read from a copy of the hub DB on a second operator ruling (copy deleted, value never printed or written to a committed file). A new repo dir `spike-r436` only; `felhom-repo` never read or written |
| A — the lock | **done**, exit test written first (`EXIT-TEST.md`) | E1–E8 and C1–C2 as stated; locks measured |
| B — the attacker | **done**, one item lab-only | raw-HTTP path escape through the pinned server measured in the lab only — a live HTTP/2 bridge over the forced ssh could not be made to work in the time box |
| C — design | **done** — `DESIGN.md`, STATUS decision 0 | |
| D — ep0 | **done** — `PART-D-ep0-safeguard.md`, STATUS decision 0b | read only; ep0 not touched |
| E — records | **done** | below |

## Claims in the brief (and the register) that turned out wrong

1. **"The box holds no sub-account password"** — it does not STORE one, but it can **obtain it at will**:
   declare `needs_credential` twice → the hub re-arms the stored value → the box consumes it (R-820).
2. **"A forced command cannot be bypassed by the sub-account itself"** — the pinned key cannot; the
   **password can** (logs in on ports 22 and 23, rewrote `authorized_keys` this session).
3. **"The hub cannot prune because of custody"** — true for *pruning*; but the hub can **delete**: it
   holds every sub-account password in the clear (R-821).
4. **"Both `forget` sites must change together"** — there are **four** deleting features on the box:
   both `forget` sites, the orphan move-aside (`mv`) and the abandonment (`rm -rf`).
5. **rclone in the image** (R-436 row: "rclone is not in the controller image today", implying it is
   needed) — **not needed**; restic 0.14.0 with `-o rclone.program="ssh … rclone"` is enough.
6. **R-342's first candidate, a Hetzner Volume snapshot** — does not exist.
7. **R-430's model** (a locks dir where deletion is refused) — does not describe this transport; the
   append-only server allows lock deletion and `unlock --remove-all` works.
8. **The vendor's cited blog** (`fluix.one`) shows the line WITHOUT `--append-only`; only Hetzner's
   ticket reply adds it. Copying the blog would give a deleting key.
9. Held: restic is **0.14.0** (`0.14.0-1+b5`); **restore works through the add-only key**.

## Part A — results (verbatim refusal)

`blob not removed, server response: 403 Forbidden (403)` for `forget d807418c --prune`,
`forget --keep-last 1` and a real `prune` (each ~45–48 s of retries, rc=1); snapshot count unchanged;
control key: `1 / 1 files deleted`. Crash lock: blocks `check`, not `backup`; plain `unlock` prints
success and removes nothing; `--remove-all` removes it. Files: `live/E1-E3…`, `live/E4-E6…`, `live/C2-A5…`.

## Part B — the attacker table

| Route | Tried how | Result | What closes it |
|---|---|---|---|
| Password, port 23 | `sshpass ssh -p 23` | **logs in**; `authorized_keys` read and **rewritten** | box never receives it (hub = key registrar) |
| Password, port 22 | `sshpass sftp -P 22` | **logs in** (SFTP), `.ssh` listed | same |
| Box obtains the password | source read | **yes, at will** (self-heal re-arm + consume) | same — R-820 |
| Pinned key: shell / `rm -rf` | `ssh … 'ls'`, `'rm -rf spike-r436'` | runs the forced rclone; repo intact | — (holds) |
| Pinned key: sftp / scp / rsync | each | refused / protocol error | — (holds) |
| Pinned key: port forward | `-L`, then connect | `administratively prohibited` | — (holds) |
| Pinned key: other path, no flag | `rclone serve restic --stdio felhom-repo` | pinned dir served, append-only | — (holds) |
| Pinned key: `../` escapes, overwrite | raw HTTP (lab) | 400 / 403 | — (holds; lab rclone) |
| Pinned key: add junk / new `keys/` | raw HTTP (lab) | allowed | quota fills — R-431/quota alarms |
| Pinned key: future-dated snapshots | restic (lab) | allowed → retention erases real history | poisoning guard — R-822 |
| Any key on port 22 | both test keys | refused (port 22 takes no OpenSSH key) | — |
| Hetzner API / panel | box code read | nothing on the box reaches either | — |
| Hub DB | operator-tier | every sub-account password in clear | R-821 |

**A route defeats the lock: the password (R-820).** The lock alone is not protection until it is closed.

## Records

- **Closed:** R-436 (measured; the 2026-10-06 due-check is cleared — the block is now empty), R-430.
- **Opened:** R-820 (P2, Security), R-821 (P2, Security), R-822 (P2, Backup). None is P1 by the
  scale: today the box's own key can already delete (R-95), so none adds harm *today*.
- **Updated:** R-95 (the measurement, the four sites, the proposal; rank untouched), R-342 (options costed).
- **Register: 326 → 327** (`register_shape_gate`). All felhom.eu gates green.
- `07` §D: one `[FACT]` block. STATUS: two decisions in the operator's format.
- `unproven.py --summary`: NOT WALKED 35 of 55 — unchanged.

## Teardown

- **Provider:** `authorized_keys` restored — sha256 `795e7153…` before and after, identical; `spike-r436`
  removed; `~/.config/rclone/` (created by the provider's rclone during the test) removed; home is back to
  `.ssh`, `felhom-repo`. Both test keys refused afterwards. (`live/TEARDOWN.txt`)
- **DooPlex:** lab container, network and image removed; test keys, the password file, the hub DB copy
  and hub page copies deleted from the scratchpad.
- **Hub:** nothing changed (two reads).
- **Left as is, on purpose:** the tester-1 sub-account password was NOT rotated — the next tester-1 install
  needs the stored value. R-821 covers why that is itself a risk.