rmm-openwrt/docs/security.md

Security Notes

Every enrolled router is a privileged remote-execution target. Use HTTPS, protect the SQLite database and tunnel private key, and keep the control plane restricted to trusted operators.

Trust model and current controls

• Browser users authenticate with Argon2id password hashes and random, revocable, server-side HttpOnly, SameSite=Strict sessions.
• The bootstrap bearer token is optional and administrator-scoped.
• Normal users can list and control only devices enrolled by their own one-time grants; device-object and admin-function authorization are enforced server-side.
• Device, enrollment, operator-session and LuCI access tokens are stored as SHA-256 fingerprints, not reusable plaintext credentials.
• Enrollment grants expire, are single-use and are limited per account. Shared enrollment exists only as an explicit compatibility switch.
• LuCI runs on a separate device subdomain. A 60-second grant creates a host-only access session scoped to one user, device and active reverse tunnel. Upstream router cookies cannot set parent domains or overwrite RMM cookie names.
• Request bodies and agent responses are capped at 2 MiB; login attempts are rate- and concurrency-limited; HTTP server timeouts and header limits are set.
• Agent command types and UCI packages are allowlisted. Stored command output redacts UCI and key/value secret forms.
• SSH tunnel accounts allow remote forwarding but no shell, PTY, agent forwarding, tunnel device, stream-local forwarding or SFTP sessions.
• Metric history defaults to 30-day retention. Expired authentication/access rows are removed by scheduled maintenance.
• SMTP credentials and the Telegram bot token are read only from the deployment environment. The browser API returns masked notification destinations and never returns channel credentials or full delivery destinations.
• Notification provider errors are logged server-side, while users receive a generic delivery error. Terminal notification history is removed by configurable retention; pending rows are preserved.
• The pending queue stores the full destination because the worker needs it for delivery. Treat the SQLite volume and its backups as sensitive data; the browser receives only a masked destination. Storage encryption and access control remain deployment concerns.
• The stable agent version is accepted from the remote update manifest only after an ECDSA signature verifies against the public package key bundled with the server image. The dashboard performs Semantic Version comparison and does not recommend downgrades.

Operational guidance

• Keep RMM_INSECURE_DEV_MODE, RMM_ALLOW_LEGACY_ENROLLMENT, and RMM_ALLOW_LEGACY_LUCI_PROXY disabled in production.
• Keep RMM_COOKIE_SECURE=true, use separate control and wildcard device hostnames, and obtain the wildcard certificate through DNS-01. See keendns.md.
• Expose port 2222 only to managed routers. Operator tunnel ports bind to loopback by default; expose them only through a VPN or a narrowly scoped firewall rule.
• Prefer uci_preview, uci_backup, and uci_commit_confirmed for network changes.
• Back up SQLite without deleting or recreating the live volume.
• Treat notification delivery errors as sensitive operational data and restrict database backups to trusted administrators.
• Delivery is at-least-once. A rare duplicate is possible if a provider accepted a message immediately before the server stopped and its lease later expired.

Remaining hardening work

• Issue a distinct SSH key or short-lived SSH certificate per device instead of sharing one persistent tunnel key.
• Add device-token rotation/revocation and optional mTLS or signed requests.
• Add command approval policies for reboot, package changes, restore, UCI commit and remote access.
• Add organization-level tenancy, recovery codes/MFA and external identity-provider integration before offering the service as public SaaS.
• Add distributed rate limiting when running more than one server instance.
• Add automated dependency/container vulnerability scanning and policy checks for the SBOM already generated by CI.
• Encrypt webhook secrets and pending notification destinations at the application layer.