70 lines
4.2 KiB
Markdown
70 lines
4.2 KiB
Markdown
# Security Notes
|
|
|
|
Every enrolled router is a privileged remote-execution target. Use HTTPS, protect the
|
|
SQLite database and tunnel private key, and keep the control plane restricted to trusted
|
|
operators.
|
|
|
|
## Trust model and current controls
|
|
|
|
- Browser users authenticate with Argon2id password hashes and random, revocable,
|
|
server-side `HttpOnly`, `SameSite=Strict` sessions.
|
|
- The bootstrap bearer token is optional and administrator-scoped.
|
|
- Normal users can list and control only devices enrolled by their own one-time grants;
|
|
device-object and admin-function authorization are enforced server-side.
|
|
- Device, enrollment, operator-session and LuCI access tokens are stored as SHA-256
|
|
fingerprints, not reusable plaintext credentials.
|
|
- Enrollment grants expire, are single-use and are limited per account. Shared enrollment
|
|
exists only as an explicit compatibility switch.
|
|
- LuCI runs on a separate device subdomain. A 60-second grant creates a host-only access
|
|
session scoped to one user, device and active reverse tunnel. Upstream router cookies
|
|
cannot set parent domains or overwrite RMM cookie names.
|
|
- Request bodies and agent responses are capped at 2 MiB; login attempts are rate- and
|
|
concurrency-limited; HTTP server timeouts and header limits are set.
|
|
- Agent command types and UCI packages are allowlisted. Stored command output redacts UCI
|
|
and key/value secret forms.
|
|
- SSH tunnel accounts allow remote forwarding but no shell, PTY, agent forwarding, tunnel
|
|
device, stream-local forwarding or SFTP sessions.
|
|
- Metric history defaults to 30-day retention. Expired authentication/access rows are
|
|
removed by scheduled maintenance.
|
|
- SMTP credentials and the Telegram bot token are read only from the deployment
|
|
environment. The browser API returns masked notification destinations and never returns
|
|
channel credentials or full delivery destinations.
|
|
- Notification provider errors are logged server-side, while users receive a generic
|
|
delivery error. Terminal notification history is removed by configurable retention;
|
|
pending rows are preserved.
|
|
- The pending queue stores the full destination because the worker needs it for delivery.
|
|
Treat the SQLite volume and its backups as sensitive data; the browser receives only a
|
|
masked destination. Storage encryption and access control remain deployment concerns.
|
|
- The stable agent version is accepted from the remote update manifest only after an
|
|
ECDSA signature verifies against the public package key bundled with the server image.
|
|
The dashboard performs Semantic Version comparison and does not recommend downgrades.
|
|
|
|
## Operational guidance
|
|
|
|
- Keep `RMM_INSECURE_DEV_MODE`, `RMM_ALLOW_LEGACY_ENROLLMENT`, and
|
|
`RMM_ALLOW_LEGACY_LUCI_PROXY` disabled in production.
|
|
- Keep `RMM_COOKIE_SECURE=true`, use separate control and wildcard device hostnames, and
|
|
obtain the wildcard certificate through DNS-01. See [keendns.md](keendns.md).
|
|
- Expose port `2222` only to managed routers. Operator tunnel ports bind to loopback by
|
|
default; expose them only through a VPN or a narrowly scoped firewall rule.
|
|
- Prefer `uci_preview`, `uci_backup`, and `uci_commit_confirmed` for network changes.
|
|
- Back up SQLite without deleting or recreating the live volume.
|
|
- Treat notification delivery errors as sensitive operational data and restrict database
|
|
backups to trusted administrators.
|
|
- Delivery is at-least-once. A rare duplicate is possible if a provider accepted a message
|
|
immediately before the server stopped and its lease later expired.
|
|
|
|
## Remaining hardening work
|
|
|
|
- Issue a distinct SSH key or short-lived SSH certificate per device instead of sharing one
|
|
persistent tunnel key.
|
|
- Add device-token rotation/revocation and optional mTLS or signed requests.
|
|
- Add command approval policies for reboot, package changes, restore, UCI commit and remote
|
|
access.
|
|
- Add organization-level tenancy, recovery codes/MFA and external identity-provider
|
|
integration before offering the service as public SaaS.
|
|
- Add distributed rate limiting when running more than one server instance.
|
|
- Add automated dependency/container vulnerability scanning and policy checks for the
|
|
SBOM already generated by CI.
|
|
- Encrypt webhook secrets and pending notification destinations at the application layer.
|