4 Commits

Include renames

Author	SHA1	Message	Date
Ilker ManapandClaude Opus 5.5	2f708e8f69	Root rotation without re-joining: prepare, switch, retire ... The CA directory holds the active root and, during a rotation, the next or the previous one; everything that trusts the region gets the trust bundle (all of them). Rack controllers receive it in their state, signed by the active root; the root update unit installs it only when the signature verifies against the roots it already trusts, and binary signatures verify against any of them. After switch racks renew their client and server certificates from the new root by themselves and report what they run on; switch and retire wait for every rack (-force). /ca.pem stays one certificate, the root of that server's certificate, and the PXE command line names that root, so agents in older images keep working; /ca-bundle.pem is the bundle. Deployed machines get one file per root and a daily timer that refreshes them from their rack over HTTPS. Refs #12 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-31 15:37:44 +01:00
Ilker ManapandClaude Opus 5.5	703b8f1b7b	rack update: work directory on /var/lib (/run is noexec) ... Found by the first signed update on pxe-rack2: the signature verified, then the copy in /run could not be executed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 18:55:07 +01:00
Ilker ManapandClaude Opus 5.5	a549f01ef5	Security review: fix traversal, identity, injection and takeover paths ... Findings from a full review (auth/API, CA and rack channel, config generation, integrations, UI/agents/scripts), each verified in code: - rack binary endpoint read any region file via arch=../.. (CA key) - render endpoint traversal; machine-reported MACs used as file paths - delegated intermediates could mint admin/rack identities and IPs; identities now require root-issued certs, intermediates are ServerAuth-only with both name types constrained - rack certs were ServerAuth for rack-chosen SANs: now client-only; racks accept only the region's own cert; join checks the CA fingerprint; unbound join codes cannot take an existing name; job results bound to the rack that took them - rack self-update: region signs binaries with the CA key, the root unit verifies against the join-time CA in a root-owned dir - dnsmasq reads a checked, root-owned copy limited to generated options - commissioning could overwrite deployed machines; MAC takeover of PXE - injection into dnsmasq/cloud-init/PXE/udev/DNS via names and machine-reported strings; stored XSS in the UI; CSP and cross-origin protection; deploy agent shell injection and seed traversal - Redfish requests confined to the BMC's /redfish/ tree - admin_http defaults to loopback; body limits and timeouts; secrets off command lines Also: IPAM claim/reconcile race, sync stopping on one error, watchdog race, release wiping the wrong disk, SAN LUNs as auto targets. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 17:58:42 +01:00
Ilker ManapandClaude Opus 5.5	bbe45804c7	Rack controllers update themselves to the region's version ... The region offers its binary (version, arch, sha256) in each rack's state and serves it over mutual TLS; the rack stages it after checking checksum and version; a root path unit installs it, restarts the rack and rolls back if it does not register within a minute. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 13:59:52 +01:00