boris/keywarden
1
1 Fork 0
Code Issues 17 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

test coverage improvements; mTLS enforcement; agent broke :(

Browse Source
This commit is contained in:
boris committed 2026-04-17 20:53:44 +01:00
1 parent 921b760f80
commit 31b726b439
43 files changed
+3343 -80
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

evidence/FAST_FIXES_STATUS.md
+40
View File
@@ -0,0 +1,40 @@
# Fast Fix Status
This tracks the fastest issues and where reproducible evidence now lives.
## Completed in this pass
- RBAC wording aligned to implemented roles (`administrator`, `user`, alias `admin`):
- [users.py](/opt/compose/keywarden/app/keywarden/api/routers/users.py#L15)
- [access.py](/opt/compose/keywarden/app/keywarden/api/routers/access.py#L168)
- [agent.py](/opt/compose/keywarden/app/keywarden/api/routers/agent.py#L214)
- [API_DOCS.md](/opt/compose/keywarden/API_DOCS.md#L39)
- Repeatable evidence collector added:
- [collect_evidence.sh](/opt/compose/keywarden/scripts/collect_evidence.sh)
- Automated operational metrics extraction added:
- [summarize_operational_metrics.sh](/opt/compose/keywarden/scripts/summarize_operational_metrics.sh)
- Diagram sources added (Mermaid):
- [architecture.mmd](/opt/compose/keywarden/evidence/diagrams/architecture.mmd)
- [deployment.mmd](/opt/compose/keywarden/evidence/diagrams/deployment.mmd)
- [erd.mmd](/opt/compose/keywarden/evidence/diagrams/erd.mmd)
- [access-sync-flow.mmd](/opt/compose/keywarden/evidence/diagrams/access-sync-flow.mmd)
- Manual evidence templates added:
- [browser-matrix.md](/opt/compose/keywarden/evidence/templates/browser-matrix.md)
- [security-test-report.md](/opt/compose/keywarden/evidence/templates/security-test-report.md)
- [standards-checklist.md](/opt/compose/keywarden/evidence/templates/standards-checklist.md)
## Generated baseline run
- Run folder: [20260416T213000Z](/opt/compose/keywarden/evidence/runs/20260416T213000Z)
- Summary: [SUMMARY.md](/opt/compose/keywarden/evidence/runs/20260416T213000Z/SUMMARY.md)
- Test output: [django-tests.txt](/opt/compose/keywarden/evidence/runs/20260416T213000Z/tests/django-tests.txt)
- Test failure summary: [django-tests-failures-summary.txt](/opt/compose/keywarden/evidence/runs/20260416T213000Z/tests/django-tests-failures-summary.txt)
- Coverage text report: [coverage-report.txt](/opt/compose/keywarden/evidence/runs/20260416T213000Z/tests/coverage-report.txt)
- Coverage XML: [coverage-xml.xml](/opt/compose/keywarden/evidence/runs/20260416T213000Z/tests/coverage-xml.xml)
- Agent endpoint counts: [agent-endpoint-status-counts.txt](/opt/compose/keywarden/evidence/runs/20260416T213000Z/logs/agent-endpoint-status-counts.txt)
- Operational evaluation summary: [operational-summary.md](/opt/compose/keywarden/evidence/runs/20260416T225300Z/evaluation/operational-summary.md)
## Still pending (not fast, or partly manual)
- Screenshot capture for dissertation figures (manual execution, now templated).
- Deep security hardening tasks (shell host-key model, strict mTLS enforcement, SPOF mitigation, push-based revocation).
evidence/README.md
+80
View File
@@ -0,0 +1,80 @@
# Evidence Pack
This folder is for dissertation evidence that can be regenerated on demand.
## Quick Start
Run from repo root:
```bash
bash scripts/collect_evidence.sh
```
Optional custom run id:
```bash
bash scripts/collect_evidence.sh 2026-04-16-baseline
```
Outputs are written to `evidence/runs/<run-id>/`.
To autofill templates for an existing run:
```bash
bash scripts/autofill_evidence_templates.sh <run-id>
```
To capture UI screenshots for an existing run:
```bash
bash scripts/capture_ui_screenshots.sh <run-id>
```
To include screenshot capture during evidence collection:
```bash
KEYWARDEN_EVIDENCE_CAPTURE_SCREENSHOTS=1 bash scripts/collect_evidence.sh <run-id>
```
## What Is Collected
- Git and environment snapshot (`meta/`)
- Docker Compose state and container runtime info (`runtime/`)
- Django test execution output (`tests/`)
- Coverage summary + XML when available (`tests/coverage-report.txt`, `tests/coverage-xml.xml`)
- Log extracts and endpoint/status summaries (`logs/`)
- Derived operational metrics and summary (`evaluation/`)
- RBAC/role-claim grep evidence (`docs/`)
- Copy of diagram sources and report templates (`diagrams/`, `templates/`)
- Autofilled template versions in each run (`templates/*.md`)
- Optional automated UI screenshots (`screenshots/`)
## Operational Metrics
The collector now derives evaluation-friendly metrics from `agent-access` logs:
- heartbeat intervals per server
- endpoint/status distributions per server
- heartbeat error-to-recovery timings
- markdown summary for direct report inclusion
Artifacts are written to `evidence/runs/<run-id>/evaluation/`.
## Diagram Sources
Mermaid sources live in `evidence/diagrams/`:
- `architecture.mmd`
- `deployment.mmd`
- `erd.mmd`
- `access-sync-flow.mmd`
These are plain text and version-controlled, so they are easy to revise and re-render.
## Manual Evidence Templates
Templates for remaining manual work are in `evidence/templates/`:
- browser test matrix
- security test report
- standards checklist (OWASP/NIST-oriented)
evidence/diagrams/access-sync-flow.mmd
+19
View File
@@ -0,0 +1,19 @@
sequenceDiagram
participant U as User
participant K as Keywarden
participant A as Agent
participant S as Server
U->>K: Upload SSH public key
K->>K: Issue SSH user certificate
U->>K: Request server access
Admin->>K: Approve access request
A->>K: Poll heartbeat/accounts/ssh-ca
K-->>A: Approved users + CA public key
A->>S: Enforce accounts + SSH CA trust
U->>S: SSH using key + certificate
K->>K: Revoke/expire access
A->>K: Next poll cycle
K-->>A: Updated account state
A->>S: Remove or lock account access
evidence/diagrams/architecture.mmd
+13
View File
@@ -0,0 +1,13 @@
flowchart LR
User[User Browser] --> Web[Keywarden UI/API]
Admin[Admin Browser] --> Web
Web <--> IdP[OIDC Provider]
Web --> PG[(PostgreSQL)]
Web --> Cache[(Valkey/Redis)]
Web --> CA[(SSH User CA)]
Agent[Linux Agent] --> Web
Agent --> SSH[Managed Server SSHD]
User --> SSH
Web -. optional .-> Shell[Browser Shell WS Proxy]
Shell --> SSH
evidence/diagrams/deployment.mmd
+19
View File
@@ -0,0 +1,19 @@
flowchart TB
subgraph DockerCompose
Nginx[Nginx]
Gunicorn[Gunicorn Django]
Daphne[Daphne WebSocket]
Celery[Celery Worker/Beat]
Redis[Valkey/Redis]
end
Nginx --> Gunicorn
Nginx --> Daphne
Gunicorn --> PG[(Keywarden PostgreSQL)]
Celery --> PG
Gunicorn --> Redis
Celery --> Redis
Agent[Agent on Managed Host] --> Nginx
Browser[User/Admin Browser] --> Nginx
IdP[Authentik/OIDC] --> Nginx
evidence/diagrams/erd.mmd
+11
View File
@@ -0,0 +1,11 @@
erDiagram
USER ||--o{ SSHKEY : owns
SSHKEY ||--o{ SSHCERTIFICATE : signs
USER ||--o{ ACCESSREQUEST : requests
SERVER ||--o{ ACCESSREQUEST : targets
SERVER ||--o{ SERVERACCOUNT : contains
USER ||--o{ SERVERACCOUNT : maps_to
SERVER ||--o{ SERVERAUDITLOG : ingests
SERVER ||--o{ TELEMETRYEVENT : emits
USER ||--o{ AUDITLOG : performs
evidence/templates/browser-matrix.md
+28
View File
@@ -0,0 +1,28 @@
# Browser Test Matrix
## How To Complete
1. Copy this template into a run folder (or let `collect_evidence.sh` do it).
2. Fill metadata first: date, URL, commit.
3. For each browser cell, use one of: `PASS`, `FAIL`, `PARTIAL`, `N/A`.
4. Add a short symptom in `Notes` for every non-pass result.
5. Add exact artifact paths in `Evidence Path` (screenshots/HAR/console output).
## Metadata
Date (UTC):
Environment URL:
Commit:
Run ID:
| Area | Chrome | Firefox | Safari | Edge | Notes | Evidence Path |
|---|---|---|---|---|---|---|
| Login / OIDC | | | | | | |
| Dashboard | | | | | | |
| Key upload | | | | | | |
| Server registration | | | | | | |
| Access approve/revoke | | | | | | |
| Audit logs | | | | | | |
| Server detail + heartbeat | | | | | | |
| Browser shell page render | | | | | | |
| Browser shell interactive session | | | | | | |
evidence/templates/security-test-report.md
+50
View File
@@ -0,0 +1,50 @@
# Security Test Report
## How To Complete
1. Fill metadata fields and keep them aligned with the evidence run ID.
2. For each test row, set `Pass/Fail` to `PASS`, `FAIL`, `PARTIAL`, or `N/A`.
3. Put concrete observations in `Actual` (status code, rejection text, behavior).
4. Always link an evidence artifact path for each completed row.
5. Keep findings evidence-backed; avoid conclusions without artifacts.
## Metadata
Date (UTC):
Environment URL:
Commit:
Run ID:
Tester:
## Scope
- Authentication and session handling
- Authorization boundaries
- Token handling
- Input validation
- File/command safety
- WebSocket controls
## Test Cases
| ID | Area | Test | Expected | Actual | Pass/Fail | Evidence Path |
|---|---|---|---|---|---|---|
| SEC-01 | Input validation | Submit malformed SSH key payload | 4xx with validation error | | | |
| SEC-02 | Auth bypass | Call admin API as non-admin | 403 | | | |
| SEC-03 | Token misuse | Use revoked/invalid agent token | 401/403 | | | |
| SEC-04 | Object permission | Access server not granted to user | 403 | | | |
| SEC-05 | Session/CSRF | Unsafe method without CSRF/session validity | Blocked | | | |
| SEC-06 | File handling | Upload invalid file/path content | Rejected safely | | | |
| SEC-07 | Command injection | Shell input escaping checks | No command injection path | | | |
| SEC-08 | WebSocket shell auth | Open shell WS without scope | Rejected | | | |
| SEC-09 | Host key verification | Shell verifies host identity | Verified or documented gap | | | |
## Findings
- High:
- Medium:
- Low:
## Follow-up Actions
-
evidence/templates/standards-checklist.md
+44
View File
@@ -0,0 +1,44 @@
# Standards Checklist
## How To Complete
1. Fill metadata and ensure it matches the evidence run folder.
2. Use one status value per row: `Meets`, `Partially Meets`, `Does Not Meet`, `Not Evaluated`.
3. Add at least one concrete artifact path for each status decision.
4. In `Notes`, explain why the evidence is sufficient or insufficient.
5. Keep `Gap Summary` focused on what still blocks compliance confidence.
## Metadata
Date (UTC):
Environment URL:
Commit:
Run ID:
## OWASP ASVS (selected)
| Control | Requirement | Status | Evidence Path | Notes |
|---|---|---|---|---|
| V1 | Architecture/design documented | | | |
| V2 | Authentication controls | | | |
| V3 | Session management | | | |
| V4 | Access control enforcement | | | |
| V5 | Input validation and encoding | | | |
| V7 | Error handling and logging | | | |
| V8 | Data protection at rest/in transit | | | |
| V10 | Malicious code / injection resistance | | | |
## NIST SP 800-53 / 800-63-aligned checks (selected)
| Control Family | Requirement | Status | Evidence Path | Notes |
|---|---|---|---|---|
| AC | Least privilege / access enforcement | | | |
| AU | Auditable events and retention | | | |
| IA | Identity proofing and authentication federation | | | |
| SC | Cryptographic protections and key handling | | | |
| CM | Configuration and change management | | | |
| CP | Resilience / single point of failure acknowledgement | | | |
## Gap Summary
-