107 lines
6.0 KiB
Markdown
107 lines
6.0 KiB
Markdown
# Central management deployment and operating model
|
|
|
|
The administrator interface is a separate web application served by the management
|
|
service. The managed browser is a device client, not an administrative trust
|
|
boundary. Opening the console in an enterprise browser does not grant permissions:
|
|
the backend authenticates the administrator and authorizes every API operation.
|
|
|
|
## Deployment topology
|
|
|
|
Run the Node management service under a dedicated service identity with access only
|
|
to its protected data directory. Bind `HOST=127.0.0.1` and publish it through the
|
|
organization's HTTPS reverse proxy on an administrative hostname. Set `PUBLIC_URL`
|
|
to that exact HTTPS origin, including the port if applicable. Keep port 4310 off
|
|
public interfaces and make administrative access subject to corporate network and
|
|
identity controls. The service does not terminate TLS itself.
|
|
|
|
Do not add permissive CORS or weaken the existing CSP. Forward the original Origin
|
|
header unchanged; origin validation must compare it to `PUBLIC_URL`. The service
|
|
uses secure, HTTP-only, SameSite session cookies on HTTPS and does not trust proxy
|
|
headers for user identity. Configure the TLS proxy to issue HSTS after the HTTPS
|
|
deployment has been validated. Do not use the loopback HTTP development URL for a
|
|
remote deployment.
|
|
|
|
Register the exact `${PUBLIC_URL}/auth/callback` redirect with the corporate OIDC
|
|
provider. Require MFA or phishing-resistant authentication at the identity provider.
|
|
Use distinct administrator, operator and auditor groups. An employee's browser
|
|
enrollment permission must not grant an administrative role.
|
|
|
|
## Deployment credentials and keys
|
|
|
|
Supply secrets through protected service configuration rather than frontend files,
|
|
URLs or policy documents. Protect the SQLite database, signing keys, backups, ICAPS
|
|
client keys and SIEM credentials with service-account ACLs and encrypted storage.
|
|
The development `.env` file is not a production secret distribution mechanism.
|
|
|
|
Require the protected management channel, and deploy its pinned ML-DSA public key
|
|
to browser installations through a trusted endpoint-management channel:
|
|
|
|
```text
|
|
REQUIRE_PQ_MANAGEMENT_CHANNEL=true
|
|
SAFETYNET_REQUIRE_CHANNEL_PIN=true
|
|
SAFETYNET_CHANNEL_SIGNATURE_KEY_FILE=C:/ProgramData/SafetyNet/management-public.pem
|
|
```
|
|
|
|
This public key is not a secret. Confirm its fingerprint independently of the
|
|
browser enrollment response. The custom policy envelope adds application-level
|
|
protection over HTTPS; it does not replace TLS, identity verification or independent
|
|
cryptographic review. Enrollment, audit and AI endpoints still rely on HTTPS.
|
|
|
|
## Operator workflow
|
|
|
|
1. Verify fleet last-seen times, policy version distribution, inspector configuration
|
|
and SIEM delivery state in the overview. A configured feature is not evidence that
|
|
every deployed device has exercised it successfully.
|
|
2. Start from a policy template and review its proposed additions. Preserve the
|
|
customer's existing proxy, VPN, DNS and ICAPS trust configuration.
|
|
3. Edit a draft, review changed policy paths, and publish with the displayed version.
|
|
A version conflict requires reloading and reviewing the current policy.
|
|
4. Teach document references using authorized source documents. Persisted teaching
|
|
features are hashes and, when configured, local vectors; the source document is
|
|
not retained. Inspect completeness before approving partial coverage.
|
|
5. Validate allowed and blocked transfers with a controlled receiver before enabling
|
|
a new detection threshold across a company. A block test alone does not establish
|
|
an acceptable false-positive rate.
|
|
6. Use managed bookmarks for intranet destinations. User bookmark read/edit access
|
|
and user editing permissions are centrally governed and enforced by the backend.
|
|
7. Export audit events to the existing SIEM using its supported authenticated
|
|
ingestion format. Exercise receiver failure and cursor resumption.
|
|
|
|
The present rollout publishes one organization-wide policy. Group assignments,
|
|
canary deployment rings, independent approval, SCIM, key rotation and retention
|
|
automation remain tracked implementation work; the console must not imply they are
|
|
already available.
|
|
|
|
## Local inspector containment
|
|
|
|
On Windows the inspector applies an unnamed, non-inheritable Job Object before
|
|
importing parsers or model code. It limits the complete process tree to four
|
|
processes and 4 GiB committed memory, denies breakaway, and terminates descendant
|
|
model workers when the inspector exits or is killed. Failure to attach the boundary
|
|
fails inspector startup. The browser checks the startup capability declaration.
|
|
|
|
The HTTP broker now keeps parsers outside its own process. Each document request
|
|
launches a separate AppContainer worker, attests its actual token and zero
|
|
capabilities, and exchanges bytes over bounded anonymous pipes. Only its approved
|
|
source, Python and local model trees receive read/execute grants for the specific
|
|
package SID. Nested jobs terminate leftover model workers. Native probes establish
|
|
private-file read denial, runtime write denial, TCP/UDP transmission denial and
|
|
child-token inheritance for the tested installation.
|
|
|
|
Windows still provides package-private storage and some system resources. Do not
|
|
claim that all possible writes or exploit classes are excluded. Protected Program
|
|
Files deployments need installer/service-provisioned package-SID ACLs; ordinary
|
|
users cannot be expected to change installation DACLs. Runtime preparation and
|
|
packaging explicitly provision these ACLs; normal startup only verifies access
|
|
and fails closed when permissions are missing. External
|
|
or linked runtime/model trees are rejected. Production installer preparation and
|
|
independent sandbox bypass testing remain release gates.
|
|
|
|
## Release gates
|
|
|
|
Track the exhaustive requirement matrix in `docs/requirements-audit.md`. Complete
|
|
native transfer coverage and parser isolation, customer integration testing, signed
|
|
installers and updates, and an independent security assessment before production
|
|
deployment. The unpacked Windows executable is a developer build with required
|
|
side resources, not a production installer.
|