Security

The host only makes outgoing connections, and the server only keeps reports signed by approved hosts.

Agent identity

On its first run the agent makes an RSA 3072 key and a self-signed certificate (CN = the host name, valid 20 years) in /var/lib/drra, readable by root only. The key never leaves the host.

Registration

The agent sends its certificate to register.php with a time stamp and a one time nonce, signed with its key, which proves it holds the key. The server checks that the certificate's CN is the host name, and saves the registration as pending, or approved when the enrollment token matches. A host name that is already registered with another key gets key_mismatch.

Signed uploads

Each upload carries the report's SHA-256 hash (and the hash of each HTML report or hook file), the host name, a time stamp and a nonce, signed with RSA PKCS#1 v1.5 and SHA-256. The server checks the signature against the registered certificate, refuses agents that are not approved, refuses a time stamp more than max_clock_skew_seconds (300) from its clock, and refuses a nonce it has seen, so a captured upload cannot be sent again.

TLS

Uploads use HTTPS through libcurl and OpenSSL with certificate and host name checks against the system trust store, or ca_file for a private CA. verify_peer=0 and use_https=0 exist for test servers only.

The service

The agent runs as root to read the package database, SELinux, firewalld and sshd settings and the DMI serial number. The systemd unit makes /usr, /boot and /etc read only, home folders read only, /tmp private, and sets NoNewPrivileges, kernel tunable and module protection, at low CPU and I/O priority. Files the agent writes are private to root. Report hooks run only from root owned, not group or world writable files, and can run as another user.

Server side

• Keep server.ini and the data folder outside the web root, or behind the Require all denied .htaccess that install_server.sh adds.
• admin.php runs only behind a login (web server or DRSM dashboard) and uses CSRF tokens.
• The include files and vex_sync.php are blocked from the web.
• Hook uploads are taken only for hook IDs with a manifest, up to max_bytes.

Limits

• Anyone with root on a host can read its key and send reports as that host. Revoke a host that was compromised.
• With an enrollment token, anyone who has the token can register a new host name. Keep the token secret and empty it after a rollout.
• Reports hold the host's package list, users and settings: protect the reports folder and the DRSM dashboard with a login.