Jon Chery
0f7f9cf914
---ci--- project: orca phase: 27 milestone: v0.12 status: execute ---/ci--- docs/threat-model.md (STRIDE + OS surface + residual risks), docs/oidc.md (bundled Dex + BYO + claim mapping + offline), docs/webauthn.md (passkeys + RP ID + bootstrap sequence), docs/security-runbook.md (seal/unseal + rotation + incident response).
2.6 KiB
2.6 KiB
Orca Threat Model (v0.12)
Overview
Orca is a minimalist, offline-first, CLI-first orchestration engine. v0.12 adopts a zero-trust identity model (R-021): no Orca-issued credentials. Human identity is exclusively OIDC; machine identity is exclusively mTLS/SPIFFE.
R-021 — No Orca Credentials
Orca never issues, stores, or accepts human-identity credentials.
- Human identity: OIDC (external IdP or bundled Dex + WebAuthn)
- Machine identity: mTLS + SPIFFE SVIDs
- No passwords, no Orca-issued tokens, no CA-key passphrases
STRIDE Analysis
| Component | Spoofing | Tampering | Repudiation | Info Disclosure | DoS | Elevation |
|---|---|---|---|---|---|---|
| OIDC client | mitigated by JWKS verification | — | mitigated by ID token | — | — | — |
| WebAuthn connector | mitigated by public-key auth | — | mitigated by signed assertions | — | — | — |
| ACL | mitigated by deny-by-default + OIDC claims | — | mitigated by audit log | — | — | mitigated by least-privilege perms |
| Master key seal | — | mitigated by AES-256-GCM + Shamir | — | mitigated by 0600 + sealing | — | — |
| SSH-push transport | mitigated by key auth + TOFU/pin | — | mitigated by audit | — | mitigated by rate limiting (v1.x) | — |
| Daemon (deprecated) | mitigated by mandatory mTLS | — | mitigated by audit | mitigated by body limits | mitigated by body limits | mitigated by ACL |
| Backup/restore | — | mitigated by HMAC signature | — | mitigated by symlink validation | — | — |
| Audit log | — | mitigated by hash chain + append-only trigger | — | — | — | — |
| Drift detection | mitigated by per-peer HMAC | — | — | — | — | — |
| nftables ingress | — | — | — | — | mitigated by conntrack + rate limit | — |
| sudoers | — | — | — | — | — | mitigated by NOEXEC + least-privilege |
OS Surface
Orca writes to: /etc/orca/, /etc/traefik/orca*, /etc/systemd/system/orca-*,
/etc/nftables.d/orca*, /etc/syncthing/orca*, /etc/sudoers.d/orca.
All via SSH-push (key auth, no passwords). The orca system user is
nologin (no shell access). Scripts run as root only for file writes
to /etc/ (the operator pre-stages the SSH key; no password flows).
Residual Risks
- Legacy CA/mTLS/daemon dual-write window (v1.x closure)
- SQLite unencrypted at rest (0600 file mode; CGO-free SQLCipher is v1.x)
- Master key compromise compromises all historical secrets (no forward secrecy)
- IdP loss: Shamir 3-of-5 recovery; if quorum unavailable, unrecoverable by design
- Transport rate limiting + typed errors (v1.x)