Jon Chery
0f7f9cf914
---ci--- project: orca phase: 27 milestone: v0.12 status: execute ---/ci--- docs/threat-model.md (STRIDE + OS surface + residual risks), docs/oidc.md (bundled Dex + BYO + claim mapping + offline), docs/webauthn.md (passkeys + RP ID + bootstrap sequence), docs/security-runbook.md (seal/unseal + rotation + incident response).
32 lines
1.1 KiB
Markdown
32 lines
1.1 KiB
Markdown
# Security Runbook (v0.12)
|
|
|
|
## Master Key Seal/Unseal
|
|
|
|
- `orca cluster seal`: encrypts master key with OIDC-derived key;
|
|
prints 5 Shamir shards for offline recovery.
|
|
- `orca cluster unseal`: operator authenticates via OIDC; master key
|
|
unwrapped into memory; zeroed on shutdown.
|
|
- `orca cluster unseal --recovery`: if IdP lost, present 3 of 5 shards.
|
|
|
|
## Master Key Rotation
|
|
|
|
`orca secrets rotate-master [--dry-run]`: generates new master key,
|
|
re-encrypts all namespace secrets, re-seals. Atomic + automatic rollback.
|
|
|
|
## Incident Response
|
|
|
|
1. Revoke the compromised identity (OIDC user/group or SPIFFE SVID).
|
|
2. Rotate the master key (`orca secrets rotate-master`).
|
|
3. Review the audit log (`orca doctor audit` verifies the hash chain).
|
|
4. If the master key is compromised, all historical secrets are
|
|
compromised (no forward secrecy).
|
|
|
|
## Sudoers Audit
|
|
|
|
`orca doctor proxmox` audits the `/etc/sudoers.d/orca` file against the
|
|
expected allowlist (pct + qm with NOEXEC; apt-get/dpkg excluded).
|
|
|
|
## nft Audit
|
|
|
|
`orca doctor nft` audits the live nftables ruleset against the emitted one.
|