Jon Chery
0f7f9cf914
---ci--- project: orca phase: 27 milestone: v0.12 status: execute ---/ci--- docs/threat-model.md (STRIDE + OS surface + residual risks), docs/oidc.md (bundled Dex + BYO + claim mapping + offline), docs/webauthn.md (passkeys + RP ID + bootstrap sequence), docs/security-runbook.md (seal/unseal + rotation + incident response).
48 lines
2.6 KiB
Markdown
48 lines
2.6 KiB
Markdown
# Orca Threat Model (v0.12)
|
|
|
|
## Overview
|
|
|
|
Orca is a minimalist, offline-first, CLI-first orchestration engine.
|
|
v0.12 adopts a **zero-trust identity model** (R-021): no Orca-issued
|
|
credentials. Human identity is exclusively OIDC; machine identity is
|
|
exclusively mTLS/SPIFFE.
|
|
|
|
## R-021 — No Orca Credentials
|
|
|
|
Orca never issues, stores, or accepts human-identity credentials.
|
|
- Human identity: OIDC (external IdP or bundled Dex + WebAuthn)
|
|
- Machine identity: mTLS + SPIFFE SVIDs
|
|
- No passwords, no Orca-issued tokens, no CA-key passphrases
|
|
|
|
## STRIDE Analysis
|
|
|
|
| Component | Spoofing | Tampering | Repudiation | Info Disclosure | DoS | Elevation |
|
|
|-----------|----------|-----------|-------------|-----------------|-----|-----------|
|
|
| OIDC client | mitigated by JWKS verification | — | mitigated by ID token | — | — | — |
|
|
| WebAuthn connector | mitigated by public-key auth | — | mitigated by signed assertions | — | — | — |
|
|
| ACL | mitigated by deny-by-default + OIDC claims | — | mitigated by audit log | — | — | mitigated by least-privilege perms |
|
|
| Master key seal | — | mitigated by AES-256-GCM + Shamir | — | mitigated by 0600 + sealing | — | — |
|
|
| SSH-push transport | mitigated by key auth + TOFU/pin | — | mitigated by audit | — | mitigated by rate limiting (v1.x) | — |
|
|
| Daemon (deprecated) | mitigated by mandatory mTLS | — | mitigated by audit | mitigated by body limits | mitigated by body limits | mitigated by ACL |
|
|
| Backup/restore | — | mitigated by HMAC signature | — | mitigated by symlink validation | — | — |
|
|
| Audit log | — | mitigated by hash chain + append-only trigger | — | — | — | — |
|
|
| Drift detection | mitigated by per-peer HMAC | — | — | — | — | — |
|
|
| nftables ingress | — | — | — | — | mitigated by conntrack + rate limit | — |
|
|
| sudoers | — | — | — | — | — | mitigated by NOEXEC + least-privilege |
|
|
|
|
## OS Surface
|
|
|
|
Orca writes to: `/etc/orca/`, `/etc/traefik/orca*`, `/etc/systemd/system/orca-*`,
|
|
`/etc/nftables.d/orca*`, `/etc/syncthing/orca*`, `/etc/sudoers.d/orca`.
|
|
All via SSH-push (key auth, no passwords). The `orca` system user is
|
|
`nologin` (no shell access). Scripts run as root only for file writes
|
|
to `/etc/` (the operator pre-stages the SSH key; no password flows).
|
|
|
|
## Residual Risks
|
|
|
|
- Legacy CA/mTLS/daemon dual-write window (v1.x closure)
|
|
- SQLite unencrypted at rest (0600 file mode; CGO-free SQLCipher is v1.x)
|
|
- Master key compromise compromises all historical secrets (no forward secrecy)
|
|
- IdP loss: Shamir 3-of-5 recovery; if quorum unavailable, unrecoverable by design
|
|
- Transport rate limiting + typed errors (v1.x)
|