# Security

## Reporting a vulnerability

Please do **not** open a public issue. Send a description and, if possible, steps to
reproduce to the maintainer via a private message on
[git.retronerd.at](https://git.retronerd.at/schiwagoa). You will get an answer within a
few days; fixes are released as soon as possible and mentioned in the changelog.

## Security model

| Part | Trust | Protection |
|---|---|---|
| Browser → web UI | untrusted | login (local / OIDC / proxy), CSRF token on every change, Origin check, strict CSP, no caching |
| Web UI container | holds the SSH key for all agents | non-root (UID 10050), read-only root FS, no capabilities, `no-new-privileges`, bound to 127.0.0.1 by default |
| Web UI → agent | SSH with a single ed25519 key | host keys pinned (`StrictHostKeyChecking=yes`), key restricted with `restrict`, `from=` and a forced command |
| Agent (`f2b-webctl`) | runs as root via one sudo rule | fixed command whitelist, strict IP/jail validation, never bans private, own or protected addresses, syslog of every action |

What the web UI **cannot** do on a host: open a shell, forward ports, run other commands,
change fail2ban configuration, or ban protected addresses.

What an attacker **with access to the web UI** can do: ban and unban public IPs on the
configured hosts. Protect the UI accordingly (strong password or SSO, reverse proxy with
TLS, ideally an IP allow list).

Recommendations:

- Always install the agent with `--from <address of the web UI>`.
- Keep the `data/` directory (SSH key, session secret) readable for UID 10050 only.
- Rebuild or pull the image regularly – the base image receives Debian security updates.