47 lines
2.6 KiB
Markdown
47 lines
2.6 KiB
Markdown
# Security and safety requirements
|
||
|
||
## Baseline
|
||
|
||
This bridge is a remote-management control plane. Treat its credentials and command path as highly sensitive.
|
||
|
||
## Required controls
|
||
|
||
- Use a dedicated MeshCentral account, never Rob’s primary administrator account.
|
||
- Grant the minimum MeshCentral permissions needed for the current phase.
|
||
- Keep the bridge on the trusted LAN or an isolated management network.
|
||
- Do not expose MeshCentral, the bridge, or an MCP endpoint directly to the public internet.
|
||
- Store secrets in a protected runtime secret store or environment file with restrictive permissions; never commit secrets.
|
||
- Use TLS for connections where supported and validate certificates appropriately.
|
||
- Authenticate and authorize every bridge request.
|
||
- Restrict targets using explicit device/group allowlists.
|
||
- Apply command allowlists or typed operations rather than accepting unrestricted shell text by default.
|
||
- Log authentication events, requests, target, operation, confirmation, result, and timestamp without logging secrets.
|
||
- Set timeouts, output limits, concurrency limits, and rate limits.
|
||
- Fail closed when the bridge, MeshCentral, or authorization state is uncertain.
|
||
- Provide a kill switch and documented rollback procedure.
|
||
|
||
## Action classes
|
||
|
||
| Class | Examples | Default policy |
|
||
|---|---|---|
|
||
| Read-only | Inventory, status, uptime, disk usage, service state | Allowed after authentication |
|
||
| Diagnostic execution | Approved health checks, log collection, connectivity tests | Targeted; explicit request; logged |
|
||
| Reversible change | Restart an approved service, create a diagnostic bundle | Immediate explicit confirmation |
|
||
| Disruptive change | Reboot, shutdown, stop service, change network settings | Explicit confirmation with impact shown |
|
||
| Destructive/high-risk | Delete files, uninstall software, disable security, arbitrary scripts | Disabled initially; separate approval/design required |
|
||
|
||
## OpenClaw-specific safety rule
|
||
|
||
Availability of a MeshCentral capability is not permission to use it. A state-changing operation requires Rob’s clear instruction and a confirmation immediately before execution. Ambiguous requests are clarification points, not authorization.
|
||
|
||
## Threat model to review
|
||
|
||
- Compromise of the bridge host or MeshCentral LXC
|
||
- Theft or misuse of the integration credential
|
||
- Prompt injection from endpoint output or device names
|
||
- Accidental targeting of the wrong device or group
|
||
- Command output containing secrets or personal data
|
||
- Replay or duplicate execution of an action
|
||
- MeshCentral/API version changes
|
||
- Network partition or partial execution across multiple targets
|