92 lines
4.0 KiB
Markdown
92 lines
4.0 KiB
Markdown
# Task List
|
|
|
|
## Discovery (Complete)
|
|
|
|
- [x] Record MeshCentral version and deployment details.
|
|
- [x] Identify whether MeshCentral is reachable only internally, through VPN, or via public ingress.
|
|
- [x] Inventory current MeshCentral users, roles, device groups, and test endpoints.
|
|
- [x] Select one non-production test device.
|
|
- [x] Confirm where secrets and bridge logs may be stored.
|
|
- [x] Research the supported MeshCentral API/server integration options.
|
|
- [x] Check for maintained open-source adapters before building custom code.
|
|
|
|
## Design (Complete)
|
|
|
|
- [x] Choose bridge deployment location.
|
|
- [x] Define trust boundaries and network flows.
|
|
- [x] Define typed read-only tool contracts.
|
|
- [x] Define authentication, authorization, target allowlists, and audit-log format.
|
|
- [x] Define timeout, output-size, retry, and concurrency behavior.
|
|
- [x] Define prompt-injection handling for endpoint output.
|
|
|
|
## Build (Complete)
|
|
|
|
- [x] Implement connectivity/authentication proof of concept.
|
|
- [x] Implement device/group inventory.
|
|
- [x] Implement status and metadata retrieval.
|
|
- [x] Implement structured errors and health endpoint.
|
|
- [x] Add unit/integration tests using the selected test device or a mock server.
|
|
- [x] Add deployment and rollback documentation.
|
|
|
|
## Security Hardening (Complete)
|
|
|
|
- [x] Implement bounded request concurrency with safe defaults (5 concurrent requests).
|
|
- [x] Implement rate limiting using token bucket algorithm.
|
|
- [x] Add structured audit logging with automatic secret redaction.
|
|
- [x] Validate credentials before use (username format, password length).
|
|
- [x] Redact secrets in logs (base64, hex, known key patterns).
|
|
- [x] Enforce device/group allowlists for target protection.
|
|
- [x] Add bounded response size validation (1 MB max).
|
|
- [x] Implement protocol schema validation with Zod.
|
|
|
|
## Verification Status (Complete)
|
|
|
|
- [x] Test suite passes: 91/91 tests
|
|
- [x] TypeScript build passes with no errors
|
|
- [x] ESLint passes with no warnings
|
|
- [x] Security review findings reconciled in `review/FINAL-HARDENING-REVIEW.md`
|
|
|
|
## Live Verification (Complete)
|
|
|
|
- [x] `mesh.ledrew.me` resolves to the intended MeshCentral endpoint
|
|
- [x] TLS validation and `/control.ashx` WSS upgrade verified
|
|
- [x] `sa_clawdia` authenticated successfully with the protected credential file
|
|
- [x] `Servers` group inventory returned successfully
|
|
- [x] PVE3 was found in the `Servers` group
|
|
- [x] Real adapter mapped the live node correctly
|
|
- [x] No credentials, tokens, commands, diagnostics, or state-changing operations were exposed or performed
|
|
|
|
The live probe uses the upstream-compatible transport in `implementation/src/upstream-transport.ts`. MeshCentral's `serverversion` action is not used as the least-privilege health check because it requires server-upgrade capability; authenticated `meshes` inventory is the health check instead.
|
|
|
|
## Remaining Deployment/Review Work
|
|
|
|
1. Review the uncommitted diff and commit on a feature branch.
|
|
2. Complete an independent final security review against the newly integrated transport.
|
|
3. Complete deployment/rollback documentation for a future non-production deployment.
|
|
4. Add an OpenClaw-facing tool/MCP wrapper only after the read-only adapter contract is finalized.
|
|
|
|
**Deployment:**
|
|
1. Deploy bridge to an approved trusted host with restricted firewall (outbound only to the MeshCentral endpoint)
|
|
2. Configure runtime secrets via protected environment file (mode 0600)
|
|
3. Start bridge service with audit logging enabled
|
|
4. Verify health endpoint returns healthy=true
|
|
|
|
**Rollback:**
|
|
1. Stop bridge service
|
|
2. Rotate integration credential in MeshCentral immediately
|
|
3. Review audit logs for unauthorized access patterns
|
|
4. Document incident if rollback was due to failure
|
|
|
|
## Later (Only After Security Review)
|
|
|
|
- [ ] Add allowlisted diagnostics.
|
|
- [ ] Add explicit confirmation flow for reversible actions.
|
|
- [ ] Add dry-run support.
|
|
- [ ] Add idempotency and duplicate-execution protection.
|
|
|
|
## Not Approved
|
|
|
|
- [ ] Enable remote commands or state-changing actions
|
|
- [ ] Connect to PVE1/PVE2 production cluster
|
|
- [ ] Expose bridge or MeshCentral to public internet
|