-
Notifications
You must be signed in to change notification settings - Fork 13
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Alexey Igrychev <[email protected]>
- Loading branch information
1 parent
a8c16d0
commit ec58e48
Showing
17 changed files
with
138 additions
and
99 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,19 +1,19 @@ | ||
<section class="security solve-that__section"> | ||
<div class="container container--wide solve-that__container"> | ||
<div class="container--wide solve-that__container"> | ||
<div class="solve-that__wrap"> | ||
<div class="solve-that__title block__title block__subtitle--invert"> | ||
Security | ||
</div> | ||
<p class="block__description block__subtitle--invert">trdl is designed to minimize the damage from potential attacks on the release system. The Vault secret manager, the TUF-based repository (The Update Framework), and Git are the three main components that make this possible. | ||
</p> | ||
</div> | ||
<div class="security-bg__lines"> | ||
<!-- <div class="security-bg__lines"> | ||
<svg width="879" height="543" viewBox="0 0 879 543" fill="none" xmlns="http://www.w3.org/2000/svg"> | ||
<path d="M749.197 145V396C749.197 415.882 733.079 432 713.197 432H274" stroke="#A41FE2" stroke-width="4"/> | ||
<path d="M876.196 6L876.197 455" stroke="#A41FE2" stroke-width="4"/> | ||
<path d="M60 486H776.08C795.962 486 812.08 469.882 812.08 450V0" stroke="#333037" stroke-width="4"/> | ||
<path d="M676 541H0" stroke="#A41FE2" stroke-width="4"/> | ||
</svg> | ||
</div> | ||
</div> --> | ||
</div> | ||
</section> |
60 changes: 29 additions & 31 deletions
60
docs/_includes/documentation/security_en/not-protecting.html
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,35 +1,33 @@ | ||
<section class="security how-work__section"> | ||
<div class="container"> | ||
<div class="how-work__wrap"> | ||
<div class="how-work__title block__title">What trdl does <span>not protect</span> against</div> | ||
<div class="architecture__cols"> | ||
<div class="architecture__cols--item col__client"> | ||
<ul class="col__list"> | ||
<li class="col__item"> | ||
<svg class="server__icon warning"> | ||
<use xlink:href="/images/icons/sprite.svg#warning"></use> | ||
</svg> | ||
<p> | ||
trdl cannot protect you against threats related to physical access to the host where the trdl-client is installed. | ||
</p> | ||
</li> | ||
</ul> | ||
</div> | ||
|
||
<div class="architecture__cols--item col__client"> | ||
<ul class="col__list"> | ||
<li class="col__item"> | ||
<svg class="server__icon warning"> | ||
<use xlink:href="/images/icons/sprite.svg#warning"></use> | ||
</svg> | ||
<p> | ||
trdl cannot protect you against human errors, e.g., incorrect GPG signature quorum configuration, improper build instructions, and faulty Vault config. | ||
</p> | ||
</li> | ||
</ul> | ||
</div> | ||
<section class="security how-work__section ignore-sidebar"> | ||
<div class="how-work__wrap"> | ||
<div class="how-work__title block__title">What trdl does <span>not protect</span> against</div> | ||
<div class="architecture__cols"> | ||
<div class="architecture__cols--item col__client"> | ||
<ul class="col__list"> | ||
<li class="col__item"> | ||
<svg class="server__icon warning"> | ||
<use xlink:href="/images/icons/sprite.svg#warning"></use> | ||
</svg> | ||
<p> | ||
trdl cannot protect you against threats related to physical access to the host where the trdl-client is installed. | ||
</p> | ||
</li> | ||
</ul> | ||
</div> | ||
|
||
<div class="architecture__cols--item col__client"> | ||
<ul class="col__list"> | ||
<li class="col__item"> | ||
<svg class="server__icon warning"> | ||
<use xlink:href="/images/icons/sprite.svg#warning"></use> | ||
</svg> | ||
<p> | ||
trdl cannot protect you against human errors, e.g., incorrect GPG signature quorum configuration, improper build instructions, and faulty Vault config. | ||
</p> | ||
</li> | ||
</ul> | ||
</div> | ||
|
||
</div> | ||
|
||
</div> | ||
</section> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
42 changes: 20 additions & 22 deletions
42
docs/_includes/documentation/security_en/recommendations.html
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,25 +1,23 @@ | ||
<section class="security how-work__section"> | ||
<div class="container"> | ||
<div class="how-work__wrap"> | ||
<div class="how-work__title block__title">Our recommendations</div> | ||
<div class="recommendations"> | ||
<ul class="card__list recommendations__list"> | ||
<div class="recommendations__col"> | ||
<li class="card__item recommendations__item">Use an external authentication provider instead of the Vault root token.</li> | ||
<!-- item --> | ||
<li class="card__item recommendations__item">Set up an NGINX proxy to secure access to Vault by switching to HTTPS and enabling access only to certain Vault endpoints.</li> | ||
<!-- item --> | ||
<li class="card__item recommendations__item">Run Docker on the same host as Vault and block outside access to Docker.</li> | ||
<!-- item --> | ||
</div> | ||
<div class="recommendations__col"> | ||
<li class="card__item recommendations__item">Do not install any other software on the virtual machine where Vault and the trdl plugin are running.</li> | ||
<!-- item --> | ||
<li class="card__item recommendations__item">Use the common and proven methods of protecting the OS/host.</li> | ||
<!-- item --> | ||
</div> | ||
</ul> | ||
</div> | ||
<section class="security how-work__section ignore-sidebar"> | ||
<div class="how-work__wrap"> | ||
<div class="how-work__title block__title">Our recommendations</div> | ||
<div class="recommendations"> | ||
<ul class="card__list recommendations__list"> | ||
<div class="recommendations__col"> | ||
<li class="card__item recommendations__item">Use an external authentication provider instead of the Vault root token.</li> | ||
<!-- item --> | ||
<li class="card__item recommendations__item">Set up an NGINX proxy to secure access to Vault by switching to HTTPS and enabling access only to certain Vault endpoints.</li> | ||
<!-- item --> | ||
<li class="card__item recommendations__item">Run Docker on the same host as Vault and block outside access to Docker.</li> | ||
<!-- item --> | ||
</div> | ||
<div class="recommendations__col"> | ||
<li class="card__item recommendations__item">Do not install any other software on the virtual machine where Vault and the trdl plugin are running.</li> | ||
<!-- item --> | ||
<li class="card__item recommendations__item">Use the common and proven methods of protecting the OS/host.</li> | ||
<!-- item --> | ||
</div> | ||
</ul> | ||
</div> | ||
</div> | ||
</section> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,18 +1,18 @@ | ||
<section class="security solve-that__section"> | ||
<div class="container container--wide solve-that__container"> | ||
<div class="container--wide solve-that__container"> | ||
<div class="solve-that__wrap"> | ||
<div class="solve-that__title block__title block__subtitle--invert"> | ||
Безопасность | ||
</div> | ||
<p class="block__description block__subtitle--invert">trdl спроектирован так, чтобы минимизировать ущерб от потенциальных атак на систему обновления. Три основных компонента, которые за это отвечают, — менеджер секретов Vault, репозиторий на основе The Update Framework и Git.</p> | ||
</div> | ||
<div class="security-bg__lines"> | ||
<!-- <div class="security-bg__lines"> | ||
<svg width="879" height="543" viewBox="0 0 879 543" fill="none" xmlns="http://www.w3.org/2000/svg"> | ||
<path d="M749.197 145V396C749.197 415.882 733.079 432 713.197 432H274" stroke="#A41FE2" stroke-width="4"/> | ||
<path d="M876.196 6L876.197 455" stroke="#A41FE2" stroke-width="4"/> | ||
<path d="M60 486H776.08C795.962 486 812.08 469.882 812.08 450V0" stroke="#333037" stroke-width="4"/> | ||
<path d="M676 541H0" stroke="#A41FE2" stroke-width="4"/> | ||
</svg> | ||
</div> | ||
</div> --> | ||
</div> | ||
</section> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,15 +1,23 @@ | ||
.security { | ||
& .architecture__cols { | ||
&--item { | ||
& .col__item .warning { | ||
stroke: $color-accent; | ||
&.how-work__section { | ||
& .architecture__cols { | ||
&--item { | ||
& .col__item { | ||
& .warning { | ||
stroke: $color-accent; | ||
} | ||
|
||
& p { | ||
color: #000; | ||
} | ||
} | ||
|
||
// &:last-child { | ||
// & .col__item { | ||
// max-width: 95%; | ||
// } | ||
// } | ||
} | ||
|
||
// &:last-child { | ||
// & .col__item { | ||
// max-width: 95%; | ||
// } | ||
// } | ||
} | ||
} | ||
} |
Oops, something went wrong.