Security & Compliance

Antemure runs as root on the hosts it defends, so its own security model is deliberately conservative: endpoints open no inbound ports, destructive actions are guarded by construction, secrets are write-only, and telemetry is redacted before it ever leaves the box.

Transport

Daemon↔hub is token-over-TLS (not mutual TLS). Enrollment, heartbeat and config pulls are outbound HTTPS with the node token as a bearer; the reverse tunnel is an outbound WSS authenticated with the same token. Endpoints therefore need no inbound ports — NAT'd and VPC hosts are reachable only via node-initiated outbound. The Kubernetes admission webhook is served over HTTPS (rustls) from a mounted cert/key Secret.

Secrets & the vault

Credentials live in the vault encrypted with AES-256-GCM and are write-only — never returned over the API, sent to the LLM, or logged. Node tokens and enrollment artifacts are persisted 0600; integration and webhook URLs live only in 0600 files; internal routes are gated by per-purpose shared secrets; SOAR resolves secrets inside activities so plaintext never enters workflow history. All config-returning endpoints mask secret fields.

Data at rest

Per-node data is SQLite (WAL + FTS5): events, incidents, the investigation trail (with a SHA-256 content-hash chain) and audit log. The hub keeps its knowledge graph, fleet telemetry, alert rules and more as SQLite files beside its config; SOAR's read model is Postgres. Database files rely on filesystem permissions plus the AES-GCM vault for secrets — there is no transparent full-database encryption layer, so use disk encryption where your policy requires encryption at rest.

Network & ports

  • Endpoints: no inbound; outbound 443/WSS to the hub (and HTTPS to the gateway/control plane). The local API (18900) can be bound to 127.0.0.1 via AURA_BIND_ADDR.
  • Hub: 18901 (dashboard/API/enroll/relay).
  • SOAR / MCP: 18902 (internal); admission webhook 8443 in-cluster.
  • CORS has no wildcard — only an explicit AURA_CORS_ORIGINS allowlist.

Operator-lockout & forbidden-command guards

Because Antemure can act autonomously as root, a hard guard refuses any remediation that would sever the management or rollback path — host power-off/reboot, stopping/killing SSH or the agent or PID 1, bringing host networking down, wholesale firewall flushes, rm -rf /, or touching operator SSH keys / auth databases. Recoverable equivalents (restart, specific-IP blocks, removing malicious packages) are allowed. This is enforced in three independent places: the hub won't draft or apply it, the node won't execute it regardless of sender, and the dispatch path re-checks. Host isolation preserves loopback, established connections, inbound SSH and the control path, and aborts if it can't. See Investigation & Remediation.

RBAC & redaction

Four roles (Viewer < Operator < Admin < SuperAdmin) mapped from SSO groups, enforced identically at hub, MCP and SOAR, with multi-tenant node isolation. Telemetry is redacted before it is sent to the reasoning gateway; the endpoint console exposes a before/after redaction view so you can see exactly what would leave the box. See Tokens, Auth & RBAC.

Hardening

  • Fail-closed for enrolled-but-tokenless nodes; constant-time token comparisons.
  • rustls-only TLS (no OpenSSL in the static musl builds); release binaries are LTO-optimized and stripped.
  • SSRF validation on every outbound webhook/notification URL (host/CIDR allowlists).
  • The Linux installer registers a watchdog timer that restarts the daemon if it is killed (tamper resistance).

Honest notes for threat modeling

  • Daemon reads are unauthenticated by design; only mutations are token-gated. Bind to loopback or restrict the network if that matters in your environment.
  • Daemon↔hub is token-over-TLS, not mutual TLS.
  • SQLite is not transparently encrypted at rest; only vault blobs are AES-GCM. Pair with disk encryption for at-rest compliance.