Security - Revision history

Lakshmi at 09:45, 11 September 2025

2025-09-11T09:45:27Z

Show changes

Lakshmi: /* Web Application Security */

2025-06-29T13:08:43Z

‎Web Application Security

Lakshmi: /* WebUI Certificate */

2025-06-29T13:08:23Z

‎WebUI Certificate

Lakshmi: /* Authentication Flow */

2025-06-29T13:08:13Z

‎Authentication Flow

Lakshmi: /* WebUI Certificate */

2025-06-29T13:07:41Z

‎WebUI Certificate

Lakshmi: /* Authentication Flow */

2025-06-29T13:07:34Z

‎Authentication Flow

Lakshmi: /* WebUI Certificate */

2025-06-29T13:07:23Z

‎WebUI Certificate

Lakshmi: /* Web Application Security */

2025-06-29T13:07:01Z

‎Web Application Security

Lakshmi: /* Authentication Security */

2025-06-29T13:06:05Z

‎Authentication Security

Lakshmi: /* Authentication Security */

2025-06-29T13:05:41Z

‎Authentication Security

@@ Line 31: / Line 31: @@
 ====WebUI (HTTPS)====
 : Uses the ''Admin'' user role with a username/password authentication secured by mangled MD5 password hashing.
 === Web Application Security ===
@@ Line 67: / Line 68: @@
 :: CSRF protection is not necessary for the agent, as the client operates via CURL.
 :: The GUI does not require dedicated CSRF protection since the Tranzman appliance is not publicly accessible and is decommissioned after migration.
 === Authentication Flow ===

@@ Line 77: / Line 77: @@
 * Browser → TLS connection established → user/password authentication → Auth tokens issued (valid for 30 minutes) → request sent with `Auth` header → access granted.
 * Browser → Active token TTL expired → Reissue token provided → new auth token issued (valid for 30 minutes) → request sent with `Auth` header → access granted.
 === WebUI Certificate ===

@@ Line 71: / Line 71: @@
 === Authentication Flow ===
-'''Agent / TZMTD – Tranzman Transfer Daemon'''
+====Agent / TZMTD – Tranzman Transfer Daemon====
 * TZMCURL Agent → TLS connection established (client certificate authorization) → CN authentication → access granted.
-'''Web Browser User Interface / HTTPS'''
+====Web Browser User Interface / HTTPS====
 * Browser → TLS connection established → user/password authentication → Auth tokens issued (valid for 30 minutes) → request sent with `Auth` header → access granted.
 * Browser → Active token TTL expired → Reissue token provided → new auth token issued (valid for 30 minutes) → request sent with `Auth` header → access granted.
 === WebUI Certificate ===

@@ Line 77: / Line 77: @@
 * Browser → TLS connection established → user/password authentication → Auth tokens issued (valid for 30 minutes) → request sent with `Auth` header → access granted.
 * Browser → Active token TTL expired → Reissue token provided → new auth token issued (valid for 30 minutes) → request sent with `Auth` header → access granted.
 === WebUI Certificate ===

@@ Line 67: / Line 67: @@
 :: CSRF protection is not necessary for the agent, as the client operates via CURL.
 :: The GUI does not require dedicated CSRF protection since the Tranzman appliance is not publicly accessible and is decommissioned after migration.
 === Authentication Flow ===
@@ Line 76: / Line 77: @@
 * Browser → TLS connection established → user/password authentication → Auth tokens issued (valid for 30 minutes) → request sent with `Auth` header → access granted.
 * Browser → Active token TTL expired → Reissue token provided → new auth token issued (valid for 30 minutes) → request sent with `Auth` header → access granted.
 === WebUI Certificate ===

@@ Line 36: / Line 36: @@
 Web security remains a high priority with Tranzman, addressing common vulnerabilities through proactive risk mitigation.
-; '''Risk: Broken Authentication'''
+====Risk: Broken Authentication====
 : '''Mitigation:'''
 :: AGENT or client authentication is integrated into the TLS protocol, ensuring CA never leaves the Tranzman appliance.
 :: Connections are restricted to Trusted Agents (authorized IP addresses), while GUI interactions are strictly controlled via port 443.
-; '''Risk: Sensitive Data Exposure'''
+====Risk: Sensitive Data Exposure====
 : '''Mitigation:'''
 :: Tranzman securely stores metadata such as NBU catalog details (hostnames, policies, backup size, storage configurations, encrypted credentials) in an internal database.
 :: Encryption keys and credentials remain inaccessible through the web interface and are only retrievable via the agent during migration.
-; '''Risk: XML External Entities'''
+====Risk: XML External Entities====
 : '''Mitigation:'''
 :: Tranzman exclusively uses REST API, rejecting any XML content type.
-; '''Risk: Broken Access Control'''
+====Risk: Broken Access Control====
 : '''Mitigation:'''
 :: Agents are validated via certificate CN before performing any tasks.
 :: Each agent can only access its designated data; cross-agent data access is restricted.
-; '''Risk: Security Misconfiguration'''
+====Risk: Security Misconfiguration====
 : '''Mitigation:'''
 :: Security measures are built-in out-of-the-box, minimizing risks associated with user misconfiguration.
-; '''Risk: Using Components with Known Vulnerabilities'''
+====Risk: Using Components with Known Vulnerabilities====
 : '''Mitigation:'''
 :: Tranzman undergoes periodic vulnerability scans using Qualys.
-; '''Risk: Cross-Site Request Forgery (CSRF)'''
+====Risk: Cross-Site Request Forgery (CSRF)====
 : '''Mitigation:'''
 :: CSRF protection is not necessary for the agent, as the client operates via CURL.

@@ Line 26: / Line 26: @@
 === Authentication Security ===
- '''Tranzman Agent (TZMTD)'''
+====Tranzman Agent (TZMTD)====
 : Utilizes client certificates for authentication, ensuring security by packaging certificates within the agent installer binary. The agent operates under the ''Agent'' user role.
- '''WebUI (HTTPS)'''
+====WebUI (HTTPS)====
 : Uses the ''Admin'' user role with a username/password authentication secured by mangled MD5 password hashing.