Security - Revision history

Lakshmi at 08:34, 26 June 2026

2026-06-26T08:34:58Z

Lakshmi at 08:27, 26 June 2026

2026-06-26T08:27:30Z

Lakshmi at 09:45, 11 September 2025

2025-09-11T09:45:27Z

Show changes

Lakshmi: /* Web Application Security */

2025-06-29T13:08:43Z

‎Web Application Security

Lakshmi: /* WebUI Certificate */

2025-06-29T13:08:23Z

‎WebUI Certificate

Lakshmi: /* Authentication Flow */

2025-06-29T13:08:13Z

‎Authentication Flow

Lakshmi: /* WebUI Certificate */

2025-06-29T13:07:41Z

‎WebUI Certificate

Lakshmi: /* Authentication Flow */

2025-06-29T13:07:34Z

‎Authentication Flow

Lakshmi: /* WebUI Certificate */

2025-06-29T13:07:23Z

‎WebUI Certificate

Lakshmi: /* Web Application Security */

2025-06-29T13:07:01Z

‎Web Application Security

@@ Line 93: / Line 93: @@
 # Copy and paste the signed Certificate into the right text field.
 # Press '''Submit''' and wait for Tranzman to update the certificate and restart web services.
-== Notes ==
+  <div style="background-color:#f8e2b3; padding:0.2rem; border-radius:8px; box-shadow:0 2px 4px rgba(0,0,0,0.06); font-size:1em; margin: 0 auto;">
-* The certificate request and signed certificate must be handled securely.
+    <p>🛈 <i>This process can take few minutes.<br>
-* Restarting web services may temporarily interrupt access to the WebUI.
+      The certificate request and signed certificate must be handled securely.<br>
      </ul>
    </div>

@@ Line 82: / Line 82: @@
      <h2 style="border-bottom:2px solid #f8bbd0; padding-bottom:0.5rem; font-size:1.5em;">WebUI Certificate</h2>
      <ul>
-       <li>Tranzman employs a self-signed certificate for authentication.</li>
+       By default, Tranzman will use a self‑signed certificate for HTTPS traffic.
      </ul>
    </div>

@@ Line 31: / Line 31: @@
 ====WebUI (HTTPS)====
 : Uses the ''Admin'' user role with a username/password authentication secured by mangled MD5 password hashing.
 === Web Application Security ===
@@ Line 67: / Line 68: @@
 :: CSRF protection is not necessary for the agent, as the client operates via CURL.
 :: The GUI does not require dedicated CSRF protection since the Tranzman appliance is not publicly accessible and is decommissioned after migration.
 === Authentication Flow ===

@@ Line 77: / Line 77: @@
 * Browser → TLS connection established → user/password authentication → Auth tokens issued (valid for 30 minutes) → request sent with `Auth` header → access granted.
 * Browser → Active token TTL expired → Reissue token provided → new auth token issued (valid for 30 minutes) → request sent with `Auth` header → access granted.
 === WebUI Certificate ===

@@ Line 71: / Line 71: @@
 === Authentication Flow ===
-'''Agent / TZMTD – Tranzman Transfer Daemon'''
+====Agent / TZMTD – Tranzman Transfer Daemon====
 * TZMCURL Agent → TLS connection established (client certificate authorization) → CN authentication → access granted.
-'''Web Browser User Interface / HTTPS'''
+====Web Browser User Interface / HTTPS====
 * Browser → TLS connection established → user/password authentication → Auth tokens issued (valid for 30 minutes) → request sent with `Auth` header → access granted.
 * Browser → Active token TTL expired → Reissue token provided → new auth token issued (valid for 30 minutes) → request sent with `Auth` header → access granted.
 === WebUI Certificate ===

@@ Line 36: / Line 36: @@
 Web security remains a high priority with Tranzman, addressing common vulnerabilities through proactive risk mitigation.
-; '''Risk: Broken Authentication'''
+====Risk: Broken Authentication====
 : '''Mitigation:'''
 :: AGENT or client authentication is integrated into the TLS protocol, ensuring CA never leaves the Tranzman appliance.
 :: Connections are restricted to Trusted Agents (authorized IP addresses), while GUI interactions are strictly controlled via port 443.
-; '''Risk: Sensitive Data Exposure'''
+====Risk: Sensitive Data Exposure====
 : '''Mitigation:'''
 :: Tranzman securely stores metadata such as NBU catalog details (hostnames, policies, backup size, storage configurations, encrypted credentials) in an internal database.
 :: Encryption keys and credentials remain inaccessible through the web interface and are only retrievable via the agent during migration.
-; '''Risk: XML External Entities'''
+====Risk: XML External Entities====
 : '''Mitigation:'''
 :: Tranzman exclusively uses REST API, rejecting any XML content type.
-; '''Risk: Broken Access Control'''
+====Risk: Broken Access Control====
 : '''Mitigation:'''
 :: Agents are validated via certificate CN before performing any tasks.
 :: Each agent can only access its designated data; cross-agent data access is restricted.
-; '''Risk: Security Misconfiguration'''
+====Risk: Security Misconfiguration====
 : '''Mitigation:'''
 :: Security measures are built-in out-of-the-box, minimizing risks associated with user misconfiguration.
-; '''Risk: Using Components with Known Vulnerabilities'''
+====Risk: Using Components with Known Vulnerabilities====
 : '''Mitigation:'''
 :: Tranzman undergoes periodic vulnerability scans using Qualys.
-; '''Risk: Cross-Site Request Forgery (CSRF)'''
+====Risk: Cross-Site Request Forgery (CSRF)====
 : '''Mitigation:'''
 :: CSRF protection is not necessary for the agent, as the client operates via CURL.