Recent changes to Security

Security modified by Christian Ferrari

Christian Ferrari — Wed, 18 Nov 2020 21:26:13 -0000

--- v11
+++ v12
@@ -1,5 +1,6 @@
+This page is no more maintained, the current one is at https://www.tiian.org/flom/security/Security.html
+
 # FLoM security #
-Starting with version 1.1.2, FLoM supports security.
 FLoM security is based on two major topics:

 * TLS (Transport Layer Security) protocol

Security modified by Christian Ferrari

Christian Ferrari — Fri, 01 Apr 2016 21:17:03 -0000

--- v10
+++ v11
@@ -67,3 +67,15 @@
 * [Channel Encryption]
 * [Mutual Authentication]

+## Debugging tools ##
+TLS can be difficult to debug due to many possible issues:
+
+* wrong X.509 certificates
+* usage of private and public addresses
+* firewalls between networks
+
+FLoM provide an integrate debugging tool that can be used to test a TLS client/server and peer to peer connection.
+There are two debugging sessions available:
+
+* [Channel Encryption Debug]
+* [Mutual Authentication Debug]

Security modified by Christian Ferrari

Christian Ferrari — Tue, 29 Mar 2016 19:54:13 -0000

--- v9
+++ v10
@@ -60,3 +60,10 @@
 * put the *unique ID* value inside the *CN* (*Common Name*) field of the certificate metadata

 [[img src=security_03.png]]
+
+## Configuration examples ##
+Follow these links for a full description of the configuration examples:
+
+* [Channel Encryption]
+* [Mutual Authentication]
+

Security modified by Christian Ferrari

Christian Ferrari — Mon, 28 Mar 2016 21:27:18 -0000

--- v8
+++ v9
@@ -1,6 +1,7 @@
 # FLoM security #
 Starting with version 1.1.2, FLoM supports security.
 FLoM security is based on two major topics:
+
 * TLS (Transport Layer Security) protocol
 * X.509 certificates

@@ -18,11 +19,13 @@
 ### No Security ###
 The default behavior of FLoM is to use clear text TCP/IP sessions without any type of security.
 With this configuration:
+
 * any FLoM client can connect to any FLoM server (daemon)
 * all the network traffic can be captured and recorded because it's based on XML document exchanges between the peers.

 ### Channel Encryption ###
 With this configuration FLoM uses the TLS standard to encrypt the TCP/IP network traffic and:
+
 * a FLoM client can connect to a FLoM server (daemon) only if the client and the server use an X.509 certificate signed by the same certification authority
 * all the network traffic is encrypted and protected by the algorithms implemented by TLS

@@ -51,7 +54,8 @@

 (FLoM uses [dbus](http://www.freedesktop.org/software/dbus/) to retrieve a system unique identifier).

-With mutual authetication you have to 
+With mutual authetication you have to:
+
 * generate a distinct certificate for every node
 * put the *unique ID* value inside the *CN* (*Common Name*) field of the certificate metadata

Security modified by Christian Ferrari

Christian Ferrari — Mon, 28 Mar 2016 21:25:40 -0000

--- v7
+++ v8
@@ -35,10 +35,24 @@
 #### Configuration example 2 ####
 Node 1, 2, 3 and 4 use the same X.509 certificate signed by a certification authority.

-[[img src=security_02.png alt="All the nodes that use a X.509 certificate signed by the same certification authority can work together"]]
+[[img src=security_02.png]]

 In general, you can create a network of secured peers with a set of X.509 certificates signed by a single certification authority. A trivial configuration is the re-use of the same certificate for many peers.

 ### Mutual Authentication ###
 This configuration extends *Channel Encryption* with a dedicated X.509 certificate for every node/system (physical or virtual) that hosts FLoM processes.
 This security level requires a more complex setup, but adds a security constraint: only the nodes/systems with a dedicated X.509 certificate signed by a specific certification authority can join and work together.
+
+Every node in the network has its own Unique ID that can be retrieved with the command:
+
+~~~~
+flom --unique-id
+~~~~
+
+(FLoM uses [dbus](http://www.freedesktop.org/software/dbus/) to retrieve a system unique identifier).
+
+With mutual authetication you have to 
+* generate a distinct certificate for every node
+* put the *unique ID* value inside the *CN* (*Common Name*) field of the certificate metadata
+
+[[img src=security_03.png]]

Security modified by Christian Ferrari

Christian Ferrari — Mon, 28 Mar 2016 21:18:17 -0000

Security modified by Christian Ferrari

Christian Ferrari — Mon, 28 Mar 2016 21:10:48 -0000

--- v5
+++ v6
@@ -27,17 +27,17 @@
 * all the network traffic is encrypted and protected by the algorithms implemented by TLS

 #### Configuration example 1 ####
-Peer1 uses a X.509 certificate signed by the certification authority CA1.
-Peer2 uses a X.509 certificate signed by the certification authority CA1.
+Node 1 uses a X.509 certificate signed by the certification authority CA1.
+Node 2 uses a X.509 certificate signed by the certification authority CA1.
+
+[[img src=security_01.png]]

 #### Configuration example 2 ####
-Peer1 and Peer2 use the same X.509 certificate signed by a certification authority.
+Node 1, 2, 3 and 4 use the same X.509 certificate signed by a certification authority.

-[[img src=security_01.png alt="Any number of X.509 certificates signed by the same certification authority"]]
+[[img src=security_02.png alt="All the nodes that use a X.509 certificate signed by the same certification authority can work together"]]

 In general, you can create a network of secured peers with a set of X.509 certificates signed by a single certification authority. A trivial configuration is the re-use of the same certificate for many peers.
-
-[[img src=security_02.png alt="All the nodes that use a X.509 certificate signed by the same certification authority can work together"]]

 ### Mutual Authentication ###
 This configuration extends *Channel Encryption* with a dedicated X.509 certificate for every node/system (physical or virtual) that hosts FLoM processes.

Security modified by Christian Ferrari

Christian Ferrari — Mon, 28 Mar 2016 21:08:45 -0000

--- v4
+++ v5
@@ -33,7 +33,11 @@
 #### Configuration example 2 ####
 Peer1 and Peer2 use the same X.509 certificate signed by a certification authority.

+[[img src=security_01.png alt="Any number of X.509 certificates signed by the same certification authority"]]
+
 In general, you can create a network of secured peers with a set of X.509 certificates signed by a single certification authority. A trivial configuration is the re-use of the same certificate for many peers.
+
+[[img src=security_02.png alt="All the nodes that use a X.509 certificate signed by the same certification authority can work together"]]

 ### Mutual Authentication ###
 This configuration extends *Channel Encryption* with a dedicated X.509 certificate for every node/system (physical or virtual) that hosts FLoM processes.

Security modified by Christian Ferrari

Christian Ferrari — Mon, 28 Mar 2016 21:05:24 -0000

Security modified by Christian Ferrari

Christian Ferrari — Mon, 28 Mar 2016 20:41:45 -0000

--- v2
+++ v3
@@ -35,3 +35,6 @@

 In general, you can create a network of secured peers with a set of X.509 certificates signed by a single certification authority. A trivial configuration is the re-use of the same certificate for many peers.

+### Mutual Authentication ###
+This configuration extends *Channel Encryption* with a dedicated X.509 certificate for every node/system (physical or virtual) that hosts FLoM processes.
+This security level requires a more complex setup, but adds a security constraint: only the nodes/systems with a dedicated X.509 certificate signed by a specific certification authority can join and work together.