{
    "product": "Cenvero Stratum",
    "generated_at": "2026-08-03T07:16:17+00:00",
    "format": "cenvero-docs-v1",
    "document_count": 1,
    "documents": [
        {
            "slug": "security",
            "title": "Security",
            "category": null,
            "url": "https://stratum.cenvero.com/docs/security",
            "headings": [
                {
                    "level": 1,
                    "text": "Security"
                },
                {
                    "level": 2,
                    "text": "Protected without any setup"
                },
                {
                    "level": 2,
                    "text": "Your checklist"
                },
                {
                    "level": 2,
                    "text": "Available if you want it"
                },
                {
                    "level": 2,
                    "text": "What is *not* protected"
                },
                {
                    "level": 2,
                    "text": "If a node may be compromised"
                },
                {
                    "level": 2,
                    "text": "Reporting a security issue"
                },
                {
                    "level": 2,
                    "text": "Where to go next"
                }
            ],
            "word_count": 746,
            "markdown": "# Security\n\nWhat Stratum protects on its own, what you need to set up yourself, and what it\ndeliberately does not protect against. The last part matters most: assuming a\nboundary exists where it does not is how people get hurt.\n\n## Protected without any setup\n\nYou do not need to configure any of this.\n\n- **The management API is closed until you open it.** It will not serve requests\n  without a token, and there is no insecure fallback.\n- **The API is encrypted.** There is no unencrypted way in.\n- **Repeated failed sign-ins are locked out**, and an attacker cannot turn that\n  lockout into a way of denying access to a legitimate user.\n- **Configuration and licences are verified before they are trusted.** Anything\n  altered in transit, or issued by anyone other than Cenvero, is refused —\n  checked on the node itself, so it works offline.\n- **Workloads cannot impersonate each other.** Traffic from a workload must match\n  what that workload is registered as. This is enforced on every packet.\n- **Changes made outside Stratum are undone.** If something alters an interface\n  Stratum manages, it is put back.\n\n## Your checklist\n\nNone of this happens on its own.\n\n**Deny by default in the firewall.** Until you do, traffic matching no rule is\nallowed. See [Zero-Trust Firewall](/docs/networking/firewall).\n\n**Treat the API token as a credential.** It grants full control of the node.\nCreate it at install time, keep it out of shell history and version control, and\nreplace it if it may have been exposed.\n\n**Limit who can reach the API.** It can be restricted to specific addresses. An\nAPI reachable from the internet is a mistake even with a strong token — keep it\non your management network.\n\n**Keep the management network private.** Stratum assumes only your operators can\nreach it.\n\n**Keep nodes updated.** Updates are pulled, never pushed, so a node nobody\nupdates stays vulnerable. See [Upgrades](/docs/upgrades).\n\n**Back up `/etc/cenvero-str/` and `/var/lib/cenvero-str/`.** They are what a node\nneeds to come back as itself.\n\n## Available if you want it\n\n- **Stricter interface protection.** By default an unauthorised change to a\n  managed interface is undone shortly after it happens. On a suitably configured\n  kernel it can be refused outright instead. Off unless you enable it.\n- **Client certificates** on the streaming interface, in addition to a token.\n- **Intrusion detection**, surfacing scanning and flooding patterns. Off by\n  default.\n\n## What is *not* protected\n\n**Someone with root on the node.** The design protects against what arrives over\nthe network, not against an administrator of the machine itself. Anyone with root\ncan stop or replace what is running there. Verification exists to stop a remote\nattacker substituting configuration or licences — it does not, and cannot,\nconstrain someone who already owns the box.\n\n**Interface protection is repair, not prevention.** By default a change is\ndetected and undone, so there is a window where it applied. Treat it as\ntamper-evidence with automatic repair rather than a lock.\n\n**Plugins are trusted code.** Signing proves a plugin is genuinely the one its\ndeveloper published and has not been altered since. That is authenticity, not\ncontainment — a plugin you install runs with real access to the node, exactly\nlike any other software you install as root. **Only install plugins from sources\nyou trust.** See [Installing Plugins](/docs/plugins/installing).\n\n**A frozen licence is not a security control.** It blocks changes; traffic keeps\nflowing. To take a node out of service, isolate it on the network.\n\n**Existing connections survive a rule change.** Tightening a rule governs new\nconnections; conversations already open continue until they end. If you are\ncutting traffic off during an incident, clear them explicitly — see\n[Zero-Trust Firewall](/docs/networking/firewall).\n\n## If a node may be compromised\n\n1. **Isolate it on the network**, upstream — not using the node's own firewall.\n2. **Revoke its licence** from your account. That stops it making changes; it\n   does not stop traffic.\n3. **Collect evidence before restarting anything.** Logs are in\n   `/var/log/cenvero-str/`. Restarting is the first instinct and it can cost you\n   the answer.\n4. **Replace the API token** and any tenant keys the node held.\n5. **Rebuild rather than clean up.** If root was obtained, reinstall.\n\n## Reporting a security issue\n\nReport it through your account rather than publicly, with enough detail to\nreproduce it.\n\n## Where to go next\n\n- **[Zero-Trust Firewall](/docs/networking/firewall)** — the policy model in full.\n- **[TLS/SSL & Licence Operations](/docs/tls-and-license)** — certificates and licences.\n- **[Operations](/docs/operations)** — logs, health checks, and recovery.\n"
        }
    ]
}