LDAPWeb/GeoNetAgent/docs/security.md

Security

Terakhir Diperbarui: 2026-06-29

---

Credential Management

Secret	Lokasi	TIDAK boleh di
DB password	/root/geonetagent_dev.credentials di server 10.100.1.25	Repo, log, chat
Agent bearer token	.env di server collector (10.100.1.24)	Repo
Zabbix API token	.env Laravel (Fase 2)	Repo
QNAP OSS credentials	infra/qnap/README.md (referensi lokasi)	Repo
SSH private keys	~/.ssh/ di laptop developer	Repo, cloud

---

Auth Model

Agent → Collector (FastAPI)

• HTTPS + Authorization: Bearer <agent_token>
• Token statis per site (config.json di endpoint)
• Opsi: validasi token ke DB jika AGENT_TOKEN_CHECK_DB=true
• Produksi: tambah mTLS (rencana)

User → Collector UI

• Saat ini: tidak ada auth — UI read-only, hanya internal LAN
• Fase 1: Laravel auth (session / Sanctum)

Zabbix Webhook (Fase 2)

• Shared secret di header
• IP allowlist Zabbix server

---

Aturan AI Agent

1. Jangan commit secret ke repository
2. Jangan tampilkan nilai secret di output percakapan
3. Jangan hardcode credentials di kode
4. Credentials update di server → via SSH langsung, bukan melalui kode yang di-commit
5. SSH command ke server wajib minta persetujuan user sebelum dijalankan

---

Nginx Security Notes

• agent.gisportal.id: ssi off — wajib agar file .ps1 tidak terpotong
• Jangan taruh $env: literal di file .ps1 yang di-serve Nginx
• HTTPS via Let's Encrypt (certbot) di 10.100.1.24
• Internal UI (/ui/) hanya diakses via HTTPS domain, tidak direct IP:port (kecuali internal LAN)

---

Data Sensitivity

Data	Sensitivitas	Catatan
Hostname, domain username	Medium	PII — diaudit akses
Hardware spec (CPU, RAM, GPU)	Low	Data inventaris
Software list	Medium	Bisa digunakan untuk targeting
IP/MAC address	Medium	Network fingerprinting
Serial number	Medium	Asset tracking
Credentials DB	Critical	Tidak boleh ada di kode