AsterionDocumentation v0.4.1

Security

How Asterion protects itself, and what the operator should add.

Built in

  • Content-Security-Policy: only the own origin; no inline scripts, styles or event handlers. Alpine.js runs as its CSP build. No external fonts, scripts or styles.
  • Sign-in: rate limited per address and per account (10 failed attempts lock the account for 15 minutes, whatever the address), TOTP (can be required for all local users), OIDC with PKCE.
  • Proxies: X-Forwarded-* headers are believed only from TRUSTED_PROXIES (default: loopback and private networks), so a client reaching Polaris directly cannot fake its address.
  • No SSRF through channels: notification servers in internal networks are refused unless a super admin allows them; metadata addresses never.
  • Roles per tenant, global operator and super admin roles; every page checks the tenant of the object.
  • Secrets encrypted with APP_KEY: satellite secrets, TOTP, channel credentials, the system mail password.
  • Satellite protocol: HMAC-signed requests and responses with single-use nonces and instance binding (details); strict validation of every upload; satellites re-validate every target and option before running a command.
  • Zone rule: global satellites never get private addresses; a container cannot set its own zone.
  • Spreadsheet safety: values from scanned systems are written as text in reports.
  • Open relay and anonymous FTP tests are off by default and never send a message or log in for real.

For the operator

  • Put TLS in front of the web UI, the API, the websocket and any public satellite page. Keep SESSION_SECURE_COOKIE=true.
  • Publish only the proxy: set POLARIS_BIND=127.0.0.1 when the proxy runs on the same host, and narrow TRUSTED_PROXIES to it.
  • Back up APP_KEY separately from the database.
  • Keep .env readable by root only; remove POLARIS_ADMIN_PASSWORD after the first start.
  • Pin images to release versions, not latest.
  • Only scan what you are authorised to scan. Scanning infrastructure you do not own may be illegal.

The documentation container runs read-only, as an unprivileged user, without capabilities, and sends a strict CSP itself.