misc: removed unnecessary section in security architecture

This commit is contained in:
Sheen Capadngan
2025-09-19 19:16:00 +08:00
parent 2ce7629dfe
commit 262f4fa2d3

View File

@@ -131,74 +131,3 @@ The architecture provides tenant isolation through multiple certificate authorit
- Each organization's traffic flows through isolated certificate-authenticated channels
- Relay servers route traffic based on certificate validation without content access
- Gateway validates all incoming connections against Organization Gateway Client CA
## Security Best Practices
### Gateway Security
- **One identity per gateway** - Create a unique machine identity for each gateway
- **Minimal permissions** - Assign only the permissions each gateway actually needs
- **Rotate credentials** - Set up regular credential rotation (quarterly recommended)
- **Monitor authentication** - Watch for unusual authentication activity
- **Deploy close to resources** - Place gateways as close as possible to your private resources
- **Use multiple gateways** - Deploy multiple gateways for redundancy and load distribution
### Relay Security
- **Deploy close to gateways** - Minimize latency between gateways and relays
- **Use multiple regions** - Deploy relays in multiple regions for redundancy
- **Monitor performance** - Track connection counts and throughput
- **Regular updates** - Keep relay servers updated and patched
- **Network isolation** - Use security groups and network ACLs to restrict access
- **Monitor network traffic** - Watch for unusual patterns
### Network Security
- **Gateway outbound only** - Gateways only need outbound connections (port 2222 to relays, port 443 to Infisical API)
- **Relay inbound** - Relays need inbound SSH (2222) and TCP with TLS (8443)
- **No inbound for gateways** - Never open inbound ports for gateways
- **Use security groups** in cloud environments to restrict access
- **Implement network ACLs** to limit traffic to specific IP ranges
- **Monitor network traffic** for unusual patterns
- **Regular security updates** for the relay server
## Compliance Considerations
### Data Sovereignty
- **Customer-deployed relays** - Deploy relays in your preferred geographic region
- **Air-gapped environments** - Use self-hosted relays for completely isolated deployments
- **Custom network policies** - Implement organization-specific security requirements
### Security Controls
- **Certificate-based authentication** - No shared secrets, uses SSH certificates
- **End-to-end encryption** - All traffic is encrypted in transit
- **Tenant isolation** - Each organization's traffic is completely isolated
- **No data storage** - Relay servers only route traffic, never store data
- **Automatic reconnection** - Handles network interruptions gracefully
## Troubleshooting Security Issues
### Common Security Issues
**Authentication failures:**
- Verify machine identity credentials are correct
- Check token expiration and renewal
- Ensure authentication method is properly configured
**Network security issues:**
- Verify firewall rules allow required connections
- Check for network ACLs blocking traffic
- Monitor for unusual network patterns
### Security Monitoring
**Key metrics to monitor:**
- Gateway connection status and health
- Authentication success/failure rates
- Network connectivity and latency
- Unusual traffic patterns or access attempts