mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-05 08:26:29 +00:00
misc: removed unnecessary section in security architecture
This commit is contained in:
@@ -131,74 +131,3 @@ The architecture provides tenant isolation through multiple certificate authorit
|
|||||||
- Each organization's traffic flows through isolated certificate-authenticated channels
|
- Each organization's traffic flows through isolated certificate-authenticated channels
|
||||||
- Relay servers route traffic based on certificate validation without content access
|
- Relay servers route traffic based on certificate validation without content access
|
||||||
- Gateway validates all incoming connections against Organization Gateway Client CA
|
- Gateway validates all incoming connections against Organization Gateway Client CA
|
||||||
|
|
||||||
## Security Best Practices
|
|
||||||
|
|
||||||
### Gateway Security
|
|
||||||
|
|
||||||
- **One identity per gateway** - Create a unique machine identity for each gateway
|
|
||||||
- **Minimal permissions** - Assign only the permissions each gateway actually needs
|
|
||||||
- **Rotate credentials** - Set up regular credential rotation (quarterly recommended)
|
|
||||||
- **Monitor authentication** - Watch for unusual authentication activity
|
|
||||||
- **Deploy close to resources** - Place gateways as close as possible to your private resources
|
|
||||||
- **Use multiple gateways** - Deploy multiple gateways for redundancy and load distribution
|
|
||||||
|
|
||||||
### Relay Security
|
|
||||||
|
|
||||||
- **Deploy close to gateways** - Minimize latency between gateways and relays
|
|
||||||
- **Use multiple regions** - Deploy relays in multiple regions for redundancy
|
|
||||||
- **Monitor performance** - Track connection counts and throughput
|
|
||||||
- **Regular updates** - Keep relay servers updated and patched
|
|
||||||
- **Network isolation** - Use security groups and network ACLs to restrict access
|
|
||||||
- **Monitor network traffic** - Watch for unusual patterns
|
|
||||||
|
|
||||||
### Network Security
|
|
||||||
|
|
||||||
- **Gateway outbound only** - Gateways only need outbound connections (port 2222 to relays, port 443 to Infisical API)
|
|
||||||
- **Relay inbound** - Relays need inbound SSH (2222) and TCP with TLS (8443)
|
|
||||||
- **No inbound for gateways** - Never open inbound ports for gateways
|
|
||||||
- **Use security groups** in cloud environments to restrict access
|
|
||||||
- **Implement network ACLs** to limit traffic to specific IP ranges
|
|
||||||
- **Monitor network traffic** for unusual patterns
|
|
||||||
- **Regular security updates** for the relay server
|
|
||||||
|
|
||||||
## Compliance Considerations
|
|
||||||
|
|
||||||
### Data Sovereignty
|
|
||||||
|
|
||||||
- **Customer-deployed relays** - Deploy relays in your preferred geographic region
|
|
||||||
- **Air-gapped environments** - Use self-hosted relays for completely isolated deployments
|
|
||||||
- **Custom network policies** - Implement organization-specific security requirements
|
|
||||||
|
|
||||||
### Security Controls
|
|
||||||
|
|
||||||
- **Certificate-based authentication** - No shared secrets, uses SSH certificates
|
|
||||||
- **End-to-end encryption** - All traffic is encrypted in transit
|
|
||||||
- **Tenant isolation** - Each organization's traffic is completely isolated
|
|
||||||
- **No data storage** - Relay servers only route traffic, never store data
|
|
||||||
- **Automatic reconnection** - Handles network interruptions gracefully
|
|
||||||
|
|
||||||
## Troubleshooting Security Issues
|
|
||||||
|
|
||||||
### Common Security Issues
|
|
||||||
|
|
||||||
**Authentication failures:**
|
|
||||||
|
|
||||||
- Verify machine identity credentials are correct
|
|
||||||
- Check token expiration and renewal
|
|
||||||
- Ensure authentication method is properly configured
|
|
||||||
|
|
||||||
**Network security issues:**
|
|
||||||
|
|
||||||
- Verify firewall rules allow required connections
|
|
||||||
- Check for network ACLs blocking traffic
|
|
||||||
- Monitor for unusual network patterns
|
|
||||||
|
|
||||||
### Security Monitoring
|
|
||||||
|
|
||||||
**Key metrics to monitor:**
|
|
||||||
|
|
||||||
- Gateway connection status and health
|
|
||||||
- Authentication success/failure rates
|
|
||||||
- Network connectivity and latency
|
|
||||||
- Unusual traffic patterns or access attempts
|
|
||||||
|
|||||||
Reference in New Issue
Block a user