Security

What Stratum protects on its own, what you need to set up yourself, and what it deliberately does not protect against. The last part matters most: assuming a boundary exists where it does not is how people get hurt.

Protected without any setup

You do not need to configure any of this.

• The management API is closed until you open it. It will not serve requests

without a token, and there is no insecure fallback.

• The API is encrypted. There is no unencrypted way in.
• Repeated failed sign-ins are locked out, and an attacker cannot turn that

lockout into a way of denying access to a legitimate user.

• Configuration and licences are verified before they are trusted. Anything

altered in transit, or issued by anyone other than Cenvero, is refused — checked on the node itself, so it works offline.

• Workloads cannot impersonate each other. Traffic from a workload must match

what that workload is registered as. This is enforced on every packet.

• Changes made outside Stratum are undone. If something alters an interface

Stratum manages, it is put back.

Your checklist

None of this happens on its own.

Deny by default in the firewall. Until you do, traffic matching no rule is allowed. See Zero-Trust Firewall.

Treat the API token as a credential. It grants full control of the node. Create it at install time, keep it out of shell history and version control, and replace it if it may have been exposed.

Limit who can reach the API. It can be restricted to specific addresses. An API reachable from the internet is a mistake even with a strong token — keep it on your management network.

Keep the management network private. Stratum assumes only your operators can reach it.

Keep nodes updated. Updates are pulled, never pushed, so a node nobody updates stays vulnerable. See Upgrades.

Back up /etc/cenvero-str/ and /var/lib/cenvero-str/. They are what a node needs to come back as itself.

Available if you want it

• Stricter interface protection. By default an unauthorised change to a

managed interface is undone shortly after it happens. On a suitably configured kernel it can be refused outright instead. Off unless you enable it.

• Client certificates on the streaming interface, in addition to a token.
• Intrusion detection, surfacing scanning and flooding patterns. Off by

default.

What is not protected

Someone with root on the node. The design protects against what arrives over the network, not against an administrator of the machine itself. Anyone with root can stop or replace what is running there. Verification exists to stop a remote attacker substituting configuration or licences — it does not, and cannot, constrain someone who already owns the box.

Interface protection is repair, not prevention. By default a change is detected and undone, so there is a window where it applied. Treat it as tamper-evidence with automatic repair rather than a lock.

Plugins are trusted code. Signing proves a plugin is genuinely the one its developer published and has not been altered since. That is authenticity, not containment — a plugin you install runs with real access to the node, exactly like any other software you install as root. **Only install plugins from sources you trust.** See Installing Plugins.

A frozen licence is not a security control. It blocks changes; traffic keeps flowing. To take a node out of service, isolate it on the network.

Existing connections survive a rule change. Tightening a rule governs new connections; conversations already open continue until they end. If you are cutting traffic off during an incident, clear them explicitly — see Zero-Trust Firewall.

If a node may be compromised

1. Isolate it on the network, upstream — not using the node's own firewall.
2. Revoke its licence from your account. That stops it making changes; it

does not stop traffic.

1. Collect evidence before restarting anything. Logs are in

/var/log/cenvero-str/. Restarting is the first instinct and it can cost you the answer.

1. Replace the API token and any tenant keys the node held.
2. Rebuild rather than clean up. If root was obtained, reinstall.

Reporting a security issue

Report it through your account rather than publicly, with enough detail to reproduce it.

Where to go next

• Zero-Trust Firewall — the policy model in full.
• TLS/SSL & Licence Operations — certificates and licences.
• Operations — logs, health checks, and recovery.