Skip to main content
Version: 0.x (legacy)

Security

This page is partial. The agent-to-centre transport and the least-privilege account's core AD delegation are confirmed below; the certificate lifecycle and binary verification sections are still pending.

Agent-to-centre transport​

Every agent connects to the centre over mutual TLS: the centre acts as its own certificate authority and issues each agent its own client certificate. If an agent's certificate or CA material is missing or unreadable, it refuses to start rather than falling back to an unencrypted connection — a broken -tls-dir is loud, not a silent downgrade. TODO: document the certificate lifecycle (issuance, rotation, revocation) and how to verify it in practice.

Least-privilege agent account​

The documented default is that the agent's Windows service account is a Domain Admin. That is more than the agent actually needs, and the narrower set below is confirmed working on real AD, not just designed:

  • Kerberos constrained delegation for live migration — the account needs write access to msDS-AllowedToDelegateTo on computer objects in its OU. An object-level ACL grant is sufficient on its own; the account does not need the SeEnableDelegationPrivilege user right some documentation suggests is also required. Confirmed with a real live migration between two lab hosts.
  • Cluster Name Object (CNO) creation for cluster formation — the account needs create/delete rights over computer objects, scoped to its OU and to the computer object class only (not Full Control of the OU, and not a single prestaged, named object). Confirmed by forming, destroying, and re-forming a failover cluster under more than one cluster name with no per-name setup step.
  • The account needs no domain-join rights at all — domain join uses a separate, per-operation credential supplied by the centre, never the service account's own identity.

Not confirmed yet: a broader manual pass across the rest of the reconcile surface (switch/vNIC, disk resize, general VM operations) under this account, beyond cluster formation and migration specifically.

Verifying the agent binary​

TODO: document how to confirm a downloaded or centre-served agent binary is genuine before installing it on a host.