Decide on SSL implementation method

[Aterfax]

Choices are continue with Nginx SSL tunnelling or implement SSL in RoR directly.

There are costs and benefits to either and there are probably further options.

[boardfish]

Care to explain further? Can't say I'm too clued up on this, but is there any harm in continuing with just nginx SSL?

[Aterfax]

Its more about choice - you could get an SSL certificate and run rails using it and have native SSL but there are implications to increased risk (i.e. larger threat cross section with more devices with valid domain SSL certs.)

Running it via nginx on as a tunnel means that fewer devices have the SSL certs but the tunnel host device needs to ensure a secure method of communication to port 80 on Rails (currently achieved by a private virtual network on the VM) and the tunnel host should be hardened by virtue of not running exploitable services. i.e. game servers without adequate sandboxing (be that users or dockers on the tunnel host sleipnir or via running a separate VM the latter being overkill.)

Either way - some things need cleaning up and re-jigging on sleipnir depending on how we want to move forward.

One of the larger worries is trying to avoiding letting anyone get access to a wildcard certificate if they were somehow successful at hacking either a tunnel or direct SSL RoR implementation.

By virtue of being on the root, the website needs a root domain cert but not necessarily sub-domains or a wildcard which may need sorting.

i.e. adequate segmentation of SSL certificates to avoid further compromises where using a subdomain, or limited cert of some kind is more appropriate.

[Aterfax]

The other thing is - if you were to setup letsencrypt for the RoR or tunnel and either gets compromised - it is feasible for an attacker to get any subdomain or root domain cert by virtue of just asking letsencrypt to re-issue one which we may need to consider a more active solution to - i.e. checking on letsencrypt when certs are issued to catch a malicious actor.

This can be negated by careful choice in DNS setup - i.e. if RoR was compromised as it stands they couldn't get a cert re-issued without also cracking the nginx box (that is where the DNS points for root) or utilizing an alternative letsencrypt cert request method (if we could force cert generation for our domain to be via a certain method this could reduce the risk.)

[boardfish]

Sounds to me like just keeping it with nginx is both the easier and more secure option from your explanation, given that we're practically there already. Is there anything further we need to do if we're sticking with nginx?

[Aterfax]

I think we could get a few more people's takes on it prior to decision making - namely our head techs etc...

[boardfish]

This is sorted now - the VM's using the top-level SSL cert for the server.

[Aterfax]

As far I know that is incorrect.

Last time I checked the VM and website have no SSL setup.

The site is simply reverse proxied through the existing nginx config on sleipnir.

This is an important difference as it has consequences for transport security in direct connections. Which I believe are still possible. That should probably be rectified.

[boardfish]

Fair point – how do you suggest we go about doing this? This leans closer to devops stuff.

[Aterfax]

Like I said, you need have a discussion with the other lead techs to decide on how to proceed. Then document it somewhere, we really do need some kind of infrastructure documentation.

Ultimately, it is probably wise to prevent access to the website on the VM host and only allow access via the reverse proxy.