B.W.A TLS-Gate // Security Policy & Key Guarding

🛡️ Our Security Perspective

"Bits do not compromise, and neither does B.W.A."

In a world of constant surveillance and corporate remote telemetry, we enforce absolute local sovereignty. Security is not an afterthought; it is baked organically into our hardware and architecture workflows.

🔒 1. Safe Credentials Management

Credentials werden aus der Umgebung gelesen; die Platzhalter greifen nur als Mock-Fallback. Zentral in SslHandler.php (geteilt von index.php und soap_cli.php):

// Aktive, sichere Credential-Auflösung:
$soap_user = getenv('BWA_SOAP_USER') ?: "tester";
$soap_pw   = getenv('BWA_SOAP_PASS') ?: ".....";
$wsdl      = getenv('BWA_SOAP_WSDL') ?: "https://www.domain-bestellsystem.de/soapstatus/wsdl/soap.wsdl";

CRITICAL INSTRUCTION: NEVER commit production passwords or authorization tokens to raw GitHub/GitLab repositories.
* Setze die Werte per Environment (Shell-Export, systemd Environment=, o.Ä.) außerhalb des Web-Roots — nie im Repo.
* Für die CLI müssen BWA_SOAP_* im ausführenden Shell-/Service-Kontext gesetzt sein, sonst läuft dashboard.sh auf dem Mock-Fallback.

🗂️ 1a. Datei- & Ausführungsrechte (CLI / RZ-Deployment)

Die Terminal-Pipeline (dashboard.sh → soap_cli.php → SslHandler.php → sample.json) benötigt korrekt gesetzte Rechte des ausführenden Users:
* soap_cli.php ist CLI-only (per PHP_SAPI-Guard abgesichert) und darf nicht über den Web-Server erreichbar sein.
* Minimalprinzip: nur der ausführende User/Gruppe erhält Lese-/Ausführrechte; keine world-writable Skripte.
bash chmod +x dashboard.sh chown "$USER":"$USER" dashboard.sh soap_cli.php SslHandler.php sample.json
* Fehlen Rechte oder php, bricht dashboard.sh kontrolliert mit klarer Meldung ab (kein stummer Exit).

🔑 2. Cryptographic Enforcements

We strictly enforce modern cryptographic algorithms. Legacy protocols are deprecated across the entire CrumbForest network.

  • RSA Key Strength: All keypairs generated via genCSR must utilize a signature minimum of 2048-bit (defaulting to 2048/4096-bit).
  • Digest Algorithm: Legacy SHA-1 is completely banned for root or domain verification certificates. All local hashes are signed in sha256 as verified during the RC1 audit.

📡 3. Telemetry & Sovereignty Guardrails

  1. Air-Gap Capable: This code operates 100% offline. sample.html does not require internet capability to load stylesheets, fonts, icons, or libraries (Zero external CDNs).
  2. Local Session Limits: No database engines are attached to store user configurations. Temporary states are held purely inside the local browser context via localStorage or temporary RAM. No cookielogging permitted.

To report security concerns, contact the waldmitte Core-IT nodes directly. Keep the forest safe, keep the code clean.