[Gerrrt]

…mp its agent pin

An audit of garuda on 2026-11-13 found Kali's stock sshd taking passwords on every address, cloud-init's passwordless sudo for analyst, and an owner-scoped gh login on the box, all on the segment the lab domain's six share.

• stacks/analyst/ssh/10-garuda.conf: key-only, analyst from Hicks and phoenix alone, no forwarding. build-the-analyst-workstation.md §4 installs it and removes the passwordless sudo; §0 and §9 record and check both.
• §7 reads the dotfiles release tags without a GitHub login; garuda holds no GitHub write credential.
• docs/architecture.md no longer describes the cgroup fence ADR-0093 replaced.
• stacks/soc/linux-agents.yaml: wazuh-agent 4.14.8 -> 4.14.10, the manager's, hash checked against Wazuh's signed apt index. §12 gains the upgrade step.
• Every Alloy runs with --disable-reporting, as Grafana and Loki already do.

What changed

Why

Blast radius

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

• make validate passes
• Deployed to the lab and confirmed working
• Docs updated (docs/, service README, or docs/roadmap.md)

[Copilot]

🟡 Changes recommended

Existing guests retain usable repository-write credentials without a revocation migration, while Unix-domain socket forwarding and usage reporting in both agent deployment paths remain enabled.

3 open issues

• Revoke and remove existing guest repository-write credentials · New
• Disable Unix-domain socket forwarding · New
• Disable reporting in both agent deployment paths · New

What changed in this PR

This PR hardens the analyst workstation’s documented access policy and updates its monitoring configuration following the garuda audit.

Changes:

• Adds key-only, source-restricted SSH settings and documents password-required sudo and credential-free GitHub access.
• Updates the Wazuh Linux agent pin to 4.14.10 and adds upgrade instructions.
• Disables Alloy usage reporting in six Compose stacks and corrects the documented OpenVAS isolation mechanism.

File	Description
stacks/​soc/​linux-agents.yaml	Updates the Wazuh agent version and checksum.
stacks/​soc/​compose.yaml	Disables Alloy usage reporting.
stacks/​sensor/​compose.yaml	Disables Alloy usage reporting.
stacks/​observability/​compose.yaml	Disables Alloy usage reporting.
stacks/​lab/​compose.yaml	Disables Alloy usage reporting.
stacks/​bloodhound/​compose.yaml	Disables Alloy usage reporting.
stacks/​analyst/​ssh/​10-garuda.conf	Adds SSH authentication, source, and forwarding restrictions.
stacks/​analyst/​README.md	Describes the SSH drop-in and sudo hardening.
stacks/​analyst/​compose.yaml	Disables Alloy usage reporting.
docs/​security.md	Documents garuda’s intended access controls.
docs/​runbooks/​build-the-analyst-workstation.md	Adds hardening, verification, anonymous release lookup, and agent upgrade steps.
docs/​changelog.md	Records the audit and proposed remediation.
docs/​architecture.md	Updates access policy and corrects the OpenVAS fence description.

_{Review effort: Balanced}