[Gerrrt]

What changed

Records what the post-rebuild audit of eden found: security.md gets an accepted row for its open sshd and garnet's passwordless sudo, and the changelog gets an entry. Runbook §2 now says Docker's first up resets the data directories' modes. The Ubuntu Packer template turns X11Forwarding off for future clones. No running service changes.

Why

A read-only audit of eden after its rebuild (Refs #1443, Refs #451) turned up three host-posture gaps the repo had never decided on:

• sshd answers all of VLAN 30, the weak domain included.
• Sudo is NOPASSWD.
• X11 forwarding is on.

It also found the runbook's directory modes don't match what Docker leaves. SSH and sudo are recorded as accepted residuals, not fenced: no Linux lab guest has an SSH fence today, and adding one would be an estate-wide decision.

Two things are left for later:

• Two plaintext sops edit temp files were deleted on eden by hand.
• The admin login is still the first-start BLOODHOUND_ADMIN_PASSWORD, never rotated. The changelog records it; nothing changes here.

Blast radius

packer/ubuntu.pkr.hcl reaches every guest cloned from template 901, but only after the template is rebuilt. Existing guests, eden included, keep X11 forwarding on until they are cloned again. Everything else is docs.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

• python3 scripts/check_docs.py: docs OK.

• ./scripts/lint.sh: passed, with 4 checks skipped (ruff twice and ansible-lint unavailable on eden). Packer and tofu lint passed.

• make validate on eden failed. Its image pulls filled eden's 47 GB root disk, so the gitleaks image could not be pulled. The pulled images were pruned and the disk is back to 24%.

  • Both gitleaks scans were re-run on their own and passed (working tree; history: 1189 commits, no leaks).
  • The secrets section passed.
  • The rest of the suite's output was not kept, so it counts as not run here. CI is the full check.

• sshd_config on Ubuntu 26.04 has Include /etc/ssh/sshd_config.d/*.conf at line 24, before X11Forwarding yes at line 113. That is why the drop-in wins.

• make validate passes (partial only; see above)

• Deployed to the lab and confirmed working (the template is not rebuilt)

• Docs updated

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

No active review issues block the security-audit documentation and Ubuntu template change disabling X11 forwarding.

No open issues 🎉

What changed in this PR

Records eden’s post-rebuild security audit and disables X11 forwarding in the Ubuntu template for future clones. Existing guests and running services remain unchanged.

Changes:

• Documents accepted SSH exposure and passwordless sudo on eden.
• Clarifies how Docker changes data-directory permissions on first startup.
• Records audit results and adds an SSH drop-in disabling X11 forwarding.

File	Description
packer/​ubuntu.pkr.hcl	Disables X11 forwarding for clones from the rebuilt template.
docs/​security.md	Records accepted SSH and sudo risks on eden.
docs/​runbooks/​build-the-bloodhound-guest.md	Explains post-startup directory modes and how to check Postgres permissions.
docs/​changelog.md	Records audit findings, cleanup, and remaining limitations.

_{Review effort: Balanced}