Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add a controls section here #987

Merged
merged 3 commits into from
Jul 17, 2024
Merged

add a controls section here #987

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4bb02fe
add a controls section here
johrstrom Jul 16, 2024
6de45d3
reset these lines
johrstrom Jul 16, 2024
610fe27
Update security.rst
matt257 Jul 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions source/customizations.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -395,6 +395,8 @@ Note that this will limit the download size for all users of the Open OnDemand i

Values like ``1000M`` or ``20G`` will not be accepted and may cause errors.

.. _set-file-allowlist:

Block or Allow Directory Access
-------------------------------

Expand Down
15 changes: 13 additions & 2 deletions source/security.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,19 @@ Limitations

- **HTTP Traffic to Origin Servers**: Traffic to backend services, including computational resources like Jupyter servers, is currently over HTTP, which is unencrypted. Plans are underway to upgrade this to HTTPS to ensure encryption of data in transit, thereby bolstering security.

Security Controls
-----------------
Controls
^^^^^^^^

These are things the the out of the box OnDemand installation will provide
that some centers may want to change or disable altogether.

- **File Access**: OnDemand lets users navigate the file system. While file permissions
limit what a user can view and navigate to, some centers may want to limit this even further.
One option is to :ref:`set-file-allowlist` to limit what directories users may navigate to.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This addition was really what I was getting at in comments in the previous PR.

Instead of just blind links to all customizations - we have specific callouts to specific behaviors that an initial installation may want to change. With a link to that specific configuration.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for explaining, that looks good to me.



Additional Information
----------------------
Comment on lines +37 to +38
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure about this heading. Happy to change it. Don't really know the purpose of this section, so can't really speak to it.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sure, change it to whatever you'd like! I'll remove the monitoring and logging line.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK - if your'e removing those 2 maybe I can just remove the whole section and move the line about vulnerability reporting somewhere else, maybe nearer the top of the page?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you think that will be better please do. I was trying to put info that could be useful for security somewhere, but i'm not sure about the order. i think its a good idea for vulnerability reporting to be mentioned near the top


- **Monitoring and Logging**: Comprehensive logging mechanisms are integral for security audits and incident response. Detailed guidelines and settings for these features can be found at :ref:`logging`.

Expand Down
Loading