236 lines
5.0 KiB
Markdown
236 lines
5.0 KiB
Markdown
# RustyTorch++ Security Guidelines
|
|
|
|
## Overview
|
|
|
|
This document outlines security best practices for deploying and configuring RustyTorch++.
|
|
|
|
## Secret Management
|
|
|
|
### Environment Variables
|
|
|
|
Sensitive configuration should be provided via environment variables, NOT hardcoded in config files:
|
|
|
|
```bash
|
|
# Database credentials
|
|
export RTX_DATABASE__URL="postgres://user:password@host:5432/db"
|
|
export RTX_DATABASE__PASSWORD="<secure-password>"
|
|
|
|
# API keys
|
|
export RTX_HUB__API_KEY="<api-key>"
|
|
export RTX_AWS__SECRET_ACCESS_KEY="<aws-secret>"
|
|
|
|
# Authentication secrets
|
|
export RTX_AUTH__JWT_SECRET="<jwt-signing-key>"
|
|
export RTX_AUTH__SESSION_SECRET="<session-secret>"
|
|
```
|
|
|
|
### Configuration File Security
|
|
|
|
When using configuration files:
|
|
|
|
1. **Never commit secrets** - Use `.gitignore` to exclude:
|
|
- `.env` files
|
|
- `*.secret.toml` files
|
|
- `credentials.json`
|
|
|
|
2. **Use placeholders** - Reference environment variables:
|
|
```toml
|
|
[database]
|
|
url = "${RTX_DATABASE__URL}"
|
|
password = "${RTX_DATABASE__PASSWORD}"
|
|
```
|
|
|
|
3. **File permissions** - Restrict config file access:
|
|
```bash
|
|
chmod 600 /etc/rustytorch/config.toml
|
|
chown rtx-user:rtx-group /etc/rustytorch/config.toml
|
|
```
|
|
|
|
### Secret Rotation
|
|
|
|
1. **API Keys**: Rotate every 90 days minimum
|
|
2. **Database Passwords**: Rotate every 60 days
|
|
3. **JWT Secrets**: Rotate on security events or every 180 days
|
|
4. **Session Secrets**: Rotate on security events
|
|
|
|
## Input Validation
|
|
|
|
RustyTorch++ includes comprehensive input validation in `rtx-serving-api`:
|
|
|
|
```rust
|
|
use rtx_serving_api::{InputValidator, ValidationConfig};
|
|
|
|
// Use default limits
|
|
let validator = InputValidator::default();
|
|
|
|
// Validate tensor inputs
|
|
validator.validate_tensor_shape(&[32, 128, 768])?;
|
|
validator.validate_batch_size(64)?;
|
|
validator.validate_inference_input(&data, &shape)?;
|
|
|
|
// Sanitize user input
|
|
let model_id = InputValidator::sanitize_model_id(user_input)?;
|
|
```
|
|
|
|
### Default Limits
|
|
|
|
| Parameter | Default | Restrictive | Permissive |
|
|
|-----------|---------|-------------|------------|
|
|
| Max Request Size | 100MB | 10MB | 500MB |
|
|
| Max Tensor Dims | 8 | 6 | 16 |
|
|
| Max Tensor Elements | 100M | 10M | 1B |
|
|
| Max Batch Size | 256 | 64 | 1024 |
|
|
| Max Sequence Length | 128K | 32K | 1M |
|
|
| Max String Length | 1MB | 256KB | 10MB |
|
|
|
|
## Network Security
|
|
|
|
### TLS Configuration
|
|
|
|
Always use TLS in production:
|
|
|
|
```toml
|
|
[server]
|
|
tls_enabled = true
|
|
tls_cert_path = "/etc/ssl/certs/rtx.crt"
|
|
tls_key_path = "/etc/ssl/private/rtx.key"
|
|
min_tls_version = "1.2"
|
|
```
|
|
|
|
### Network Isolation
|
|
|
|
1. Run inference servers in isolated network segments
|
|
2. Use firewall rules to restrict access
|
|
3. Implement rate limiting (built-in):
|
|
|
|
```rust
|
|
use rtx_serving_api::RateLimitManager;
|
|
|
|
let rate_limiter = RateLimitManager::new(config);
|
|
```
|
|
|
|
## Dependency Security
|
|
|
|
### Automated Scanning
|
|
|
|
Security scanning is integrated into CI/CD:
|
|
|
|
```yaml
|
|
# .github/workflows/ci.yml
|
|
- name: Security audit
|
|
uses: rustsec/audit-check@v2
|
|
```
|
|
|
|
### Current Vulnerabilities
|
|
|
|
See `SECURITY_AUDIT.md` for current vulnerability status and remediation plans.
|
|
|
|
### Dependency Updates
|
|
|
|
Run regular dependency updates:
|
|
|
|
```bash
|
|
# Check for updates
|
|
cargo outdated
|
|
|
|
# Run security audit
|
|
cargo audit
|
|
|
|
# Update dependencies
|
|
cargo update
|
|
```
|
|
|
|
## Runtime Security
|
|
|
|
### Circuit Breaker Pattern
|
|
|
|
Built-in resilience against cascading failures:
|
|
|
|
```rust
|
|
use rtx_serving_api::CircuitBreaker;
|
|
|
|
let breaker = CircuitBreaker::new(CircuitBreakerConfig {
|
|
failure_threshold: 5,
|
|
reset_timeout: Duration::from_secs(30),
|
|
half_open_requests: 3,
|
|
});
|
|
```
|
|
|
|
### Resource Limits
|
|
|
|
Configure resource limits in production:
|
|
|
|
```toml
|
|
[limits]
|
|
max_concurrent_requests = 1000
|
|
max_memory_mb = 32768
|
|
request_timeout_ms = 30000
|
|
max_queue_size = 10000
|
|
```
|
|
|
|
## Audit Logging
|
|
|
|
Enable audit logging for security-sensitive operations:
|
|
|
|
```toml
|
|
[logging]
|
|
audit_enabled = true
|
|
audit_log_path = "/var/log/rustytorch/audit.log"
|
|
log_level = "info"
|
|
|
|
# Log these events
|
|
audit_events = [
|
|
"model_load",
|
|
"model_unload",
|
|
"config_change",
|
|
"auth_failure",
|
|
"rate_limit_exceeded",
|
|
]
|
|
```
|
|
|
|
## Container Security
|
|
|
|
When deploying in containers:
|
|
|
|
1. **Use non-root user**:
|
|
```dockerfile
|
|
USER rtx-user
|
|
```
|
|
|
|
2. **Read-only filesystem**:
|
|
```bash
|
|
docker run --read-only ...
|
|
```
|
|
|
|
3. **No new privileges**:
|
|
```bash
|
|
docker run --security-opt=no-new-privileges ...
|
|
```
|
|
|
|
4. **Resource limits**:
|
|
```bash
|
|
docker run --memory=32g --cpus=8 ...
|
|
```
|
|
|
|
## Reporting Security Issues
|
|
|
|
Please report security vulnerabilities to: security@rustytorch.dev
|
|
|
|
Do NOT create public issues for security vulnerabilities.
|
|
|
|
## Security Checklist
|
|
|
|
Before deploying to production:
|
|
|
|
- [ ] No hardcoded secrets in code or config files
|
|
- [ ] All secrets provided via environment variables or secret manager
|
|
- [ ] TLS enabled for all network communication
|
|
- [ ] Rate limiting configured
|
|
- [ ] Input validation enabled (default)
|
|
- [ ] Circuit breaker patterns enabled
|
|
- [ ] Audit logging enabled
|
|
- [ ] Dependencies audited (cargo audit passes)
|
|
- [ ] Container running as non-root user
|
|
- [ ] Resource limits configured
|
|
- [ ] Network isolation in place
|