# Agent S1: Security Hardening - Quick Reference Guide

**Date**: 2025-10-19
**Purpose**: Fast reference for security blocker resolution

---

## 🎯 QUICK STATUS

| Blocker | Status | Time | Priority |
|---------|--------|------|----------|
| **B1: TLS** | 🟡 80% | 4h | P0 |
| **B2: JWT** | ✅ 100% | 0h | DONE |
| **B3: MFA** | ✅ 100% | 0h | DONE |
| **P0-1: OCSP** | 🔴 0% | 1h | CRITICAL |
| **P0-2: Passwords** | 🔴 0% | 1h | CRITICAL |

**Total Time to 100%**: **6 hours**

---

## 🔥 CRITICAL 1-HOUR FIXES

### Fix 1: Production Passwords (1 hour)

```bash
# Generate
export POSTGRES_PASSWORD=$(openssl rand -base64 32)
export GRAFANA_PASSWORD=$(openssl rand -base64 24)
export MINIO_PASSWORD=$(openssl rand -base64 32)

# Store in Vault
vault kv put secret/foxhunt/postgres password="$POSTGRES_PASSWORD"
vault kv put secret/foxhunt/grafana password="$GRAFANA_PASSWORD"
vault kv put secret/foxhunt/minio password="$MINIO_PASSWORD"

# Verify
grep -r "foxhunt_dev_password" . --exclude-dir=.git
# Expected: 0 results
```

### Fix 2: OCSP Revocation (1 hour)

```rust
// File: services/ml_training_service/src/tls_config.rs:594-603
// REPLACE TODO with:
async fn check_ocsp_revocation(&self, cert: &X509Certificate<'_>, ocsp_url: &str) -> Result<bool> {
    use ocsp::{OcspRequest, OcspResponse, CertStatus};

    let request = OcspRequest::from_cert(cert)?;
    let client = reqwest::Client::builder().timeout(Duration::from_secs(5)).build()?;
    let response = client.post(ocsp_url)
        .header("Content-Type", "application/ocsp-request")
        .body(request.to_der()?)
        .send().await?;

    let ocsp_resp = OcspResponse::from_der(&response.bytes().await?)?;

    match ocsp_resp.cert_status {
        CertStatus::Good => Ok(false),
        CertStatus::Revoked(_) => Ok(true),
        CertStatus::Unknown => Err(anyhow!("OCSP Unknown status"))
    }
}
```

---

## 🔐 TLS QUICK START (4 hours)

### API Gateway (30 min)

```rust
// File: services/api_gateway/src/main.rs
use api_gateway::auth::mtls::tls_config::ApiGatewayTlsConfig;

// After JWT config:
let tls_config = if std::env::var("TLS_ENABLED").unwrap_or_default().parse().unwrap_or(false) {
    let tls = ApiGatewayTlsConfig::from_files(
        &std::env::var("TLS_CERT_PATH")?,
        &std::env::var("TLS_KEY_PATH")?,
        &std::env::var("TLS_CA_PATH")?,
        true,
    ).await?;
    Some(tls.to_server_tls_config())
} else {
    None
};

// Update server:
let server = match tls_config {
    Some(tls) => Server::builder().tls_config(tls)?,
    None => Server::builder(),
};
```

### Other Services (same pattern)

**ML Training** (30 min): Copy API Gateway pattern
**Backtesting** (30 min): Copy API Gateway pattern
**Trading** (1h): Copy tls_config.rs + update main.rs
**Trading Agent** (1h): Copy tls_config.rs + update main.rs

---

## ✅ VERIFICATION COMMANDS

### TLS Verification

```bash
# Test without client cert (should fail)
grpcurl -plaintext localhost:50051 list

# Test with client cert (should succeed)
grpcurl -cert certs/client-cert.pem -key certs/client-key.pem \
  -cacert certs/ca/ca-cert.pem localhost:50051 list
```

### JWT Verification

```bash
# Check Vault secret
docker exec -e VAULT_TOKEN=foxhunt-dev-root foxhunt-vault \
  vault kv get secret/foxhunt/jwt
# Expected: 88-character jwt_secret
```

### MFA Verification

```bash
# Check MFA enforcement
psql "postgresql://foxhunt:$POSTGRES_PASSWORD@localhost:5432/foxhunt" \
  -c "SELECT * FROM users_requiring_mfa;"
```

### Password Verification

```bash
# No hardcoded credentials
grep -r "foxhunt_dev_password" . --exclude-dir=.git --exclude="*.example"
# Expected: 0 results
```

---

## 📋 MINIMAL DEPLOYMENT CHECKLIST

**Critical (MUST DO)**:
- [ ] Generate production passwords (1h)
- [ ] Implement OCSP (1h)
- [ ] Enable TLS on all services (4h)
- [ ] Enroll admin in MFA (10min)

**Verification**:
- [ ] All services start with TLS_ENABLED=true
- [ ] gRPC requires client certificates
- [ ] Zero hardcoded credentials
- [ ] Admin can login with MFA

**Time**: 6 hours → **100% production ready**

---

## 🚨 CRITICAL FILES

**Configuration**:
- `docker-compose.yml` - Service passwords
- `.env` - TLS configuration
- `.env.production` - Production secrets

**TLS Infrastructure**:
- `services/api_gateway/src/auth/mtls/tls_config.rs`
- `services/ml_training_service/src/tls_config.rs`
- `services/backtesting_service/src/tls_config.rs`

**Main Files to Edit**:
- `services/api_gateway/src/main.rs`
- `services/ml_training_service/src/main.rs`
- `services/backtesting_service/src/main.rs`
- `services/trading_service/src/main.rs`
- `services/trading_agent_service/src/main.rs`

---

## 📖 DOCUMENTATION

**Detailed Reports**:
- `AGENT_S1_SECURITY_HARDENING_STATUS.md` - Full status
- `SECURITY_PRODUCTION_DEPLOYMENT_CHECKLIST.md` - Step-by-step guide
- `AGENT_H1_TLS_ENABLEMENT_REPORT.md` - TLS infrastructure
- `AGENT_H2_JWT_SECRET_ROTATION_COMPLETE.md` - JWT details
- `AGENT_H3_MFA_ENABLEMENT_REPORT.md` - MFA details

**Quick Access**:
- Security audit: `AGENT_SECURITY_01_COMPREHENSIVE_AUDIT.md`
- Main docs: `CLAUDE.md` (Security section)

---

## 🎯 FASTEST PATH TO PRODUCTION

**6 hours**:
1. Production passwords → 1h
2. OCSP implementation → 1h
3. TLS code changes → 4h

**Then deploy**:
```bash
TLS_ENABLED=true docker-compose up -d
```

---

**Quick Reference Version**: 1.0
**Last Updated**: 2025-10-19