foxhunt/AGENT_S1_QUICK_REFERENCE.md

Agent S1: Security Hardening - Quick Reference Guide

Date: 2025-10-19 Purpose: Fast reference for security blocker resolution

---

🎯 QUICK STATUS

Blocker	Status	Time	Priority
B1: TLS	🟡 80%	4h	P0
B2: JWT	✅ 100%	0h	DONE
B3: MFA	✅ 100%	0h	DONE
P0-1: OCSP	🔴 0%	1h	CRITICAL
P0-2: Passwords	🔴 0%	1h	CRITICAL

Total Time to 100%: 6 hours

---

🔥 CRITICAL 1-HOUR FIXES

Fix 1: Production Passwords (1 hour)

# Generate
export POSTGRES_PASSWORD=$(openssl rand -base64 32)
export GRAFANA_PASSWORD=$(openssl rand -base64 24)
export MINIO_PASSWORD=$(openssl rand -base64 32)

# Store in Vault
vault kv put secret/foxhunt/postgres password="$POSTGRES_PASSWORD"
vault kv put secret/foxhunt/grafana password="$GRAFANA_PASSWORD"
vault kv put secret/foxhunt/minio password="$MINIO_PASSWORD"

# Verify
grep -r "foxhunt_dev_password" . --exclude-dir=.git
# Expected: 0 results

Fix 2: OCSP Revocation (1 hour)

// File: services/ml_training_service/src/tls_config.rs:594-603
// REPLACE TODO with:
async fn check_ocsp_revocation(&self, cert: &X509Certificate<'_>, ocsp_url: &str) -> Result<bool> {
    use ocsp::{OcspRequest, OcspResponse, CertStatus};

    let request = OcspRequest::from_cert(cert)?;
    let client = reqwest::Client::builder().timeout(Duration::from_secs(5)).build()?;
    let response = client.post(ocsp_url)
        .header("Content-Type", "application/ocsp-request")
        .body(request.to_der()?)
        .send().await?;

    let ocsp_resp = OcspResponse::from_der(&response.bytes().await?)?;

    match ocsp_resp.cert_status {
        CertStatus::Good => Ok(false),
        CertStatus::Revoked(_) => Ok(true),
        CertStatus::Unknown => Err(anyhow!("OCSP Unknown status"))
    }
}

---

🔐 TLS QUICK START (4 hours)

API Gateway (30 min)

// File: services/api_gateway/src/main.rs
use api_gateway::auth::mtls::tls_config::ApiGatewayTlsConfig;

// After JWT config:
let tls_config = if std::env::var("TLS_ENABLED").unwrap_or_default().parse().unwrap_or(false) {
    let tls = ApiGatewayTlsConfig::from_files(
        &std::env::var("TLS_CERT_PATH")?,
        &std::env::var("TLS_KEY_PATH")?,
        &std::env::var("TLS_CA_PATH")?,
        true,
    ).await?;
    Some(tls.to_server_tls_config())
} else {
    None
};

// Update server:
let server = match tls_config {
    Some(tls) => Server::builder().tls_config(tls)?,
    None => Server::builder(),
};

Other Services (same pattern)

ML Training (30 min): Copy API Gateway pattern Backtesting (30 min): Copy API Gateway pattern Trading (1h): Copy tls_config.rs + update main.rs Trading Agent (1h): Copy tls_config.rs + update main.rs

---

✅ VERIFICATION COMMANDS

TLS Verification

# Test without client cert (should fail)
grpcurl -plaintext localhost:50051 list

# Test with client cert (should succeed)
grpcurl -cert certs/client-cert.pem -key certs/client-key.pem \
  -cacert certs/ca/ca-cert.pem localhost:50051 list

JWT Verification

# Check Vault secret
docker exec -e VAULT_TOKEN=foxhunt-dev-root foxhunt-vault \
  vault kv get secret/foxhunt/jwt
# Expected: 88-character jwt_secret

MFA Verification

# Check MFA enforcement
psql "postgresql://foxhunt:$POSTGRES_PASSWORD@localhost:5432/foxhunt" \
  -c "SELECT * FROM users_requiring_mfa;"

Password Verification

# No hardcoded credentials
grep -r "foxhunt_dev_password" . --exclude-dir=.git --exclude="*.example"
# Expected: 0 results

---

📋 MINIMAL DEPLOYMENT CHECKLIST

Critical (MUST DO):

• Generate production passwords (1h)
• Implement OCSP (1h)
• Enable TLS on all services (4h)
• Enroll admin in MFA (10min)

Verification:

• All services start with TLS_ENABLED=true
• gRPC requires client certificates
• Zero hardcoded credentials
• Admin can login with MFA

Time: 6 hours → 100% production ready

---

🚨 CRITICAL FILES

Configuration:

• docker-compose.yml - Service passwords
• .env - TLS configuration
• .env.production - Production secrets

TLS Infrastructure:

• services/api_gateway/src/auth/mtls/tls_config.rs
• services/ml_training_service/src/tls_config.rs
• services/backtesting_service/src/tls_config.rs

Main Files to Edit:

• services/api_gateway/src/main.rs
• services/ml_training_service/src/main.rs
• services/backtesting_service/src/main.rs
• services/trading_service/src/main.rs
• services/trading_agent_service/src/main.rs

---

📖 DOCUMENTATION

Detailed Reports:

• AGENT_S1_SECURITY_HARDENING_STATUS.md - Full status
• SECURITY_PRODUCTION_DEPLOYMENT_CHECKLIST.md - Step-by-step guide
• AGENT_H1_TLS_ENABLEMENT_REPORT.md - TLS infrastructure
• AGENT_H2_JWT_SECRET_ROTATION_COMPLETE.md - JWT details
• AGENT_H3_MFA_ENABLEMENT_REPORT.md - MFA details

Quick Access:

• Security audit: AGENT_SECURITY_01_COMPREHENSIVE_AUDIT.md
• Main docs: CLAUDE.md (Security section)

---

🎯 FASTEST PATH TO PRODUCTION

6 hours:

1. Production passwords → 1h
2. OCSP implementation → 1h
3. TLS code changes → 4h

Then deploy:

TLS_ENABLED=true docker-compose up -d

---

Quick Reference Version: 1.0 Last Updated: 2025-10-19