From ba20f65bfac1132ec2b349d64e0ea880516e58b2 Mon Sep 17 00:00:00 2001 From: Elijah Greenstein Date: Tue, 7 Jul 2026 13:24:11 -0700 Subject: [PATCH 1/4] doc: add logging section to security explanation Signed-off-by: Elijah Greenstein --- doc/explanation/security.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/doc/explanation/security.md b/doc/explanation/security.md index ed3fdeb25..5c78b56ed 100644 --- a/doc/explanation/security.md +++ b/doc/explanation/security.md @@ -31,10 +31,16 @@ Report potential security issues privately through GitHub by [filing a security (exp-security-microcloud)= ## MicroCloud +### Cryptography + MicroCloud manages cluster membership and encrypted communication through mTLS and certificate-based identities. When a machine joins a cluster, it verifies the cluster’s certificate fingerprint and receives the complete set of member certificates, establishing a consistent trust store. During the join process, MicroCloud uses an **explicit trust establishment mechanism** designed to prevent secret leakage and mitigate {spellexception}`man-in-the-middle` attacks. This mechanism uses a Hash-Based Message Authentication Code (HMAC) to sign the messages exchanged between the machine that initiates the join process and the joining peers. The shared secret used for joining is never transmitted over the network. The join process also enforces rate limits and session timeouts to reduce the risk of replay and brute-force attacks. For further information, refer to the [public specification](https://discourse.ubuntu.com/t/explicit-trust-establishment-mechanism-for-microcloud/44261). +### Logging + +MicroCloud creates logs through systemd. These logs can be accessed with `sudo snap logs microcloud`. + (exp-security-lxd)= ## LXD From 27bdc62a3e273273094930ba8605e9f585ea7902 Mon Sep 17 00:00:00 2001 From: Elijah Greenstein Date: Tue, 7 Jul 2026 13:48:03 -0700 Subject: [PATCH 2/4] doc: add links to security reporting policies Signed-off-by: Elijah Greenstein --- doc/explanation/security.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/explanation/security.md b/doc/explanation/security.md index 5c78b56ed..5bc1267b3 100644 --- a/doc/explanation/security.md +++ b/doc/explanation/security.md @@ -26,7 +26,7 @@ All snaps are digitally signed using {ref}`assertions Date: Tue, 7 Jul 2026 13:58:51 -0700 Subject: [PATCH 3/4] doc: add release notes links to security page Signed-off-by: Elijah Greenstein --- doc/explanation/security.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/doc/explanation/security.md b/doc/explanation/security.md index 5bc1267b3..4b2e09bee 100644 --- a/doc/explanation/security.md +++ b/doc/explanation/security.md @@ -17,7 +17,9 @@ MicroCloud runs on Ubuntu and benefits from all [Ubuntu platform security measur Ubuntu LTS releases subscribed to Ubuntu Pro can use the [Ubuntu Security Guide (USG)](https://documentation.ubuntu.com/security/compliance/usg/) for CIS hardening. Refer to the LXD documentation on {ref}`lxd:howto-security-harden-cis` for related details about auditing LXD hosts with USG. (exp-security-snaps)= -## Snaps +## Snaps and supported versions + +The MicroCloud team maintains both Long Term Support (LTS) and feature releases. See {ref}`ref-releases-snaps` and our {ref}`ref-release-notes` for details about the currently supported releases. MicroCloud and its components are distributed as [snaps](https://snapcraft.io/docs), which enhances security by providing a confined environment with a streamlined update mechanism. Both LTS and feature channels receive regular security updates through Canonical’s official infrastructure. From 900fde89ae51fdccc3727145bf732d0cc91a1bfd Mon Sep 17 00:00:00 2001 From: Elijah Greenstein Date: Thu, 9 Jul 2026 12:26:50 -0700 Subject: [PATCH 4/4] doc/.custom_wordlist.txt: add systemd Signed-off-by: Elijah Greenstein --- doc/.custom_wordlist.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/doc/.custom_wordlist.txt b/doc/.custom_wordlist.txt index a5e678701..dfa137c74 100644 --- a/doc/.custom_wordlist.txt +++ b/doc/.custom_wordlist.txt @@ -83,6 +83,7 @@ subfolders subnet subnets SVG +systemd TCP Terraform TinyPNG