danvics/Pulse
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: Update temperature monitoring security notice for proxy architecture

Browse source 
Replaced outdated security warnings with accurate information about
the pulse-temp-proxy architecture:

- Removed scary 'legacy feature' and 'compromised container' warnings
- Explains secure proxy architecture for containerized deployments
- Notes that SSH keys are stored on Proxmox host (not in container)
- Clarifies container compromise does not expose credentials
- Includes information for both containerized and native installs
- More factual and less alarmist tone

The old message implied temperature monitoring was insecure for
containers, which is no longer true with pulse-temp-proxy.

Related to #528
This commit is contained in:
rcourtman 2025-10-12 22:11:12 +00:00
parent 5c1dec14e1
commit dd468a9e26
1 changed files with 14 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
internal/api/config_handlers.go
View file

@ -3219,23 +3219,25 @@ if grep -q "pulse.lan\|pulse.home\|192.168" <<< "%s"; then
:
fi
echo "⚠️ SECURITY NOTICE"
echo "📊 Temperature Monitoring"
echo ""
echo "Temperature monitoring requires SSH access from Pulse to this node."
echo "This creates the following security considerations:"
echo "Temperature monitoring collects CPU and drive temperatures via SSH."
echo ""
echo " • SSH private keys will be stored on the Pulse server"
echo " • If Pulse runs in a container (LXC/Docker), keys live inside it"
echo " • Compromised Pulse = potential access to Proxmox hosts"
echo "Security Architecture:"
echo " • SSH key authentication (industry standard, used by Ansible/Terraform)"
echo " • Forced command restriction (only 'sensors -j' can execute)"
echo " • No port forwarding, X11, PTY, or agent forwarding allowed"
echo ""
echo "Mitigations in place:"
echo " • Forced command restriction (only 'sensors -j' can run)"
echo " • No port forwarding, X11, or PTY allocation"
echo "For containerized Pulse (LXC/Docker):"
echo " • SSH keys stored on Proxmox host (not inside container)"
echo " • pulse-temp-proxy service manages connections securely"
echo " • Container compromise does not expose SSH credentials"
echo ""
echo "This is a legacy feature. Future versions will use agent-based"
echo "architecture where nodes push metrics to Pulse (more secure)."
echo "For native Pulse installations:"
echo " • SSH keys stored in Pulse service user's home directory"
echo " • Standard key-based authentication with forced commands"
echo ""
echo "Do you want to enable temperature monitoring? [y/N]"
echo "Enable temperature monitoring? [y/N]"
echo -n "> "
ENABLE_TEMP_MONITORING="n"