32 lines
1.4 KiB
Markdown
32 lines
1.4 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
|---------|-----------|
|
|
| 3.x (upcoming) | Yes |
|
|
| 2.3.x | Yes |
|
|
| 2.2.x and earlier | No — please upgrade |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
**Do not open a public GitHub issue for security vulnerabilities.**
|
|
|
|
Email security reports to: **security@ksatechnologies.com** (or **theprofessor@ksatechnologies.com**)
|
|
|
|
Include:
|
|
- A description of the vulnerability
|
|
- Steps to reproduce
|
|
- The potential impact
|
|
- Any suggested fixes if you have them
|
|
|
|
You will receive an acknowledgment within 72 hours. We aim to release a fix within 14 days for confirmed vulnerabilities and will credit reporters in the release notes unless anonymity is requested.
|
|
|
|
## Security Considerations for Operators
|
|
|
|
- **API tokens are stored in `/etc/pve/storage.cfg`** which is readable only by root and replicated across the PVE cluster via `pmxcfs`. Treat cluster access accordingly.
|
|
- **Use API token authentication** rather than username/password. Tokens can be revoked individually without changing your TrueNAS user password.
|
|
- **Enable SSL** on the TrueNAS API connection. The plugin accepts self-signed certificates (SSL verification is relaxed) — use a private CA or valid certificate where possible.
|
|
- **Scope API tokens** to the minimum required permissions on TrueNAS if your version supports scoped tokens.
|
|
- **Restrict network access** to the TrueNAS management interface to only the Proxmox nodes that need it.
|