[DOCS] Review Security Docs - Security WG

[barneysowood]

Description

Security documentation is fragmented, difficult to use and out of date. We've agreed within the Security Working Group to undertake a review to:

• Find and document the location of existing security related docs
• Assess those docs to see if they should be updated/removed/consolidated
• Make the required changes
• Co-ordinate with the Docs WG to work out the best location for those docs and how to make them more easily discoverable

Suggested Fix

• Find existing docs and document their location this issue
• Review them
• Decide on required action for each doc

Additional context

• Running the Salt Master/Minon as an Unprivileged user - not updated for 3006.0 (or for some time before that)
• Hardening Salt - lots of info, not all of it good, written in a difficult to follow and not easily actionable way
• Salt User Guide - Security page - more up to date, but repeats qute a bit of info from the hardening guide without much detail or actionable info
• Security docs issues:

  • 62820

  • 57158

  • 62144

[barneysowood]

@jeff350, list of docs for review so far:

• https://docs.saltproject.io/en/latest/topics/hardening.html
• https://docs.saltproject.io/salt/user-guide/en/latest/topics/security.html
• https://docs.saltproject.io/en/latest/ref/configuration/nonroot.html
• https://docs.saltproject.io/en/latest/topics/eauth/access_control.html
• https://docs.saltproject.io/en/latest/ref/publisheracl.html

If you can find any others or anyone else has suggestions?

[jeff350]

@barneysowood A couple others are:

• https://docs.saltproject.io/en/latest/topics/best_practices.html#storing-secure-data
• https://docs.saltproject.io/en/latest/faq.html#faq-grain-security
• https://docs.saltproject.io/en/getstarted/system/communication.html
• https://docs.saltproject.io/en/latest/security/index.html