cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a861ca4275f32a7f4c5bf1d7a9d3f720a508700a
jobtrackingapp/docs/audits/2026-09-07/validation/evidence/b06-runtime-observations.json
T
cesnimda 0954876295 fix(security): enforce audited account, network and resource boundaries 
Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2026-09-09 18:21:47 +02:00

806 lines
20 KiB
JSON
Raw Blame History

{
"ticket": "B06",
"utc": "2026-09-09T16:06:49.668967+00:00",
"status": "Implementation complete; full local runtime and production verification incomplete; F04 open",
"public": {
"utc": "2026-09-09T10:43:53.552659+00:00",
"hostname": "jobs.cesnimda.uk",
"dns_addresses": [
"109.189.21.248"
],
"certificate": {
"verified": true,
"peer": [
"109.189.21.248",
443
],
"tls": "TLSv1.3",
"certificate": {
"subject": [
[
[
"commonName",
"jobs.cesnimda.uk"
]
]
],
"issuer": [
[
[
"countryName",
"US"
]
],
[
[
"organizationName",
"Let's Encrypt"
]
],
[
[
"commonName",
"YR2"
]
]
],
"version": 3,
"serialNumber": "060998FB27348950371ABE6EE336566BDEFE",
"notBefore": "Aug 16 20:35:58 2026 GMT",
"notAfter": "Nov 14 20:35:57 2026 GMT",
"subjectAltName": [
[
"DNS",
"jobs.cesnimda.uk"
]
],
"caIssuers": [
"http://yr2.i.lencr.org/"
],
"crlDistributionPoints": [
"http://yr2.c.lencr.org/127.crl"
]
}
},
"requests": [
{
"name": "public_https",
"command": [
"curl.exe",
"--noproxy",
"*",
"--connect-timeout",
"4",
"--max-time",
"8",
"--silent",
"--show-error",
"--dump-header",
"-",
"--output",
"NUL",
"--write-out",
"\nB06_META %{json}\n",
"https://jobs.cesnimda.uk/api/auth/config"
],
"exit": 0,
"headers": [
"HTTP/1.1 200 OK",
"Content-Type: application/json; charset=utf-8",
"Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()",
"Referrer-Policy: same-origin",
"Strict-Transport-Security: max-age=63072000; includeSubDomains; preload",
"X-Content-Type-Options: nosniff",
"X-Frame-Options: SAMEORIGIN"
],
"metadata": {
"http_code": 200,
"remote_ip": "109.189.21.248",
"remote_port": 443,
"local_ip": "192.168.50.2",
"ssl_verify_result": 0,
"time_total": 0.172905,
"exitcode": 0
},
"stderr": ""
},
{
"name": "public_http",
"command": [
"curl.exe",
"--noproxy",
"*",
"--connect-timeout",
"4",
"--max-time",
"8",
"--silent",
"--show-error",
"--dump-header",
"-",
"--output",
"NUL",
"--write-out",
"\nB06_META %{json}\n",
"http://jobs.cesnimda.uk/api/auth/config"
],
"exit": 0,
"headers": [
"HTTP/1.1 301 Moved Permanently",
"Location: https://jobs.cesnimda.uk:444/api/auth/config",
"Content-Length: 17"
],
"metadata": {
"http_code": 301,
"remote_ip": "109.189.21.248",
"remote_port": 80,
"local_ip": "192.168.50.2",
"ssl_verify_result": 0,
"time_total": 0.023086,
"exitcode": 0
},
"stderr": ""
},
{
"name": "public_https_forged_forwarding",
"command": [
"curl.exe",
"--noproxy",
"*",
"--connect-timeout",
"4",
"--max-time",
"8",
"--silent",
"--show-error",
"--dump-header",
"-",
"--output",
"NUL",
"--write-out",
"\nB06_META %{json}\n",
"https://jobs.cesnimda.uk/api/auth/config",
"--header",
"X-Forwarded-For: 198.51.100.10",
"--header",
"X-Forwarded-Proto: http",
"--header",
"X-Forwarded-Host: attacker.example.test"
],
"exit": 0,
"headers": [
"HTTP/1.1 200 OK",
"Content-Type: application/json; charset=utf-8",
"Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()",
"Referrer-Policy: same-origin",
"Strict-Transport-Security: max-age=63072000; includeSubDomains; preload",
"X-Content-Type-Options: nosniff",
"X-Frame-Options: SAMEORIGIN"
],
"metadata": {
"http_code": 200,
"remote_ip": "109.189.21.248",
"remote_port": 443,
"local_ip": "192.168.50.2",
"ssl_verify_result": 0,
"time_total": 0.173702,
"exitcode": 0
},
"stderr": ""
},
{
"name": "direct_3000_109.189.21.248_none",
"command": [
"curl.exe",
"--noproxy",
"*",
"--connect-timeout",
"4",
"--max-time",
"8",
"--silent",
"--show-error",
"--dump-header",
"-",
"--output",
"NUL",
"--write-out",
"\nB06_META %{json}\n",
"http://109.189.21.248:3000/api/auth/config",
"--header",
"Host: jobs.cesnimda.uk"
],
"exit": 7,
"headers": [],
"metadata": {
"http_code": 0,
"remote_ip": "",
"remote_port": -1,
"local_ip": "",
"ssl_verify_result": 0,
"time_total": 2.040384,
"exitcode": 7
},
"stderr": "curl: (7) Failed to connect to 109.189.21.248:3000 after 2040 ms: Could not connect to server"
},
{
"name": "direct_3000_109.189.21.248_xff",
"command": [
"curl.exe",
"--noproxy",
"*",
"--connect-timeout",
"4",
"--max-time",
"8",
"--silent",
"--show-error",
"--dump-header",
"-",
"--output",
"NUL",
"--write-out",
"\nB06_META %{json}\n",
"http://109.189.21.248:3000/api/auth/config",
"--header",
"Host: jobs.cesnimda.uk",
"--header",
"X-Forwarded-For: 198.51.100.10"
],
"exit": 7,
"headers": [],
"metadata": {
"http_code": 0,
"remote_ip": "",
"remote_port": -1,
"local_ip": "",
"ssl_verify_result": 0,
"time_total": 2.049992,
"exitcode": 7
},
"stderr": "curl: (7) Failed to connect to 109.189.21.248:3000 after 2049 ms: Could not connect to server"
},
{
"name": "direct_3000_109.189.21.248_proto",
"command": [
"curl.exe",
"--noproxy",
"*",
"--connect-timeout",
"4",
"--max-time",
"8",
"--silent",
"--show-error",
"--dump-header",
"-",
"--output",
"NUL",
"--write-out",
"\nB06_META %{json}\n",
"http://109.189.21.248:3000/api/auth/config",
"--header",
"Host: jobs.cesnimda.uk",
"--header",
"X-Forwarded-Proto: https"
],
"exit": 7,
"headers": [],
"metadata": {
"http_code": 0,
"remote_ip": "",
"remote_port": -1,
"local_ip": "",
"ssl_verify_result": 0,
"time_total": 2.041284,
"exitcode": 7
},
"stderr": "curl: (7) Failed to connect to 109.189.21.248:3000 after 2041 ms: Could not connect to server"
},
{
"name": "direct_3000_109.189.21.248_host",
"command": [
"curl.exe",
"--noproxy",
"*",
"--connect-timeout",
"4",
"--max-time",
"8",
"--silent",
"--show-error",
"--dump-header",
"-",
"--output",
"NUL",
"--write-out",
"\nB06_META %{json}\n",
"http://109.189.21.248:3000/api/auth/config",
"--header",
"Host: attacker.example.test"
],
"exit": 7,
"headers": [],
"metadata": {
"http_code": 0,
"remote_ip": "",
"remote_port": -1,
"local_ip": "",
"ssl_verify_result": 0,
"time_total": 2.053169,
"exitcode": 7
},
"stderr": "curl: (7) Failed to connect to 109.189.21.248:3000 after 2053 ms: Could not connect to server"
},
{
"name": "direct_3000_109.189.21.248_combined",
"command": [
"curl.exe",
"--noproxy",
"*",
"--connect-timeout",
"4",
"--max-time",
"8",
"--silent",
"--show-error",
"--dump-header",
"-",
"--output",
"NUL",
"--write-out",
"\nB06_META %{json}\n",
"http://109.189.21.248:3000/api/auth/config",
"--header",
"Host: jobs.cesnimda.uk",
"--header",
"X-Forwarded-For: 198.51.100.10",
"--header",
"X-Forwarded-Proto: https",
"--header",
"X-Forwarded-Host: attacker.example.test"
],
"exit": 7,
"headers": [],
"metadata": {
"http_code": 0,
"remote_ip": "",
"remote_port": -1,
"local_ip": "",
"ssl_verify_result": 0,
"time_total": 2.042874,
"exitcode": 7
},
"stderr": "curl: (7) Failed to connect to 109.189.21.248:3000 after 2042 ms: Could not connect to server"
},
{
"name": "direct_3000_109.189.21.248_malformed_chain",
"command": [
"curl.exe",
"--noproxy",
"*",
"--connect-timeout",
"4",
"--max-time",
"8",
"--silent",
"--show-error",
"--dump-header",
"-",
"--output",
"NUL",
"--write-out",
"\nB06_META %{json}\n",
"http://109.189.21.248:3000/api/auth/config",
"--header",
"Host: jobs.cesnimda.uk",
"--header",
"X-Forwarded-For: not-an-ip, 198.51.100.10",
"--header",
"X-Forwarded-Proto: https"
],
"exit": 7,
"headers": [],
"metadata": {
"http_code": 0,
"remote_ip": "",
"remote_port": -1,
"local_ip": "",
"ssl_verify_result": 0,
"time_total": 2.042874,
"exitcode": 7
},
"stderr": "curl: (7) Failed to connect to 109.189.21.248:3000 after 2042 ms: Could not connect to server"
},
{
"name": "direct_api_109.189.21.248_5202",
"command": [
"curl.exe",
"--noproxy",
"*",
"--connect-timeout",
"4",
"--max-time",
"8",
"--silent",
"--show-error",
"--dump-header",
"-",
"--output",
"NUL",
"--write-out",
"\nB06_META %{json}\n",
"http://109.189.21.248:5202/health",
"--header",
"Host: jobs.cesnimda.uk"
],
"exit": 7,
"headers": [],
"metadata": {
"http_code": 0,
"remote_ip": "",
"remote_port": -1,
"local_ip": "",
"ssl_verify_result": 0,
"time_total": 2.043141,
"exitcode": 7
},
"stderr": "curl: (7) Failed to connect to 109.189.21.248:5202 after 2043 ms: Could not connect to server"
},
{
"name": "direct_api_109.189.21.248_8080",
"command": [
"curl.exe",
"--noproxy",
"*",
"--connect-timeout",
"4",
"--max-time",
"8",
"--silent",
"--show-error",
"--dump-header",
"-",
"--output",
"NUL",
"--write-out",
"\nB06_META %{json}\n",
"http://109.189.21.248:8080/health",
"--header",
"Host: jobs.cesnimda.uk"
],
"exit": 7,
"headers": [],
"metadata": {
"http_code": 0,
"remote_ip": "",
"remote_port": -1,
"local_ip": "",
"ssl_verify_result": 0,
"time_total": 2.040558,
"exitcode": 7
},
"stderr": "curl: (7) Failed to connect to 109.189.21.248:8080 after 2040 ms: Could not connect to server"
}
],
"vantage": "Connor Windows workstation; external independence/NAT hairpin not established",
"limitations": [
"No assertion of Traefik identity or upstream header values from public status alone",
"Connection failure does not identify which firewall/NAT/listener rejected it"
]
},
"publicFollowup": [
{
"name": "observed_http_redirect_target",
"command": [
"curl.exe",
"--noproxy",
"*",
"--connect-timeout",
"4",
"--max-time",
"8",
"--silent",
"--show-error",
"--dump-header",
"-",
"--output",
"NUL",
"--write-out",
"\nB06_META %{json}\n",
"https://jobs.cesnimda.uk:444/api/auth/config"
],
"exit": 7,
"headers": [],
"metadata": {
"http_code": 0,
"remote_ip": "",
"remote_port": -1,
"local_ip": "",
"ssl_verify_result": 0,
"time_total": 2.063806,
"exitcode": 7
},
"stderr": "curl: (7) Failed to connect to jobs.cesnimda.uk:444 after 2063 ms: Could not connect to server"
},
{
"name": "https_forged_host",
"command": [
"curl.exe",
"--noproxy",
"*",
"--connect-timeout",
"4",
"--max-time",
"8",
"--silent",
"--show-error",
"--dump-header",
"-",
"--output",
"NUL",
"--write-out",
"\nB06_META %{json}\n",
"https://jobs.cesnimda.uk/api/auth/config",
"--header",
"Host: attacker.example.test"
],
"exit": 0,
"headers": [
"HTTP/1.1 421 Misdirected Request",
"Content-Type: text/plain; charset=utf-8",
"X-Content-Type-Options: nosniff",
"Content-Length: 20"
],
"metadata": {
"http_code": 421,
"remote_ip": "109.189.21.248",
"remote_port": 443,
"local_ip": "192.168.50.2",
"ssl_verify_result": 0,
"time_total": 0.041514,
"exitcode": 0
},
"stderr": ""
},
{
"name": "https_malformed_chain",
"command": [
"curl.exe",
"--noproxy",
"*",
"--connect-timeout",
"4",
"--max-time",
"8",
"--silent",
"--show-error",
"--dump-header",
"-",
"--output",
"NUL",
"--write-out",
"\nB06_META %{json}\n",
"https://jobs.cesnimda.uk/api/auth/config",
"--header",
"X-Forwarded-For: not-an-ip, 198.51.100.10",
"--header",
"X-Forwarded-Proto: https"
],
"exit": 0,
"headers": [
"HTTP/1.1 200 OK",
"Content-Type: application/json; charset=utf-8",
"Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()",
"Referrer-Policy: same-origin",
"Strict-Transport-Security: max-age=63072000; includeSubDomains; preload",
"X-Content-Type-Options: nosniff",
"X-Frame-Options: SAMEORIGIN"
],
"metadata": {
"http_code": 200,
"remote_ip": "109.189.21.248",
"remote_port": 443,
"local_ip": "192.168.50.2",
"ssl_verify_result": 0,
"time_total": 0.037985,
"exitcode": 0
},
"stderr": ""
}
],
"dns": [
{
"Query": "A",
"Records": [
{
"Name": "jobs.cesnimda.uk",
"Type": 1,
"IPAddress": "109.189.21.248",
"NameHost": null,
"TTL": 208
}
]
},
{
"Query": "AAAA",
"Records": [
{
"Name": "cesnimda.uk",
"Type": 6,
"IPAddress": null,
"NameHost": null,
"TTL": 1708
}
]
},
{
"Query": "CNAME",
"Records": [
{
"Name": "jobs.cesnimda.uk",
"Type": 5,
"IPAddress": null,
"NameHost": "cesnimda.uk",
"TTL": 300
}
]
}
],
"authoritativeDns": [
{
"Server": "oaklyn.ns.cloudflare.com",
"Query": "A",
"Records": [
{
"Name": "jobs.cesnimda.uk",
"Type": 1,
"IPAddress": "109.189.21.248",
"NameHost": null,
"TTL": 300
}
]
},
{
"Server": "oaklyn.ns.cloudflare.com",
"Query": "AAAA",
"Records": [
{
"Name": "cesnimda.uk",
"Type": 6,
"IPAddress": null,
"NameHost": null,
"TTL": 1800
}
]
},
{
"Server": "oaklyn.ns.cloudflare.com",
"Query": "CNAME",
"Records": [
{
"Name": "jobs.cesnimda.uk",
"Type": 5,
"IPAddress": null,
"NameHost": "cesnimda.uk",
"TTL": 300
}
]
},
{
"Server": "thaddeus.ns.cloudflare.com",
"Query": "A",
"Records": [
{
"Name": "jobs.cesnimda.uk",
"Type": 1,
"IPAddress": "109.189.21.248",
"NameHost": null,
"TTL": 300
}
]
},
{
"Server": "thaddeus.ns.cloudflare.com",
"Query": "AAAA",
"Records": [
{
"Name": "cesnimda.uk",
"Type": 6,
"IPAddress": null,
"NameHost": null,
"TTL": 1800
}
]
},
{
"Server": "thaddeus.ns.cloudflare.com",
"Query": "CNAME",
"Records": [
{
"Name": "jobs.cesnimda.uk",
"Type": 5,
"IPAddress": null,
"NameHost": "cesnimda.uk",
"TTL": 300
}
]
}
],
"dockerStart": {
"command": [
"C:/Users/Connor/AppData/Local/Programs/DockerDesktop/resources/bin/docker.exe",
"desktop",
"start",
"--detach"
],
"exit": 0,
"stdout": "\u00e2\u0153\u201c Starting Docker Desktop\n",
"stderr": ""
},
"dockerEngine": {
"exit": null,
"timeoutSeconds": 10,
"command": [
"docker",
"version",
"--format",
"{{json .Server}}"
],
"utc": "2026-09-09T10:48:29.844623+00:00"
},
"dockerFailure": {
"message": "starting services: initializing Inference manager: listening on unix://C:/Users/Connor/AppData/Local/Docker/run/dockerInference: remove C:/Users/Connor/AppData/Local/Docker/run/dockerInference: The file cannot be accessed by the system. (listener: The filename, directory name, or volume label syntax is incorrect.)",
"socketObserved": {
"length": 0,
"attributes": [
"Archive",
"ReparsePoint"
],
"lastWriteDate": "2026-08-24",
"reparseQueryExit": 1,
"reparseQueryError": 1920
},
"gracefulStop": "Did not complete; waiting command interrupted. Desktop/backend processes remained. No forced process termination or socket/data changes."
},
"windowsWorkstation": {
"listeners": {
"LocalAddress": "127.0.0.1",
"LocalPort": 8080,
"OwningProcess": 17996
},
"port8080Process": "steamwebhelper; unrelated to Jobjakt",
"firewallProfiles": [
{
"Name": "Domain",
"Enabled": 1,
"DefaultInboundAction": 0,
"DefaultOutboundAction": 0
},
{
"Name": "Private",
"Enabled": 1,
"DefaultInboundAction": 0,
"DefaultOutboundAction": 0
},
{
"Name": "Public",
"Enabled": 1,
"DefaultInboundAction": 0,
"DefaultOutboundAction": 0
}
],
"productionHost": false
},
"sshDiscovery": {
"configExists": false,
"nonSecretRepoSources": "Only PROD_HOST/PROD_USER/PROD_SSH_KEY secret references found; no unambiguous alias/user",
"sshConnectionAttempted": false,
"credentialsAccessed": false
},
"runtimeTopologyStarted": false,
"observedTraefikPeer": null,
"actualBackendClientIp": null,
"applicationConfigurationChangesThisFollowup": []
}
Reference in New Issue View Git Blame Copy Permalink