Security FAQ

A Nexus Telemetry Fleet server opens no connection to a site, keeps each organisation in its own database, and holds no key it does not need. The answers below cover ports, isolation, keys, what a compromise exposes, air-gapped use, signed updates, logging and export.

# Does the fleet server ever connect to my sites?

No. Every connection is opened by the collector at the site, outbound to the fleet server, and commands to the collector go back over that same connection. Nothing connects into a site, so a collector works behind network address translation and a strict firewall, with no port forwarding and no inbound rule.

# What ports open where?

# How are tenants isolated?

Every organisation has its own database file and its own certificate authority. A collector’s organisation is read from the certificate it presents, never from anything it sends. Every request opens the organisation’s own database before it reads anything, so no query can return another organisation’s data. Organisations form a tree, a reseller above its customers, and a user sees their own organisation and the ones beneath it only. A request for any other organisation gets a not found response. See Organisations.

# Who holds the keys?

On a self-hosted fleet server, you do. The root key, the key at the top of the organisation’s certificate chain, is created in the fleet server’s data directory. The recommended practice is to back it up, encrypted with a passphrase the fleet server never stores, and then remove it from the fleet server. See Root key. On a managed fleet server, the provider keeps the root key, encrypted with a key that only the provider holds. Whoever has the data directory has everything in it.

# What does a compromise of the fleet server expose?

The readings the fleet server stores, the user accounts, and whatever keys are in the data directory at that moment. With the root key removed from the fleet server, the CA certificates it has already signed keep the fleet running, and what was taken cannot be used to create a new certificate authority. Nothing on the fleet server gives a route into a site, because the fleet server has no connection into a site and cannot open one.

# What does a compromise of a collector expose?

One site’s readings and that collector’s own certificate. The certificate identifies that collector only, cannot be used to read another site’s data, and stops working across the fleet when a user revokes it. No traffic from the site’s users passes through the collector. The enrolment token’s secret is spent at enrolment and never stored. Only the token’s public id is recorded.

# Can I run it air-gapped?

Yes, once the fleet server and its collectors are enrolled. The licence key is verified on the fleet server. The fleet server also checks the key online once a day, and a check that cannot connect changes nothing. That check, and the check for a newer version, can both be switched off. Installing new packages requires a route out, and so does the dashboard’s map. Point NF_TILES_URL at your own copy of the map data to serve the map with no route out. The map’s place search calls OpenStreetMap when a user types in it.

# How are updates signed?

Every release publishes a checksum file with a detached signature, and the publishing step refuses to run unless the signature verifies. The apt repository is signed. The rpm packages are signed individually, and so is the repository index. The macOS package is signed and notarised. The Windows installer is signed with Authenticode. The 2 container images, the collector and the fleet server, are signed with cosign against a public key at https://nexustelemetry.com/cosign.pub. See Docker for the verify command.

# What is logged, and where?

Users’ actions are recorded in the organisation’s Audit trail, and certificate events in the Certificate Audit Log. The fleet server and each collector write a log on the host they run on, and those logs are never sent anywhere. A test in the product’s build fails if a coordinate pair, a token secret, a licence key, a credential or a private key appears in any log.

# How do I export my data, or leave?

nf-server backup writes one backup, verified as it is written, containing the registry, the keys, the certificate authority and every organisation’s database. That backup is the export. See Backup and restore. To delete one terminal’s data, decommission or revoke its collector on the dashboard and then remove the record. See Data sent.