remove a page of 5+ year old issues

source/index.rst

@@ -81,10 +81,10 @@ These are institutions who were early adopters or provided HPC resources for dev
 
   architecture
   reference
+  security
   release-notes
   version-policy
   glossary
-  issues/overview
 
 .. _website: https://openondemand.org/
 .. _bowdoin: https://www.bowdoin.edu/it/resources/high-performance-computing.html

source/security.rst

@@ -0,0 +1,48 @@
+.. _security:
+
+Security
+=================
+
+Introduction
+------------
+
+This document provides an overview of the security framework implemented in Open OnDemand, focusing on practical security concerns administrators need to consider when installing and managing the platform.
+
+Security Concerns
+-----------------
+
+**The Good:**
+
+- **PUN Architecture**: The Per-user Nginx (PUN) architecture underpins the security model where web servers, run by individual users rather than the root, handle user requests. This ensures that all actions, including file accesses, are executed under non-root user privileges, enhancing security by isolating user processes.
+
+- **Apache Authentication**: Authentication is mandatory, with the type of scheme being adjustable per site. Open OnDemand discourages and does not document insecure basic authentication mechanisms such as Basic or LDAP to promote stronger security measures.
+
+**The Bad:**
+
+- **HTTP Traffic to Origin Servers**: Currently, traffic to origin servers (like compute nodes running applications such as Jupyter) is handled via HTTP. This presents a risk as it is not encrypted. Efforts are ongoing to shift this traffic to HTTPS to secure all data in transit.
+
+Security Features
+-----------------
+
+- **Monitoring and Logging**: Extensive monitoring and logging are in place, providing crucial tools for security auditing and incident response. For more information, see :ref:`logging`.
+
+- **Vulnerability Management**: Vulnerabilities within Open OnDemand are diligently identified, reported, and managed. For more details on this process, see :ref:`vulnerability-management`.
+
+- **Security Audits**: Open OnDemand has undergone several security audits by Trusted CI, the NSF Cybersecurity Center of Excellence. The latest audit report is available `here <https://openondemand.org/sites/default/files/documents/Trusted%20CI%20Open%20OnDemand%20Engagement%20Final%20Report%20-%20REDACTED%20FOR%20PUBLIC%20RELEASE%20210712_0.pdf>`__.
+
+Conclusion
+----------
+
+Maintaining robust security is pivotal for the operation of Open OnDemand. Ongoing efforts are dedicated to strengthening the security measures in place. Users and administrators are encouraged to adhere to the outlined best practices and security guidelines to ensure a secure operational environment.
+
+Relevant References
+-------------------
+
+.. toctree::
+   :maxdepth: 2
+   :caption: Security Topics
+
+   security/vulnerability-management
+   authentication/overview
+   how-tos/monitoring/logging
+   customizations

source/security/vulnerability-management.rst

@@ -0,0 +1,42 @@
+.. _vulnerability-management:
+
+Vulnerability Management
+========================
+
+Introduction
+------------
+
+Vulnerability management is a critical component of the security strategy for Open OnDemand. This document outlines the procedures for reporting and managing vulnerabilities.
+
+Reporting a Vulnerability
+-------------------------
+
+If you have security concerns or think you have found a vulnerability, please submit a private report by visiting the 'Security' section of our GitHub located at [GitHub Open OnDemand Security](https://github.com/OSC/ondemand/security/) and clicking 'Report a vulnerability'.
+
+For direct inquiries or issues in submitting a report, contact the core project team via email at [email protected].
+
+Disclosure Policy
+-----------------
+
+- Upon reporting, you will receive a response within hours, acknowledging the receipt of the report.
+- A primary handler from the team will be assigned to coordinate the fix and release process:
+  - Confirm the problem and determine the affected versions (1-2 days).
+  - Audit code to find any potential similar problems
+  - Prepare fixes for all releases still under maintenance and release as soon as possible 
+
+Comments on Policy
+------------------
+
+Suggestions to improve this process can be made via submitting a ticket, opening a Discourse topic, or a pull request.
+
+Security Audits
+---------------
+
+Open OnDemand has been audited several times by Trusted CI, the NSF Cybersecurity Center of Excellence. The latest engagement report is available [here](https://openondemand.org/sites/default/files/documents/Trusted%20CI%20Open%20OnDemand%20Engagement%20Final%20Report%20-%20REDACTED%20FOR%20PUBLIC%20RELEASE%20210712_0.pdf). These audits have helped shape the security landscape of the platform and contribute to its ongoing security enhancements.
+
+Conclusion
+----------
+
+Effective vulnerability management is crucial for maintaining the security and integrity of Open OnDemand. Users and contributors play a vital role in this process by reporting potential security vulnerabilities through GitHub, ensuring the platform's continued safety.
+
+.. note:: For details on the specific vulnerability management steps, please see the GitHub repository guidelines or the security policies linked above.