Security and access

When you install Stout on a box, Stout secures the box in two layers. The access guard controls who can use the box. The SSH lockdown controls who can log in to the box over SSH. Both layers turn on by themselves after the install. Nobody in the organization can turn them off from the dashboard. To remove both layers, uninstall Stout.

​

The access guard

The stout container takes over the Lager ports on the box. It lets a request through only when a signed-in Stout user with access to the box sends it. Owners and admins have access to every box in the organization. A member has access only to the boxes that an owner or admin assigned to them. The first time a person runs a Lager CLI command against a secured box, Lager asks them to sign in with lager login. They sign in with the email and password of their Stout account. See Signing In in the Lager docs.

​

The SSH lockdown

The SSH lockdown makes these changes on the box:

• It turns off password logins and root logins.
• It lets only the box account log in over SSH.
• It removes every SSH key that Stout did not install.

After the lockdown, people log in as the box account with their own SSH key. Stout copies the keys of everyone with access to the box. See Give people access to a box. Before Stout keeps the lockdown, it checks that it can still connect to the box. If that check fails, the box undoes the lockdown by itself within three minutes.

​

Security states

A box is secure when only people with access can use it, and only the keys that Stout manages can log in. The health badge on the box page shows Online only when the box is secure. See Health badge. The Access tab shows a Security card when the box is not secure. The card shows one of these states: The card also has two lines: Who can use this box and Who can log in over SSH. Each line shows the state of its layer and the fix for a blocked layer. On the Boxes page, an amber shield in the Health column means that a box needs attention. These are the usual fixes:

• If the box has no IP address, add one with Edit in the menu of the box.
• If Stout is not healthy on the box, install Stout again.
• If the box account has no passwordless sudo, fix sudo for that account. The lockdown then continues by itself.

Stout retries a failed layer by itself, but it waits 2 hours after a failure. If you fixed the problem, select Retry in the Security card to try at once. When you retry the SSH lockdown, Stout asks you to confirm with Lock down SSH.

​

Give people access to a box

A member can use a box only after an owner or admin assigns the box to them. Owners and admins always have access. Box groups do not give access. One assignment covers every way into the box: the dashboard, the Lager CLI, and SSH. Only owners and admins can assign boxes. To give people access:

1. Open the box, and then select the Access tab.
2. In Box Access, select Grant Access.
3. Find each person with the search field.
4. Select the check box of each person.
5. Select Grant access.

You can also select View Access in the menu of a box. It opens the same list. To assign boxes from the member list, use Manage access… in Settings > Team Permissions. See Members and invitations. The list shows each person with access. A Direct badge means an assignment. A badge with a role name means that the role gives access. Owners and admins keep their access, so only a direct assignment has an X to revoke it. To revoke an assignment, point at the row, select the X, and then select Revoke. A No SSH key badge means that the person has no SSH key in Stout. That person can use the dashboard and the Lager CLI, but cannot log in over SSH. To add a key, see Account. When you grant or revoke access, Stout updates the SSH keys on the box at once. The box applies the change within a minute. When you grant access, Stout also sends a notification to the person. If nobody has an assignment, the tab says that only org admins can use the box.

​

Access attempts

Select View access attempts to see the recent attempts that the box turned away. The list shows up to 20 attempts. For a person who is a member of the organization, select Grant to give them access.

​

Uninstall Stout

Uninstalling Stout returns the box to an ordinary Lager setup. Only owners and admins can uninstall Stout.

1. Open the box, and then select the Settings tab.
2. In Stout Daemon, select Uninstall Stout.
3. Select Uninstall.

The Uninstall Stout button appears only when the Stout container on the box is healthy. The uninstall makes these changes on the box:

• It turns off the access guard, so Lager uses its own ports again.
• It removes the SSH lockdown, if the box has one.
• It stops and removes the stout container, and it deletes the connection settings.
• It puts back the secrets file that the box had before Stout. If there was no such file, it deletes the Stout secrets file.
• It removes the SSH keys of the people with access. It keeps the Stout SSH key, so you can install Stout again later.

After the uninstall, the box stops reporting to Stout.