Security & Audit

Authentication, authorization, encryption at rest and the tamper-evident hash-chained audit trail in Cockpit v2.

Every security-relevant action is chained: each entry seals the previous entry’s hash, so any tampering breaks the chain.

Applies to:

Cockpit v2Security

Authentication

Cockpit v2 authenticates callers through a layered identity stack built on modern, vetted cryptography.

JWT sessions

Short-lived access tokens paired with refresh tokens, so credentials stay in scope only briefly.

WebAuthn / FIDO2

Passkey authentication with full server-side signature verification.

Full MFA

TOTP with recovery codes and lockout on repeated failures.

Breached-password checks

Passwords are screened against Have I Been Pwned using k-anonymity, so the plaintext never leaves the service.

Bot protection

reCAPTCHA v3 or hCaptcha on sensitive flows, configured fail-closed.

External IdP federation

OIDC, SAML 2.0, LDAP / AD, Azure AD, Okta, Google and Keycloak.

Authorization

Access control is enforced by a single policy engine that provides both RBAC and attribute-based access control (ABAC). Permissions are hierarchical, are scoped to organizational units (OUs), and are gated by product edition.

Capability	Description
RBAC + ABAC	A single policy engine evaluates role-based and attribute-based rules together.
Hierarchical permissions	Fine-grained permissions that nest hierarchically, so a parent grant implies everything beneath it.
OU scoping	Grants are bounded to an organizational unit and its subtree.
Edition feature gating	Capabilities are enabled or withheld according to the licensed edition.

Full authorization model

The complete permission model, role hierarchy and ABAC dimensions are documented in Access Policies.

Encryption at rest

Stored secrets are protected with authenticated encryption and modern password hashing. All primitives come from well-established cryptographic libraries — there is no custom cryptography.

Concern	Mechanism
Stored credentials	AES-256-GCM, keyed from an ENCRYPTION_KEY.
Password hashing	Strong, industry-standard password hashing.
Cryptography	Vetted, industry-standard cryptographic libraries — no custom crypto.

Tamper-evident audit

The audit trail is a core differentiator of Cockpit v2. Every audit record is both signed and chained, so any later insertion, edit or deletion becomes detectable.

Two layers of integrity

Each audit record is HMAC-SHA256 signed and, in addition, linked into a SHA-256 hash chain over the activity log. Each tenant has its own chain head, which is advanced atomically so concurrent writes cannot fork or race the chain.

How it works

Property	Detail
Per-record signature	Every audit record carries an HMAC-SHA256 signature.
Hash chain	Records are linked into a SHA-256 chain over the activity log.
Chain head	A per-tenant chain head is advanced atomically.
First-class caller identity	Records carry the caller identity (email and application) directly.

Verifying the chain

A dedicated verification routine recomputes the chain and reports any break, so any insertion, edit or deletion is surfaced.

API reference

Detailed API endpoints are documented separately in the Developer Docs.

Fail-closed audit

Auditing is fail-closed. An allow decision that cannot be paired with a durable forensic audit record is refused rather than silently permitted.

Setting	Behavior
DKE_FAIL_CLOSED_AUDIT	Toggles fail-closed auditing. Enabled by default in production.

Turning fail-closed audit off

Disabling DKE_FAIL_CLOSED_AUDIT allows actions to proceed even when their forensic audit record cannot be written, which weakens the tamper-evidence guarantees above. Keep it enabled in production.

See Also

• Access Policies