Compliance Profiles

Choose how operators sign in to the guardian and which jurisdiction's security settings it enforces, before you run setup for the first time.

Sign-in Modes

The identity service controls who can operate the guardian. GUARDIAN_MODE selects one of two modes:

Mode	Who holds the accounts
`standalone`, the default	The identity service. Every account needs a one-time code, and you manage accounts on the console's Accounts page. Use this mode if you have no identity provider, or on an air-gapped site.
`brokered`	Your organisation's identity provider. The guardian never holds a password, and a change in your identity provider applies at the next sign-in. Your groups map to the guardian's roles, and the guardian decides what each role can do.

The guardian has four roles: admin, manager, auditor and user. Each role includes the roles below it, so give each person one role, or one group in brokered mode. See Sign-In, Roles and Accounts for what each role can do.

To set up brokered sign-in:

0 of 3 done

Add these settings alongside GUARDIAN_MODE=brokered:

The brokered block

AGENCY_IDP_DISPLAY_NAME=Agency Single Sign-On
AGENCY_IDP_CLIENT_ID=...
AGENCY_IDP_CLIENT_SECRET=...
AGENCY_IDP_AUTH_URL=https://idp.agency.gov/oauth2/authorize
AGENCY_IDP_TOKEN_URL=https://idp.agency.gov/oauth2/token
AGENCY_IDP_JWKS_URL=https://idp.agency.gov/oauth2/keys
AGENCY_IDP_ISSUER=https://idp.agency.gov
AGENCY_GROUP_ADMIN=GUARDIAN-ADMINS
AGENCY_GROUP_MANAGER=GUARDIAN-MANAGERS
AGENCY_GROUP_USER=GUARDIAN-USERS
AGENCY_GROUP_AUDITOR=GUARDIAN-AUDITORS

Setup refuses to run in brokered mode if any value is missing.

Comparing the Profiles

GUARDIAN_PROFILE sets the values that differ between jurisdictions: us-dod (the default), au-ism or uk-mod. The architecture, images and controls are the same in all three.

Setting	US DoD	Australian ISM	UK MOD	Control
Session idle timeout	15 minutes	30 minutes	30 minutes	AC-11
Session maximum	11 hours	12 hours	12 hours	AC-12
Password minimum length	15	14	14	IA-5
Password history	5	8	8	IA-5
Password maximum age	60 days	365 days	None	IA-5
Lockout threshold	3 attempts	5 attempts	5 attempts	AC-7
Audit retention, hot	90 days	90 days	90 days	AU-11
System-use notice	U.S. Government Information System	Australian Government Information System	Official UK Government System	AC-8

The UK profile sets no maximum password age, because NCSC guidance advises against forced periodic expiry. If your assessor requires a maximum age, change the profile's value.
The Australian profile favours long passwords over frequent change, with a long maximum age and a deeper history.
Keep audit records in your SIEM for longer than the profile's retention period.

System-Use Notice

Before anyone signs in, the sign-in page shows the profile's system-use notice. The sign-in form appears only after the person confirms that they have read the notice and accept its conditions.

The notice comes before both the console and the identity service's administration pages. In brokered mode, it also comes before your identity provider's sign-in. A session that is already open does not see it again.

Fig. 01 — The notice, by profile01 / 03

The us-dod profile, the default.

GuardianSign in to the accountU.S. Government Information SystemYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS you consent to the following conditions: the USG routinely intercepts and monitors communications on this IS; at any time, the USG may inspect and seize data stored on this IS; communications using, or data stored on, this IS are not private and are subject to routine monitoring, interception, and search.I have read this notice and consent to its conditions

The au-ism profile.

GuardianSign in to the accountAustralian Government Information SystemThis system is for the use of authorised users only. Use of this system constitutes consent to monitoring, interception, recording, reading, copying and disclosure by and to authorised personnel. Unauthorised access or use may result in disciplinary action or criminal prosecution.I have read this notice and consent to its conditions

The uk-mod profile.

GuardianSign in to the accountOfficial UK Government SystemThis is a UK Government computer system. Access is restricted to authorised users. Activity on this system is monitored and recorded. Unauthorised access is an offence under the Computer Misuse Act 1990.I have read this notice and consent to its conditions

To change the wording of the notice:

0 of 2 done

01
GUARDIAN_LOGIN_BANNER_ENABLED=true GUARDIAN_LOGIN_BANNER_TITLE=... GUARDIAN_LOGIN_BANNER_TEXT=...
Add these three settings to secrets/.env to replace the profile's notice. Setup refuses a notice that is turned on but has no title or no text.

Shared Controls

Some controls are the same in every profile. These controls cover actions on running machines:

Control	How the guardian meets it
AC-3	With console control on, only the guardian's admin nodes hold a power that acts on machines. With it off, only an operator's control credential does. No machine ever holds such a power.
AU-2, AU-12	Each realm's Control activity records every block, unblock, compartment move, networks change and control credential issued. Each record names the person and the outcome, and refusals are recorded too.
SC-28	Every response from the API server and the console carries Cache-Control: no-store. No browser or intermediate cache keeps a manifest or a control credential.

Changing the Mode or Profile

The identity service imports its realm, its own set of accounts and policies, only once, into an empty store. To change the mode or profile after the first run:

0 of 3 done

Edit GUARDIAN_MODE or GUARDIAN_PROFILE in secrets/.env.

Sign-in Modes

Get eleven values from your identity provider+

Register the redirect address+

Assign each person a group+

Comparing the Profiles

System-Use Notice

Set the notice settings+

Run setup+

Shared Controls

Changing the Mode or Profile

Change the setting+

Run setup+

Re-import the realm+