Secure Tessera

Tessera is the control point between engineers and production, so harden it like one.

Hardening checklist

• Set stable TESSERA_ENC_KEY and TESSERA_JWT_SECRET, and back them up — see Backups & upgrades.
• Terminate with a real TLS certificate; don’t run clients with verification disabled in production. The nginx setup is in Deploy on a VM.
• Restrict and back up PostgreSQL — it holds the encrypted credentials and the audit log.
• Protect the metrics endpoint with a token — see Monitoring & metrics.
• Pair OIDC with SCIM for instant deprovisioning.
• Enable session recording and SIEM export where compliance requires it.

For a deployment sitting between admins and production, an independent penetration test before go-live is recommended. Rely on grants, JIT, recording and audit as the primary controls; the read-only filter is a best-effort guardrail.

Credential handling

• Secrets are decrypted only in the controller’s memory, for the life of a connection.
• The console is write-only for credentials — once stored, a secret is never returned, only replaced.
• RDP passwords are handed to the remote-desktop client over an in-memory channel and are never written to disk or the Windows Credential Manager.

Network-level protections

• SSRF protection — target hosts are validated on creation and update. Loopback, link-local, and other addresses that would turn the controller into an internal network scanner are rejected.
• IP rate limiting — the login endpoint caps failed attempts per source IP using the real TCP connection address; forwarded-for headers are intentionally ignored so the limit can’t be bypassed by spoofing.

SSH and host-key protections

• TOFU host keys — on first connection to a target or bastion the host public key is stored; later connections reject key changes, preventing silent man-in-the-middle substitution.
• Read-only filter — a configurable command blocklist enforced at the SSH channel level for read-only sessions, plus write/upload blocking; the same read-only intent is enforced as query filtering on databases and verb filtering on Kubernetes. It applies live when a session is downgraded. Treat it as a guardrail, not a hard boundary (see Read-only policies).

Privilege controls

• Users cannot modify their own permissions.
• Only an administrator can promote another user to administrator.
• A user can retrieve recordings of their own sessions; administrators can access all recordings.
• Disabling a user (locally or via SCIM) blocks login and kills their sessions immediately.