# ONES Security

ONES is a support application for SONiC stack. It is designed for customer's engineering team such as SRE’s, HW and SW engineering teams for their daily network diagnosis and troubleshooting needs. In addition to that ONES exposes the API to integrate with external tools or customer homegrown applications.&#x20;

### This section describes how ONES authenticates users and secures communication.



<table><thead><tr><th width="164">Features</th><th>ONES Support</th></tr></thead><tbody><tr><td><strong>Role Based Access</strong></td><td>ONES provide RBAC support for creating dedicated user accounts. it has a <mark style="color:blue;"><strong>superadmin</strong></mark> account which can manage these user accounts for control and permissions</td></tr><tr><td><strong>Secure Access to Application</strong></td><td>ONES Application provides <strong>HTTPS over standard port 443</strong> supporting both self-signed and CA-signed certificates</td></tr><tr><td><strong>Secure Access to switches</strong></td><td>Auto-discovery communication between Agent and collector using a secure channel<strong>(SSL/TLS) with certificates</strong> (self-signed and CA-signed certificates</td></tr><tr><td><strong>API Access</strong></td><td>ONES Application provides <strong>HTTPS over standard port 443</strong> supporting both <strong>self-signed and CA-signed certificates</strong>, the API is available via time-bound authentication tokens.</td></tr></tbody></table>



<figure><img src="https://content.gitbook.com/content/LacTh6x78oAd4VRzALXL/blobs/cICryQbc48gwFyL0VYFO/Screenshot%202023-04-04%20at%2012.14.16%20PM.png" alt=""><figcaption></figcaption></figure>

### RBAC: Role-Based Access Control

* [Click to get more details on RBAC](broken-reference)

### Secure Access to the Application

ONES application provides HTTPs over standard port 443 supporting both self-signed and CA signed certificates.&#x20;

* HTTPS Support CA Signed
* HTTPS Self Signed

### Secure Access to the switch\*

ONES utilizes gRPC infrastructure to communicate with switch agents. TLS (Transport Layer Security) is the primary security protocol used by gRPC to secure communication between the client and the server. TLS provides authentication, confidentiality, and integrity of data. Authentication is achieved using digital certificates, which verify the identity of the client and the server.

With an added extra layer of security, ONESv2.0 support Certificate based communication between switches and ONES Controller, and all the metrics will be streamed using the certificate-based encryption&#x20;

###
