doc : add remote access switch documentation

Signed-off-by: Shahriyar Jalayeri <shahriyar@zededa.com>

docs/CONFIG.md

@@ -13,6 +13,7 @@ In general, EVE is trying to make sure that its controller always has the last w
 * `wpa_supplicant.conf` - a legacy way of configuring EVE's WiFi
 * `authorized_keys` - initial authorized SSH keys for accessing EVE's debug console; DO NOT use options, we only accept 'keytype, base64-encoded key, comment' format
 * `bootstrap-config.pb`- initial device configuration used only until device is onboarded (see below for details)
+* `remote_access_disabled`- a file indicating remote access status, if it exist remote access (edge-view and ssh) is disabled. Please check [config document](SECURITY.md#disabling-remote-access) for more information.
 
 The initial content of these configuration files is stored in the EVE's source tree under [config](../config) folder. From there, these configuration files are baked into the EVE installer images. For the read-write bootable disk installer image these files can further be tweaked by mounting the "EVE" partition and editing those files directly on the installer image. This gives you an ability to take the default installer image and tweak it for your needs without re-building EVE from scratch (obviously this is not an option for a read-only ISO installer image). A typical workflow is to take an installer image from the official EVE build, flash it onto a USB flash drive, insert that USB flash drive into your desktop and edit file on the partition called EVE.
 

docs/SECURITY.md

@@ -158,6 +158,10 @@ Two ECOs communicating using the overlay will get an secure channel since LISP w
 
 In addition, the LISP map server can provide ability to limit access to the mappings for certain EIDs based on the EID which is trying to look them up.
 
+## Disabling Remote Access
+
+EVE provides a mechanism to build an image with remote access disabled (edge-view and ssh), this can be done by configuring EVE when building an installer. Enabling remote access back, requires access to the cloud controller to enable debugging access on the edge node, plus physical access to the edge node to issue `eve remote-access` command on the edge node. In addition changing remote access status from its initial value to anything else will result in change of PCR-14 value and subsequent failure in unsealing the vault key that needs to be handled using the cloud controller. Check [config document](CONFIG.md#eve-configuration) for more information.
+
 ## Details on keys and certificates
 
 These details are specified in [KEYS-AND-CERTS](KEYS-AND-CERTS.md).