From a0c88e5183838ebad04d5aad4acb3e05e1c1c153 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Thu, 22 Oct 2026 16:58:45 +0200 Subject: [PATCH] =?UTF-8?q?R-982=20(D4):=20root=20SSH=20from=20the=20LAN?= =?UTF-8?q?=20by=20key=20only=20=E2=80=94=20a=20bundle=20drop-in,=20checke?= =?UTF-8?q?d=20and=20reloaded=20by=20felhom-os-apply;=20R-1204:=20the=20he?= =?UTF-8?q?artbeat=20reports=20a=20future-stamped=20tunnel=20handshake;=20?= =?UTF-8?q?unreleased?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 17 +++++++++++ configs/felhom-os-apply | 23 +++++++++++++-- configs/felhom-root-ssh-key-only.conf | 7 +++++ configs/test_felhom_config_bundle.py | 42 +++++++++++++++++++++++++++ internal/hub/report.go | 6 +++- internal/wgtunnel/manager.go | 25 ++++++++++++++++ internal/wgtunnel/manager_test.go | 28 ++++++++++++++++++ 7 files changed, 144 insertions(+), 4 deletions(-) create mode 100644 configs/felhom-root-ssh-key-only.conf diff --git a/CHANGELOG.md b/CHANGELOG.md index 7ea115a..1ec6d7e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,20 @@ +## Unreleased (2026-10-22 night) — root SSH from the LAN by key only (R-982, operator ruling D4); the tunnel's future-stamped handshake is reported (R-1204) — COMMITTED, NOT RELEASED (no agent release tonight) + +- **R-982 / D4 — the host's own sshd: root by key only.** New bundle file `/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf` + (`PermitRootLogin prohibit-password`; source `configs/felhom-root-ssh-key-only.conf`, policy `replace`). Debian's + `sshd_config` reads that folder before its own `PermitRootLogin yes`, and the first value wins (read on demo-hp). + The root password still works on the console; the operator's door (felhom-sshd, port 8822) reads only + `/etc/felhom-sshd/sshd_config`, which includes nothing from there. `felhom-os-apply`: a new content check `sshd` + (`sshd -t -f` on the snippet, and the snippet must set exactly `PermitRootLogin prohibit-password` — `yes` undoes the + ruling, `no` would shut the root KEY out too), and after an install that wrote it: `sshd -t` (the whole config; a + failure is a refusal and the bundle undo puts the old files back), then `systemctl reload ssh` (open sessions stay). + A new box gets it from the installer's `--install-bundle` (the same bundle). Tests `RootKeyOnly` (3) in + `configs/test_felhom_config_bundle.py`, red-proved both ways. +- **R-1204 — `wireguard.handshake_future_s`.** A box that ran once with its clock ahead keeps a handshake stamped in the + future; ep0 refuses every newer one, and `last_handshake_age_s` (clamped at 0) read „just now" for ever. The heartbeat + now carries how many seconds the handshake lies ahead (> 60 s only); the age keeps its clamp. The hub alarms on it + (felhom.eu hub `wg_tunnel_stale`). Test `TestR1204_AFutureHandshakeIsReported`, red-proved. + ## v0.162.0 — every guest may swap as much as its RAM (R-1192, the 8 GB freeze); the host's swap is reported and checked; no false „operator access degraded" on a fresh box (R-1194) (2026-10-22) — RELEASED on the operator's yes; the vouch is the operator's Released 2026-10-22 07:40 UTC (operator yes, the morning answers) with `scripts/release-agent.sh` from a clean clone at diff --git a/configs/felhom-os-apply b/configs/felhom-os-apply index 81565fb..3b6fc9a 100755 --- a/configs/felhom-os-apply +++ b/configs/felhom-os-apply @@ -165,7 +165,8 @@ KERNEL_ACTIVE = ("staged", "oneshot", "judging", "reverting") # dest: (source file under configs/, mode, check, policy) # check: the content check BEFORE anything is written (R18): sudoers → visudo -cf; sh / bash → -n; python → compile; # unit → a [Unit]/[Service]/[Timer] section; unit-nort → that, and never RuntimeDirectory= (the G1 incident); -# agent-unit → User=felhom-agent; dropin → a [Unit] section (SF-3); nft → nft -c -f; plain → none. +# agent-unit → User=felhom-agent; dropin → a [Unit] section (SF-3); nft → nft -c -f; plain → none; +# sshd → `sshd -t -f` on the snippet alone (R-982). # policy: replace → always written when it differs; if-absent → only when the box has none (a setting the operator may # have tuned); oob → only on a box with the OOB belt (/etc/felhom-sshd exists — the installer's --no-oob leaves none). # Order matters: the sudoers files come LAST, so a referenced wrapper is in place before the line that allows it. @@ -221,6 +222,9 @@ BUNDLE_FILES = [ ("/etc/systemd/system/felhom-sshd.service", "felhom-sshd.service", 0o644, "unit-nort", "oob"), ("/etc/felhom-oob.nft", "felhom-oob.nft", 0o644, "nft", "oob"), ("/etc/systemd/system/felhom-oob-nft.service", "felhom-oob-nft.service", 0o644, "unit", "oob"), + # R-982, operator ruling D4 (2026-10-22): the host's own sshd (port 22, the LAN): root by key only. The console + # password stays; felhom-sshd (the operator's door) reads nothing from sshd_config.d. Reloaded in after_install. + ("/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf", "felhom-root-ssh-key-only.conf", 0o644, "sshd", "replace"), ("/etc/sudoers.d/felhom-op", "felhom-op.sudoers", 0o440, "sudoers", "oob"), ("/etc/sudoers.d/felhom-agent", "felhom-agent.sudoers", 0o440, "sudoers", "replace"), ] @@ -434,7 +438,8 @@ class Runner: def check_content(self, kind, data): """Run an external syntax check on a root-only temp copy. Returns (rc, message).""" import tempfile - cmd = {"sudoers": ["visudo", "-cf"], "sh": ["sh", "-n"], "bash": ["bash", "-n"], "nft": ["nft", "-c", "-f"]}[kind] + cmd = {"sudoers": ["visudo", "-cf"], "sh": ["sh", "-n"], "bash": ["bash", "-n"], "nft": ["nft", "-c", "-f"], + "sshd": ["/usr/sbin/sshd", "-t", "-f"]}[kind] with tempfile.TemporaryDirectory(prefix="felhom-bundle-") as d: p = os.path.join(d, "f") with open(p, "wb") as f: @@ -1932,10 +1937,16 @@ class Bundle: text = content.decode("utf-8") except UnicodeDecodeError: raise Refused("R18", f"{dest} is not UTF-8 text") - if check in ("sudoers", "sh", "bash", "nft"): + if check in ("sudoers", "sh", "bash", "nft", "sshd"): rc, msg = self.r.check_content(check, content) if rc != 0: raise Refused("R18", f"{dest} fails its {check} check: {msg}") + if check == "sshd": + # R-982: the drop-in may only ever make root KEY-ONLY. `no` would also shut the root key out (Proxmox's own + # node-to-node SSH and the LAN key route), `yes` would undo the ruling — both refused. + vals = re.findall(r"^\s*PermitRootLogin\s+(\S+)\s*$", text, re.M | re.I) + if vals != ["prohibit-password"]: + raise Refused("R18", f"{dest} must set exactly `PermitRootLogin prohibit-password` (found {vals})") elif check == "python": try: compile(text, dest, "exec") @@ -2073,6 +2084,12 @@ class Bundle: "enable the crash guard") if "/etc/systemd/system/felhom-mgmt-watchdog.timer" in dests: self.must(["systemctl", "enable", "--now", "felhom-mgmt-watchdog.timer"], "enable the mgmt watchdog timer") + # R-982: the host's sshd takes the root-key-only drop-in. The WHOLE config is tested first (a failure is a + # refusal, and the bundle undo puts the old files back); `reload` keeps every open session, including the + # operator's. felhom-sshd is not touched. + if "/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf" in written: + self.must(["/usr/sbin/sshd", "-t"], "sshd -t (the host's whole sshd config)") + self.must(["systemctl", "reload", "ssh"], "systemctl reload ssh") def must(self, argv, what): rc, out, err = self.r.host(argv, 120) diff --git a/configs/felhom-root-ssh-key-only.conf b/configs/felhom-root-ssh-key-only.conf new file mode 100644 index 0000000..f2ff547 --- /dev/null +++ b/configs/felhom-root-ssh-key-only.conf @@ -0,0 +1,7 @@ +# MANAGED BY FELHOM (the agent's config bundle) — R-982, operator ruling D4 (2026-10-22). +# The Proxmox host's OWN sshd — the listener the household network reaches on port 22: root logs in with a KEY only. +# The root password still works on the console (the break-glass password, `03` §8a). The operator's door +# (felhom-sshd, port 8822, /etc/felhom-sshd/sshd_config) is a separate daemon whose config includes nothing from +# here, so it is not changed. Debian's sshd_config reads this folder BEFORE its own `PermitRootLogin yes`, and for +# sshd the first value wins. +PermitRootLogin prohibit-password diff --git a/configs/test_felhom_config_bundle.py b/configs/test_felhom_config_bundle.py index 1c5a6ab..74f983d 100644 --- a/configs/test_felhom_config_bundle.py +++ b/configs/test_felhom_config_bundle.py @@ -429,6 +429,48 @@ class SelfCheckUndo(unittest.TestCase): self.assert_restored(box, before, rep) + +class RootKeyOnly(unittest.TestCase): + """R-982, operator ruling D4 (2026-10-22): the bundle gives the host's own sshd a root-key-only drop-in, tests the + whole config and reloads sshd — only when the file was written; a drop-in that says anything but + `prohibit-password` is refused before anything is written. + RED-PROOF: with the after_install block removed, test_fresh_box_takes_the_dropin_and_reloads fails (no reload); + with the content rule removed, test_a_dropin_that_says_yes_or_no_is_refused fails — seen failing 2026-10-22.""" + DEST = "/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf" + + def test_fresh_box_takes_the_dropin_and_reloads(self): + data, sha = real_bundle() + box = Box(data, signed_job(sha)) + rc, rep = run(box) + self.assertEqual(rc, 0, rep) + self.assertIn(b"PermitRootLogin prohibit-password", box.files[self.DEST]) + self.assertEqual(box.modes[self.DEST], 0o644) + self.assertIn(["/usr/sbin/sshd", "-t"], box.calls) + self.assertIn(["systemctl", "reload", "ssh"], box.calls) + self.assertLess(box.calls.index(["/usr/sbin/sshd", "-t"]), box.calls.index(["systemctl", "reload", "ssh"])) + self.assertFalse(any("felhom-sshd" in " ".join(c) for c in box.calls), "the operator's door must not be touched") + + def test_an_unchanged_dropin_is_not_reloaded(self): + data, sha = real_bundle() + box = Box(data, signed_job(sha)) + box.put(self.DEST, (REPO / "configs" / "felhom-root-ssh-key-only.conf").read_bytes(), 0o644) + rc, rep = run(box) + self.assertEqual(rc, 0, rep) + self.assertNotIn(["systemctl", "reload", "ssh"], box.calls) + + def test_a_dropin_that_says_yes_or_no_is_refused(self): + for bad in (b"PermitRootLogin yes\n", b"PermitRootLogin no\n", b"# nothing\n", + b"PermitRootLogin prohibit-password\nPermitRootLogin yes\n"): + def edit(files, bad=bad): + for e in files: + if e["path"] == self.DEST: + e["content_b64"] = base64.b64encode(bad).decode() + data, sha = edited_bundle(edit) + box = Box(data, signed_job(sha)) + rc, rep = run(box) + self.assertNotEqual(rc, 0, bad) + self.assertNotIn(self.DEST, box.files, bad) + class TrustBootstrap(unittest.TestCase): def test_missing_signers_verifies_against_the_pinned_key_and_creates_it(self): data, sha = real_bundle() diff --git a/internal/hub/report.go b/internal/hub/report.go index 8e6f261..60f36c8 100644 --- a/internal/hub/report.go +++ b/internal/hub/report.go @@ -292,7 +292,11 @@ type WireguardStatus struct { Registered bool `json:"registered"` // the registration marker exists Active bool `json:"active"` // wg-quick@wg-felhom is-active LastHandshakeAgeS *int64 `json:"last_handshake_age_s,omitempty"` - AssignedIP string `json:"assigned_ip,omitempty"` // from the marker, e.g. "10.77.0.2/32" + // HandshakeFutureS (R-1204): seconds the latest handshake lies in the FUTURE by this box's clock — set (> 0) only + // then. A box that ran once with its clock ahead keeps a handshake stamped in the future; WireGuard on ep0 then + // refuses every newer handshake, and LastHandshakeAgeS (clamped at 0) reads „just now" for ever. The hub alarms on it. + HandshakeFutureS *int64 `json:"handshake_future_s,omitempty"` + AssignedIP string `json:"assigned_ip,omitempty"` // from the marker, e.g. "10.77.0.2/32" } // SystemInfo is the `system` stanza (see HostReport.System). diff --git a/internal/wgtunnel/manager.go b/internal/wgtunnel/manager.go index 0a2b17c..03b8afe 100644 --- a/internal/wgtunnel/manager.go +++ b/internal/wgtunnel/manager.go @@ -661,6 +661,9 @@ func (m *Manager) Status(ctx context.Context) *hub.WireguardStatus { if age, ok := parseHandshakeAge(string(out), m.now()); ok { st.LastHandshakeAgeS = &age } + if fut, ok := handshakeFuture(string(out), m.now()); ok { + st.HandshakeFutureS = &fut + } } } if st.Pubkey == "" && !st.Registered && !st.Active { @@ -669,6 +672,28 @@ func (m *Manager) Status(ctx context.Context) *hub.WireguardStatus { return st } +// handshakeFuture (R-1204) reports how many seconds the latest handshake lies in the future, ok only when it does +// (by more than a minute — clock jitter is not the case). parseHandshakeAge clamps that case to 0 („just now"), which +// is what made a box whose clock had run ahead look healthy while ep0 refused its tunnel. Pinned by +// TestR1204_AFutureHandshakeIsReported. +func handshakeFuture(out string, now time.Time) (int64, bool) { + for _, line := range strings.Split(strings.TrimSpace(out), "\n") { + f := strings.Fields(line) + if len(f) != 2 { + continue + } + epoch, err := strconv.ParseInt(f[1], 10, 64) + if err != nil || epoch <= 0 { + continue + } + if fut := epoch - now.Unix(); fut > 60 { + return fut, true + } + return 0, false + } + return 0, false +} + // parseHandshakeAge parses `wg show latest-handshakes` output ("\t"). // epoch 0 = no handshake yet → not ok (nil in the report; nil ≠ 0). func parseHandshakeAge(out string, now time.Time) (int64, bool) { diff --git a/internal/wgtunnel/manager_test.go b/internal/wgtunnel/manager_test.go index de0232d..17a72df 100644 --- a/internal/wgtunnel/manager_test.go +++ b/internal/wgtunnel/manager_test.go @@ -696,3 +696,31 @@ func TestInitialResolveFailureNoTeardown(t *testing.T) { t.Errorf("did not recover after DNS returned: %v", rr.calls) } } + +// R-1204: a box that ran once with its clock ahead keeps a handshake stamped in the FUTURE — ep0 then refuses every +// newer one. The age stays clamped at 0 (unchanged contract), and the new field says how far ahead it lies; a +// handshake in the past (or within a minute of now) never sets it. +// RED-PROOF: with Status not setting HandshakeFutureS the first assertion fails — seen failing 2026-10-22. +func TestR1204_AFutureHandshakeIsReported(t *testing.T) { + fh := &fakeHub{} + m, _, active, _ := testManager(t, fh) + ctx := context.Background() + m.Apply(ctx, false, nil) + *active = true + m.now = func() time.Time { return time.Unix(1783107115-2*24*3600, 0) } // the clock came back two days earlier + st := m.Status(ctx) + if st.HandshakeFutureS == nil || *st.HandshakeFutureS != 2*24*3600 { + t.Fatalf("handshake_future_s = %v, want %d", st.HandshakeFutureS, 2*24*3600) + } + if st.LastHandshakeAgeS == nil || *st.LastHandshakeAgeS != 0 { + t.Fatalf("the age stays clamped at 0: %v", st.LastHandshakeAgeS) + } + m.now = func() time.Time { return time.Unix(1783107115+100, 0) } + if st = m.Status(ctx); st.HandshakeFutureS != nil { + t.Fatalf("a past handshake must not set handshake_future_s: %v", *st.HandshakeFutureS) + } + m.now = func() time.Time { return time.Unix(1783107115-30, 0) } // 30 s of jitter is not the case + if st = m.Status(ctx); st.HandshakeFutureS != nil { + t.Fatalf("clock jitter must not set handshake_future_s") + } +}