From b45c47be6c784007e535503011809f997207d0d4 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Fri, 23 Oct 2026 00:06:13 +0200 Subject: [PATCH] REPORT: night 2026-10-22/23 (D30 live, hardened; D4 patches v2) --- REPORT.md | 38 +++++++++++++++++++++----------------- 1 file changed, 21 insertions(+), 17 deletions(-) diff --git a/REPORT.md b/REPORT.md index d0bbade..afca443 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,19 +1,23 @@ -# REPORT — night 2026-10-22: one change on `main`, one ready patch, nothing released +# REPORT — night 2026-10-22 → 23: D30 on `main`, the D4 patches v2, nothing released -**What:** the night brief's agent parts. No agent release, no vouch (both forbidden tonight). Design read: -`03-host-agent.md` (the WireGuard tunnel, the config bundle), `06-offsite-connectivity.md`. +**What:** the night brief's agent parts. No release, no vouch. Design read: `03-host-agent.md` (the tunnel, the key, the +bundle), `06-offsite-connectivity.md` (the full-list push to ep0). -- **R-1204, `a0c88e5` (on `main`, unreleased).** The heartbeat's `wireguard` block gains `handshake_future_s` when the - last handshake lies more than 60 s in the future (`wgtunnel.handshakeFuture`) — the clock-ahead lock-out that the - clamped `last_handshake_age_s` hid. Red-proved (`TestR1204_AFutureHandshakeIsReported`). The hub's alarm on it is - hub 0.166.0 (felhom.eu, built, not deployed). -- **R-982 / D4 (operator 15:47: root SSH from the LAN by key only) — a ready patch, NOT on main (`7651461` moved it - out).** A bundle drop-in `/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf` (`PermitRootLogin prohibit-password`), - checked and reloaded by `felhom-os-apply`; proven on a fresh install from ISO 1.30.0 (nested VM 9343, destroyed): - password SSH refused, key works, the console and the PVE web login keep the password. Patches: - felhom.eu `audits/night-2026-10-22/P2-D4/felhom-agent-bundle-D4.patch` + `felhom.eu-installer-D4.patch`. They ship - with the next agent release (the operator's vouch) and the next installer tag. -- **Correction:** the CHANGELOG first said a push of the installer would publish it. Wrong: `/scripts/` is served from - the tag `installer-v1.35.0` (R-110). The decision to keep D4 as a patch stands on the other two reasons. -- **Gates:** `agent_gates.py --fast` green before each push. CI by commit: felhom.eu `REPORT-night-2026-10-22.md`. -- **Teardown:** VM 9343 destroyed on demo-hp (own id); its hub appliance (id 49) waits for the operator's Discard. +- **D30** (`ae69ad4`, hardened `39fb9cb`, `b9b831f`): a handshake stamped in the future for 15 min → a new key pair, + registered on `POST /hosts//wg` (the hub re-keys in place; its full-list push swaps the key on ep0 — nothing new + on ep0). The key file is replaced by an fsynced rename over it (never missing or empty); the first old key stays + `private.key.prev`, later ones dated (3 kept); the once-an-hour bound survives a restart; a wait stamp dated after now + is dropped. Tests `TestD30_*` (7), each red-proved. +- **Live** (felhom.eu `audits/night-2026-10-23/P2-D30/`, test box Tester4-16fdef, fixture `ae69ad4`): with ep0 free to + start a handshake, a 2-hour clock jump healed by itself and no re-key ran (correct); with ep0's starts dropped on the + box, the tunnel stayed dead, the agent re-keyed at 15 min, the hub took the key (`existed=false generation=3 + sync=ok`), the box switched at its next desired-state fetch and shook hands with the new key. +- **D4 patches v2** (felhom.eu `audits/night-2026-10-23/P3-review/`), after a fresh review (A1–A7): `try-reload-or-restart`, + an `sshd -T` read-back reported as `sshd_dropin_not_in_force`, a reload in undo, the right citation; installer: a warning + when the reload fails. RootKeyOnly 6/6 (two new, red-proved); installer tests 40/40 with the patch. Both apply to + tonight's mains. Live by hand on the test box: root password SSH refused, key works, web password 200. +- **Gap filed:** a reboot after the clock was corrected forgets the future stamp (felhom.eu R-1223). + +CI by commit: `ae69ad4` 2229, `39fb9cb` 2235 green; `b9b831f` and this docs commit: see felhom.eu +`REPORT-night-2026-10-23.md`. Fixture names on the test box: `0.163.0-night.1` (= `ae69ad4`), then `0.162.99` +(= `b9b831f`; a plain number, because the controller cannot compare a pre-release string — the off-site unlock refused).