Files

T

admin 9a34887acc harden offsite apply-bridge: pin verified host key on the install/verify sessions (no TOFU)

The SSHCopyIDInstaller used StrictHostKeyChecking=accept-new on the ssh-copy-id
and sftp-verify connections, so even though the bridge verifies the box host-key
fingerprint against the hub descriptor BEFORE installing, the actual install
connection was not pinned to that verified key — a MITM could substitute a
different key in the gap between the scan and the install (TOCTOU).

Now the bridge threads the scanner-verified known_hosts line into KeyInstaller,
which writes it to a temp known_hosts and connects with StrictHostKeyChecking=yes
+ UserKnownHostsFile — the install/verify sessions refuse any key but the one the
bridge already matched. Empty known_hosts now refuses to install.

Test asserts the installer receives the pinned known_hosts; red-proofed by passing
an empty line (the pre-fix TOFU shape) → test fails. Addresses the security-review
"host-key TOFU after verify" finding on internal/offsiteapply/seams.go.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

2026-07-09 19:24:17 +02:00

4.5 KiB

Raw Blame History

REPORT — controller v0.106.0: offsite provisioning SLICE 2 (apply-bridge)

Date: 2026-07-09 · Class: implementation (controller) + risky. Baseline: main @ fa9362f (v0.105.0) → v0.106.0. Pairs with hub v0.38.0 (adds HostFingerprint to the offsite descriptor).

What shipped

On startup the controller reconciles the hub-served offsite: descriptor into a working key-only offbox target — the controller half of hub-driven offsite provisioning.

internal/config.OffsiteConfig — the offsite: section (mirrors the hub descriptor incl. host_fingerprint).
internal/offsiteapply.Bridge.Reconcile — verify-pin (no blind TOFU) → generate keypair → consume the one-time password (single-use, never logged) → install pubkey (sshpass -e ssh-copy-id -p 23 -s -f, pinning the scanner-verified known_hosts via StrictHostKeyChecking=yes — the install/verify sessions refuse any key but the one the bridge already matched, closing the scan→install MITM gap)
- verify → configure offbox → EscrowState="pending" → persist the descriptor-hash marker LAST. Idempotent (marker prevents re-consuming a spent password) and fail-safe (any step fails → nothing persisted, retried next cycle; consumed-but-failed install logs a loud "password is spent — reset on the hub").
internal/backup.Manager.ApplyOffsiteTarget — reuses the fork-4 enable primitives (best-effort escrow stage).
cmd/controller — wires the real seams + runs Reconcile async at startup. Dockerfile + sshpass.

Files changed

internal/config/config.go, internal/offsiteapply/{offsiteapply.go,seams.go,offsiteapply_test.go} (new), internal/backup/offbox.go, cmd/controller/main.go, Dockerfile, CHANGELOG.md.

Tests + companion red-proofs

Green gate go build ./... && go vet ./... && go test ./... — ALL-GREEN (both repos).

TestBridge_AppliesEndToEnd — consume→verify-pin→install→configure→marker; asserts the installer AND the enabler both receive the scanner-verified known_hosts + the private key, and the one-time password never appears in a log line. Red-proof run: passed an empty known_hosts to the installer (the pre-fix TOFU shape) → test FAILED ("installer must receive the scanner-verified known_hosts to pin (no TOFU), got """). Reverted. Pinning-the-install-connection (not just the scan) is load-bearing — addresses the security-review TOFU-after-verify finding.
TestBridge_HostKeyMismatchRefuses — a scanned FP ≠ descriptor FP → refuse (no consume/install/configure/marker). Red-proof run: dropped the verify (if false) → the mismatch proceeded to install a wrong key → test FAILED ("mismatch must refuse, got "). Reverted. No-TOFU is load-bearing.
TestBridge_IdempotentNoReconsume — marker matches → Consume panics if called → clean no-op.
TestBridge_InstallFailIsFailSafe — install errors → marker NOT persisted, offbox NOT configured, loud "password is spent" log. Red-proof run: persisted the marker before the install → a failed apply looked done → test FAILED ("marker must NOT be persisted on a failed apply"). Reverted. Marker-after-success is load-bearing.
Hub internal/offsite: descriptor carries HostFingerprint from a faked scanner; a scan failure fails-closed.

Deploy verification

(To be filled by the deploy step: controller :0.106.0 Up (healthy) on guest 9201 + clean startup logs; offsite is disabled in the demo config, so the bridge no-ops — the deploy proves the image ships sshpass + the bridge wiring, not a live apply.)

NOT yet live-applied

The supervised end-to-end (hub provisions on the new pool box u629488/project 15282031 → controller consumes + installs its key + configures the offbox → EscrowState="pending") is the next runbook, gated on the hub being wired with the new scoped HETZNER_TOKEN + HETZNER_POOL_BOX_ID. Unit tests (faked seams) are this slice's proof. Untested-live: the real sshpass/ssh-copy-id -s -f install + the x/crypto/ssh host-key scan against a live box (both proven in the API spike; re-confirmed in the supervised run).

Observations

The bridge runs once at startup; the config-refresh self-restart re-runs it after a descriptor change (no separate post-refresh hook needed — the restart is the trigger).
The escrow stage-push is best-effort (agent-down leaves the offbox configured+pending, re-stage later) — the offbox run-gate still holds until the operator confirms escrow (fork-4).

4.5 KiB Raw Blame History