diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/Readme.md b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/Readme.md index 8893e3ebfccc7828d4da277b6eb2d59e174ec61f..112c9318d6c9f780347e377e99deea030342be79 100644 --- a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/Readme.md +++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/Readme.md @@ -1,5 +1,8 @@ # Improving ssh handling and security - Creating local `bin/ssh` and related `gen/known_hosts` file from templates -- Enhancing `sshd` security settings +- Enhancing `sshd` security settings: + - Disallow password based logins + - Disallow `root` login + - Allow `devops` private key based login diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/userData.yml b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/userData.yml index cd61df8f304442177d09f8f7364afec9e64bf071..deae75e2752f254431b64614555b583fdf02b3f7 100644 --- a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/userData.yml +++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/userData.yml @@ -13,6 +13,7 @@ users: - ${devopsSshPublicKey} runcmd: + # ssh daemon defaults - sed -ie '/^PermitRootLogin/s/^.*$/PermitRootLogin no/' /etc/ssh/sshd_config - sed -ie '/^PasswordAuthentication/s/^.*$/PasswordAuthentication no/' /etc/ssh/sshd_config - sed -ie '/^#AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh/authorized_keys/' /etc/ssh/sshd_config diff --git a/Doc/Sdi/CloudProvider/Terra/070Upgrade/Readme.md b/Doc/Sdi/CloudProvider/Terra/070Upgrade/Readme.md new file mode 100644 index 0000000000000000000000000000000000000000..1fe6603e4076985afe145b5a42ca371e29089c88 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/070Upgrade/Readme.md @@ -0,0 +1,7 @@ +# System update, enhanced security and useful helpers + +- Package upgrade and reboot if so required +- Installing and configuring `fail2ban` limiting ssh connection attempts. +- Installing enhanced vim +- Installing mlocate file indexer + diff --git a/Doc/Sdi/CloudProvider/Terra/070Upgrade/bin/.gitignore b/Doc/Sdi/CloudProvider/Terra/070Upgrade/bin/.gitignore new file mode 100644 index 0000000000000000000000000000000000000000..c96a04f008ee21e260b28f7701595ed59e2839e3 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/070Upgrade/bin/.gitignore @@ -0,0 +1,2 @@ +* +!.gitignore \ No newline at end of file diff --git a/Doc/Sdi/CloudProvider/Terra/070Upgrade/gen/.gitignore b/Doc/Sdi/CloudProvider/Terra/070Upgrade/gen/.gitignore new file mode 100644 index 0000000000000000000000000000000000000000..c96a04f008ee21e260b28f7701595ed59e2839e3 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/070Upgrade/gen/.gitignore @@ -0,0 +1,2 @@ +* +!.gitignore \ No newline at end of file diff --git a/Doc/Sdi/CloudProvider/Terra/070Upgrade/main.tf b/Doc/Sdi/CloudProvider/Terra/070Upgrade/main.tf new file mode 100644 index 0000000000000000000000000000000000000000..52c074a630f01f203f8f9086d01369b714c4cda6 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/070Upgrade/main.tf @@ -0,0 +1,48 @@ +terraform { + required_providers { + hcloud = { + source = "hetznercloud/hcloud" + } + } + required_version = ">= 0.13" +} + +provider "hcloud" { + token = var.hcloud_token +} +resource "tls_private_key" "host" { + algorithm = "ED25519" +} + +resource "hcloud_ssh_key" "loginUser" { + name = "goik@hdm-stuttgart.de" + public_key = file("~/.ssh/id_ed25519.pub") +} + +resource "hcloud_server" "helloServer" { + name = "hello" + image = "debian-12" + server_type = "cx11" + user_data = templatefile("tpl/userData.yml", { + host_ed25519_private = indent(4, tls_private_key.host.private_key_openssh) # yaml format parsing quirk, sigh! + host_ed25519_public = tls_private_key.host.public_key_openssh + devopsSshPublicKey = hcloud_ssh_key.loginUser.public_key + }) + ssh_keys = [hcloud_ssh_key.loginUser.id] + firewall_ids = [hcloud_firewall.sshFw.id] +} + +resource "local_file" "known_hosts" { + content = "${hcloud_server.helloServer.ipv4_address} ${tls_private_key.host.public_key_openssh}" + filename = "gen/known_hosts" + file_permission = "644" +} + +resource "local_file" "ssh_script" { + content = templatefile("tpl/ssh.sh", { + ip = hcloud_server.helloServer.ipv4_address + }) + filename = "bin/ssh" + file_permission = "700" + depends_on = [local_file.known_hosts] +} diff --git a/Doc/Sdi/CloudProvider/Terra/070Upgrade/network.tf b/Doc/Sdi/CloudProvider/Terra/070Upgrade/network.tf new file mode 100644 index 0000000000000000000000000000000000000000..0a58ea6647bf9530394a4d5491b0e76eab5da606 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/070Upgrade/network.tf @@ -0,0 +1,12 @@ +resource "hcloud_firewall" "sshFw" { + name = "www-firewall" + rule { + direction = "in" + protocol = "tcp" + port = "22" + source_ips = [ + "0.0.0.0/0", + "::/0" + ] + } +} diff --git a/Doc/Sdi/CloudProvider/Terra/070Upgrade/outputs.tf b/Doc/Sdi/CloudProvider/Terra/070Upgrade/outputs.tf new file mode 100644 index 0000000000000000000000000000000000000000..a63f85e5283012a999cf461de92feec4adfc2ce8 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/070Upgrade/outputs.tf @@ -0,0 +1,9 @@ +output "hello_ip_addr" { + value = hcloud_server.helloServer.ipv4_address + description = "The server's IPv4 address" +} + +output "hello_datacenter" { + value = hcloud_server.helloServer.datacenter + description = "The server's datacenter" +} diff --git a/Doc/Sdi/CloudProvider/Terra/070Upgrade/secrets.auto.tfvars.template b/Doc/Sdi/CloudProvider/Terra/070Upgrade/secrets.auto.tfvars.template new file mode 100644 index 0000000000000000000000000000000000000000..5929da087a27aa9b1d390187a3dd39a7ab347fc0 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/070Upgrade/secrets.auto.tfvars.template @@ -0,0 +1 @@ +hcloud_token="your_api_token_goes_here" diff --git a/Doc/Sdi/CloudProvider/Terra/070Upgrade/tpl/ssh.sh b/Doc/Sdi/CloudProvider/Terra/070Upgrade/tpl/ssh.sh new file mode 100644 index 0000000000000000000000000000000000000000..5de61bbbfc9871279e8991caded30b635650ae7b --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/070Upgrade/tpl/ssh.sh @@ -0,0 +1,5 @@ +#!/usr/bin/env bash + +GEN_DIR=$(dirname "$0")/../gen + +ssh -o UserKnownHostsFile="$GEN_DIR/known_hosts" devops@${ip} "$@" diff --git a/Doc/Sdi/CloudProvider/Terra/070Upgrade/tpl/userData.yml b/Doc/Sdi/CloudProvider/Terra/070Upgrade/tpl/userData.yml new file mode 100644 index 0000000000000000000000000000000000000000..e9d65aaed599751ffb29e0b9a5af56709ca678d3 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/070Upgrade/tpl/userData.yml @@ -0,0 +1,37 @@ +#cloud-config + +ssh_keys: + ed25519_private: | + ${host_ed25519_private} + ed25519_public: ${host_ed25519_public} +users: + - name: devops + groups: users, admin + sudo: ALL=(ALL) NOPASSWD:ALL + shell: /bin/bash + ssh_authorized_keys: + - ${devopsSshPublicKey} + +package_update: true +package_upgrade: true +package_reboot_if_required: true + +packages: + - fail2ban + - vim # Enhanced vi command + - mlocate +runcmd: + # Fail2ban activation + - printf "[sshd]\nenabled = true\nbanaction = iptables-multiport" > /etc/fail2ban/jail.local + - systemctl enable fail2ban + - systemctl start fail2ban + # ssh daemon defaults + - sed -ie '/^PermitRootLogin/s/^.*$/PermitRootLogin no/' /etc/ssh/sshd_config + - sed -ie '/^PasswordAuthentication/s/^.*$/PasswordAuthentication no/' /etc/ssh/sshd_config + - sed -ie '/^#AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh/authorized_keys/' /etc/ssh/sshd_config + - sed -i '$a AllowUsers devops' /etc/ssh/sshd_config + - systemctl restart ssh + # Generation mlocate index + - updatedb + + diff --git a/Doc/Sdi/CloudProvider/Terra/070Upgrade/variables.tf b/Doc/Sdi/CloudProvider/Terra/070Upgrade/variables.tf new file mode 100644 index 0000000000000000000000000000000000000000..3eefa6804960a042381853d0ed36d7936b7b5c9b --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/070Upgrade/variables.tf @@ -0,0 +1,4 @@ +variable "hcloud_token" { # See secret.auto.tfvars + nullable = false + sensitive = true +} \ No newline at end of file