diff --git a/Doc/Sdi/CloudProvider/Terra/050CloudInitBasic/Readme.md b/Doc/Sdi/CloudProvider/Terra/050CloudInitBasic/Readme.md new file mode 100644 index 0000000000000000000000000000000000000000..4f9b5f16bf6ab2c997758411baf7f98153f5e0f0 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/050CloudInitBasic/Readme.md @@ -0,0 +1,6 @@ +# Cloud-init creating a simple http static content server + +- File `userData` connecting Terraform and Cloud-init +- Package Nginx + static content +- Firewall by `network.tf` allowing incoming 80 and 443 (yet unused) connections + diff --git a/Doc/Sdi/CloudProvider/Terra/050CloudInitBasic/network.tf b/Doc/Sdi/CloudProvider/Terra/050CloudInitBasic/network.tf index a17a78fffef217d429aa2c6500663f7fffdd401d..dcfa52d7af012792b763f8d8497510e40972f787 100644 --- a/Doc/Sdi/CloudProvider/Terra/050CloudInitBasic/network.tf +++ b/Doc/Sdi/CloudProvider/Terra/050CloudInitBasic/network.tf @@ -27,4 +27,5 @@ resource "hcloud_firewall" "wwwFw" { "::/0" ] } + } diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/Readme.md b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/Readme.md new file mode 100644 index 0000000000000000000000000000000000000000..8893e3ebfccc7828d4da277b6eb2d59e174ec61f --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/Readme.md @@ -0,0 +1,5 @@ +# Improving ssh handling and security + +- Creating local `bin/ssh` and related `gen/known_hosts` file from templates +- Enhancing `sshd` security settings + diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/bin/.gitignore b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/bin/.gitignore new file mode 100644 index 0000000000000000000000000000000000000000..c96a04f008ee21e260b28f7701595ed59e2839e3 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/bin/.gitignore @@ -0,0 +1,2 @@ +* +!.gitignore \ No newline at end of file diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/gen/.gitignore b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/gen/.gitignore new file mode 100644 index 0000000000000000000000000000000000000000..c96a04f008ee21e260b28f7701595ed59e2839e3 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/gen/.gitignore @@ -0,0 +1,2 @@ +* +!.gitignore \ No newline at end of file diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/main.tf b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/main.tf new file mode 100644 index 0000000000000000000000000000000000000000..52c074a630f01f203f8f9086d01369b714c4cda6 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/main.tf @@ -0,0 +1,48 @@ +terraform { + required_providers { + hcloud = { + source = "hetznercloud/hcloud" + } + } + required_version = ">= 0.13" +} + +provider "hcloud" { + token = var.hcloud_token +} +resource "tls_private_key" "host" { + algorithm = "ED25519" +} + +resource "hcloud_ssh_key" "loginUser" { + name = "goik@hdm-stuttgart.de" + public_key = file("~/.ssh/id_ed25519.pub") +} + +resource "hcloud_server" "helloServer" { + name = "hello" + image = "debian-12" + server_type = "cx11" + user_data = templatefile("tpl/userData.yml", { + host_ed25519_private = indent(4, tls_private_key.host.private_key_openssh) # yaml format parsing quirk, sigh! + host_ed25519_public = tls_private_key.host.public_key_openssh + devopsSshPublicKey = hcloud_ssh_key.loginUser.public_key + }) + ssh_keys = [hcloud_ssh_key.loginUser.id] + firewall_ids = [hcloud_firewall.sshFw.id] +} + +resource "local_file" "known_hosts" { + content = "${hcloud_server.helloServer.ipv4_address} ${tls_private_key.host.public_key_openssh}" + filename = "gen/known_hosts" + file_permission = "644" +} + +resource "local_file" "ssh_script" { + content = templatefile("tpl/ssh.sh", { + ip = hcloud_server.helloServer.ipv4_address + }) + filename = "bin/ssh" + file_permission = "700" + depends_on = [local_file.known_hosts] +} diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/network.tf b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/network.tf new file mode 100644 index 0000000000000000000000000000000000000000..0a58ea6647bf9530394a4d5491b0e76eab5da606 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/network.tf @@ -0,0 +1,12 @@ +resource "hcloud_firewall" "sshFw" { + name = "www-firewall" + rule { + direction = "in" + protocol = "tcp" + port = "22" + source_ips = [ + "0.0.0.0/0", + "::/0" + ] + } +} diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/outputs.tf b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/outputs.tf new file mode 100644 index 0000000000000000000000000000000000000000..a63f85e5283012a999cf461de92feec4adfc2ce8 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/outputs.tf @@ -0,0 +1,9 @@ +output "hello_ip_addr" { + value = hcloud_server.helloServer.ipv4_address + description = "The server's IPv4 address" +} + +output "hello_datacenter" { + value = hcloud_server.helloServer.datacenter + description = "The server's datacenter" +} diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/secrets.auto.tfvars.template b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/secrets.auto.tfvars.template new file mode 100644 index 0000000000000000000000000000000000000000..5929da087a27aa9b1d390187a3dd39a7ab347fc0 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/secrets.auto.tfvars.template @@ -0,0 +1 @@ +hcloud_token="your_api_token_goes_here" diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/ssh.sh b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/ssh.sh new file mode 100644 index 0000000000000000000000000000000000000000..5de61bbbfc9871279e8991caded30b635650ae7b --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/ssh.sh @@ -0,0 +1,5 @@ +#!/usr/bin/env bash + +GEN_DIR=$(dirname "$0")/../gen + +ssh -o UserKnownHostsFile="$GEN_DIR/known_hosts" devops@${ip} "$@" diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/userData.yml b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/userData.yml new file mode 100644 index 0000000000000000000000000000000000000000..cd61df8f304442177d09f8f7364afec9e64bf071 --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/tpl/userData.yml @@ -0,0 +1,20 @@ +#cloud-config + +ssh_keys: + ed25519_private: | + ${host_ed25519_private} + ed25519_public: ${host_ed25519_public} +users: + - name: devops + groups: users, admin + sudo: ALL=(ALL) NOPASSWD:ALL + shell: /bin/bash + ssh_authorized_keys: + - ${devopsSshPublicKey} + +runcmd: + - sed -ie '/^PermitRootLogin/s/^.*$/PermitRootLogin no/' /etc/ssh/sshd_config + - sed -ie '/^PasswordAuthentication/s/^.*$/PasswordAuthentication no/' /etc/ssh/sshd_config + - sed -ie '/^#AuthorizedKeysFile/s/^.*$/AuthorizedKeysFile .ssh/authorized_keys/' /etc/ssh/sshd_config + - sed -i '$a AllowUsers devops' /etc/ssh/sshd_config + - systemctl restart ssh diff --git a/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/variables.tf b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/variables.tf new file mode 100644 index 0000000000000000000000000000000000000000..3eefa6804960a042381853d0ed36d7936b7b5c9b --- /dev/null +++ b/Doc/Sdi/CloudProvider/Terra/060SshKnownHosts/variables.tf @@ -0,0 +1,4 @@ +variable "hcloud_token" { # See secret.auto.tfvars + nullable = false + sensitive = true +} \ No newline at end of file