gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: Complete SSH bootstrap hardening

Browse Source
This commit is contained in:
Gabriel Brown
2026-08-27 05:19:58 -04:00
parent 98e29eb8f3
commit fc8f226747
9 changed files with 852 additions and 186 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.claude/docs/specs/2026-08-25-server-role.md
+10 -4
View File
@@ -138,10 +138,16 @@ steps, each checked and skipped when already true:
exists, use it.
2. Ensure the user has a password (needed for sudo) — `passwd` interactively
if none is set.
3. Copy root's `authorized_keys` to the user when the user has none.
4. Offer sshd hardening (yes/no, default yes): drop-in under
`/etc/ssh/sshd_config.d/` with `PermitRootLogin no`,
`PasswordAuthentication no`, then reload sshd. Skipped when already set.
3. Copy root's `authorized_keys` only after OpenSSH parses every key line. The
destination directory and file are created as the target UID at `0700/0600`
and revalidated before hardening is available.
4. Offer sshd hardening (yes/no, default yes): atomically install
`/etc/ssh/sshd_config.d/00-panama.conf` with `PermitRootLogin no`,
`PasswordAuthentication no`, and `KbdInteractiveAuthentication no`. Run
`sshd -t` plus effective root/target `sshd -T -C` checks before reloading the
detected unit. Restore a prior regular file with metadata on failure. A
missing unit or unsupported existing drop-in leaves SSH unchanged and
bootstrap continues. The later binding transaction design owns the details.
5. Move/clone the checkout under the user's home, chown it, and re-exec
`install --server` as that user.
.claude/skills/panama/SKILL.md
+15 -6
View File
@@ -99,10 +99,19 @@ Before it offers SSH hardening, it copies a safe root key when possible or
verifies the target key. The target user's `.ssh` must be owned by that user at
`0700`, and `authorized_keys` must be owned by that user at `0600`. Without a
verified target key, SSH hardening is unavailable and the bootstrap continues.
Every non-comment key line must parse with `ssh-keygen`. Root-key destination
creation and writing run as the target UID, followed by the same owner, mode,
and key checks. Do not replace that with root writes or assume the user's
primary group matches the username.
Accepted hardening uses an atomic same-directory `sshd_config.d` drop-in,
runs `sshd -t`, then reloads the detected SSH unit. Validation or reload
failure restores the previous drop-in before it retries validation and reload;
failed recovery stops the handoff with manual recovery instructions. The
fixture contracts exercise those branches. `panama test --safe` never reloads
a live daemon, so it is not live-host proof.
Accepted hardening uses atomic same-directory `00-panama.conf` with exactly
`PermitRootLogin no`, `PasswordAuthentication no`, and
`KbdInteractiveAuthentication no`. A pre-existing symlink or non-regular
object makes hardening unavailable, as does a missing SSH unit. Panama runs
`sshd -t`, then checks effective root and target-user policy with `sshd -T -C`
before reloading the detected unit. Validation or reload failure restores a
prior regular file with its metadata before it retries validation and reload.
Failed recovery stops the handoff with instructions that distinguish a prior
file from no prior file. The fixture contracts also cover declined hardening
and interrupted preparation. `panama test --safe` never reloads a live daemon,
so it is not live-host proof.