gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: Complete SSH bootstrap hardening

Browse Source
This commit is contained in:
Gabriel Brown
2026-08-27 05:19:58 -04:00
parent 98e29eb8f3
commit fc8f226747
9 changed files with 852 additions and 186 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/setup/readme-contract
+16
View File
@@ -57,18 +57,28 @@ assert_bootstrap_probe_rejected() {
}
target_key_requirement='target user owns[^.]*\.ssh[^.]*mode[^.]*([^0-9]|^)0700([^0-9]|$)[^.]*authorized_keys[^.]*mode[^.]*([^0-9]|^)0600([^0-9]|$)'
parseable_key_requirement='(every|each)[^.]*non-?comment[^.]*authorized_keys[^.]*(OpenSSH|ssh-keygen)[^.]*(parse|valid)|(OpenSSH|ssh-keygen)[^-]*parse[^.]*every[^.]*non-?comment'
hardening_continues_requirement='hardening[[:space:]]+is[[:space:]]+unavailable[^.]*without[^.]*verified[^.]*key[^.]*install[[:space:]]+continues[^.]*without[[:space:]]+(it|SSH[[:space:]]+hardening)'
atomic_dropin_requirement='atomic[[:space:]]+same-directory[[:space:]]+drop-in'
rollback_requirement='validation[^.]*reload[^.]*fail[^.]*(restor|rollback)[^.]*previous[[:space:]]+drop-in'
effective_policy_requirement='sshd -T[^.]*root[^.]*target|sshd -T[^.]*target[^.]*root'
require_bootstrap_doc "$target_key_requirement" \
'the root bootstrap docs do not require target-user ownership with exact 0700/0600 SSH modes'
require_bootstrap_doc "$parseable_key_requirement" \
'the root bootstrap docs do not require OpenSSH to parse every non-comment key entry'
require_bootstrap_doc "$hardening_continues_requirement" \
'the root bootstrap docs do not say bootstrap continues without unavailable SSH hardening'
require_bootstrap_doc 'sshd -t' \
'the root bootstrap docs do not name sshd -t validation'
require_bootstrap_doc "$effective_policy_requirement" \
'the root bootstrap docs do not name sshd -T checks for root and target contexts'
require_bootstrap_doc "$atomic_dropin_requirement" \
'the root bootstrap docs do not describe the atomic same-directory drop-in'
require_bootstrap_doc '00-panama\.conf' \
'the root bootstrap docs do not name the precedence-safe 00-panama.conf drop-in'
require_bootstrap_doc 'PermitRootLogin[^.]*no[^.]*PasswordAuthentication[^.]*no[^.]*KbdInteractiveAuthentication[^.]*no' \
'the root bootstrap docs do not state all three effective authentication denials'
require_bootstrap_doc 'detected (SSH )?unit.*reload|reload.*detected (SSH )?unit' \
'the root bootstrap docs do not describe reloading the detected SSH unit'
require_bootstrap_doc "$rollback_requirement" \
@@ -85,6 +95,10 @@ assert_bootstrap_probe_rejected 'exact SSH modes' "$target_key_requirement" \
"${bootstrap_doc//0700/700}"
assert_bootstrap_probe_rejected 'target-user ownership' "$target_key_requirement" \
"${bootstrap_doc//target user owns/someone owns}"
weakened_key_doc="${bootstrap_doc//OpenSSH/text tooling}"
weakened_key_doc="${weakened_key_doc//ssh-keygen/text parser}"
assert_bootstrap_probe_rejected 'OpenSSH key parsing' "$parseable_key_requirement" \
"$weakened_key_doc"
assert_bootstrap_probe_rejected 'hardening availability' "$hardening_continues_requirement" \
"${bootstrap_doc//unavailable/available}"
assert_bootstrap_probe_rejected 'hardening continuation' "$hardening_continues_requirement" \
@@ -95,6 +109,8 @@ assert_bootstrap_probe_rejected 'rollback after failure' "$rollback_requirement"
"${bootstrap_doc//restores /keeps }"
assert_bootstrap_probe_rejected 'rollback trigger' "$rollback_requirement" \
"${bootstrap_doc//fails/works}"
assert_bootstrap_probe_rejected 'effective target policy' "$effective_policy_requirement" \
"${bootstrap_doc//target/root}"
if grep -qiE 'merely writes? (the )?(SSH )?(drop-in|file)|reload failure.*ignored|ignores? .*reload failure' <<<"$bootstrap_doc"; then
note 'the root bootstrap docs weaken the transaction by treating the write or reload failure as harmless'