Disable root SSH authentication altogether #24

New issue

Open

opened 2024-11-21 11:49:14 +01:00 by Niols · 0 comments

Niols commented

2024-11-21 11:49:14 +01:00

Owner

After discussion in the Matrix channel, and as mentioned in #20 (comment), we should get rid of root SSH authentication altogether.
this would then raise the question on how we might handle deployment in such a way as to better limit attack surface.

implementation notes.

ideas:

first off switch deployment from using root to using @wheel users with password-less sudo. NixOps4 did not support this yet, so this may depend on it being subsumed (after #494).
pull-based (may be less great for latency in our context of operator-triggered updates):
1. ~~nits~~
2. UKIs' ~~pull-based updates~~
  - c.f. appvm
push-based:
1. nixless-agent: on command node pulls update from cache
2. replace the node with a new one based on the new configuration (needs state transfer, see #100).
kubernetes (#598)

After discussion in the Matrix channel, and as mentioned in https://git.fediversity.eu/fediversity/fediversity/pulls/20#issuecomment-3275, we should get rid of root SSH authentication altogether. this would then raise the question on how we might handle deployment in such a way as to better limit attack surface. ### implementation notes. ideas: 1. first off switch deployment from using `root` to using `@wheel` users with password-less sudo. NixOps4 did not support this yet, so this may depend on it being subsumed (after #494). 1. pull-based (may be less great for latency in our context of operator-triggered updates): 1. ~~[nits](https://github.com/numtide/nits)~~ 1. [UKIs](https://nixos.org/manual/nixos/stable/#sec-image-repart-appliance)' ~~pull-based [updates](https://x86.lol/generic/2024/08/28/systemd-sysupdate.html)~~ - c.f. [`appvm`](https://github.com/jollheef/appvm) 1. push-based: 1. [`nixless-agent`](https://github.com/DanielSidhion/nixless-agent): on command node pulls update from cache 1. replace the node with a new one based on the new configuration (needs state transfer, see #100). 1. kubernetes (#598)

👍 1

Niols added the

blocked

label

2024-11-21 11:51:56 +01:00

Niols referenced this issue

2024-11-21 11:52:50 +01:00

Factorise users configurations #20