fediversity/fediversity

Fork 10

Disable root SSH authentication altogether #24

New issue

Open

opened 2024-11-21 11:49:14 +01:00 by Niols · 1 comment

Niols commented

2024-11-21 11:49:14 +01:00

Owner

After discussion in the Matrix channel, and as mentioned in #20 (comment), we should get rid of root SSH authentication altogether.
this would then raise the question on how we might handle deployment in such a way as to better limit attack surface.

implementation notes.

ideas:

first off switch deployment from using root to using @wheel users with password-less sudo. NixOps4 did not support this yet, so this may depend on it being subsumed (after #494).
pull-based (may be less great for latency in our context of operator-triggered updates):
1. ~~nits~~
2. UKIs' ~~pull-based updates~~
  - c.f. appvm
pull-on-command:
1. ~~nixless-agent: on command node pulls update from cache~~ - unmaintained
2. SSH keys limited to a command like pulling from cache (#295) + rebuild
push-based:
1. ~~replace the node with a new one based on the new configuration (needs state transfer, see #100)~~ - overkill
~~kubernetes~~ (#598) - overkill

After discussion in the Matrix channel, and as mentioned in https://git.fediversity.eu/fediversity/fediversity/pulls/20#issuecomment-3275, we should get rid of root SSH authentication altogether. this would then raise the question on how we might handle deployment in such a way as to better limit attack surface. ### implementation notes. ideas: 1. first off switch deployment from using `root` to using `@wheel` users with password-less sudo. NixOps4 did not support this yet, so this may depend on it being subsumed (after #494). 1. pull-based (may be less great for latency in our context of operator-triggered updates): 1. ~~[nits](https://github.com/numtide/nits)~~ 1. [UKIs](https://nixos.org/manual/nixos/stable/#sec-image-repart-appliance)' ~~pull-based [updates](https://x86.lol/generic/2024/08/28/systemd-sysupdate.html)~~ - c.f. [`appvm`](https://github.com/jollheef/appvm) 1. pull-on-command: 1. ~[`nixless-agent`](https://github.com/DanielSidhion/nixless-agent): on command node pulls update from cache~ - unmaintained 1. SSH keys limited to a command like pulling from cache (#295) + rebuild 1. push-based: 1. ~replace the node with a new one based on the new configuration (needs state transfer, see #100)~ - overkill 1. ~kubernetes~ (#598) - overkill

👍 1

Niols added the

blocked

label

2024-11-21 11:51:56 +01:00

Niols referenced this issue

2024-11-21 11:52:50 +01:00

Factorise users configurations #20

fricklerhandwerk added this to the Fediversity project

2024-11-25 10:02:33 +01:00

kiara added the

security

label

2025-02-11 09:28:34 +01:00

kiara added the

component: nixops4

label

2025-03-18 12:22:04 +01:00

kiara referenced this issue

2025-04-02 16:46:11 +02:00

limit security impact of SSH access to service VMs #295

kiara added a new dependency

2025-04-02 16:46:33 +02:00

#291 code passes security check

kiara removed this from the Fediversity project

2025-04-14 11:13:17 +02:00

kiara added the

type: task

label

2025-05-01 11:42:40 +02:00

~~kiara referenced this issue 2025-05-05 19:48:02 +02:00~~

ephemeral state is automatically provisioned #314

kiara added the

13 points

label

2025-12-02 19:15:02 +01:00

kiara added a new dependency

2026-02-09 23:59:01 +01:00

#494 data model used

kiara added a new dependency

2026-02-10 00:01:24 +01:00

#100 migrating application data between hosting providers

kiara removed the

blocked

security

component: nixops4

labels

2026-02-10 13:07:48 +01:00

kiara referenced this issue

2026-06-06 14:35:33 +02:00

limit security impact of SSH access to service VMs #295

kiara added the

ambition

security

label

2026-06-11 15:32:02 +02:00

kiara referenced this issue

2026-06-21 01:01:46 +02:00

feat(tf-incus): deploy via incus exec, drop deployment SSH #1112

kiara referenced this issue from a commit

2026-06-21 10:22:48 +02:00

feat(tf-incus): deploy via `incus exec`, drop deployment SSH (#1112)

kiara commented

2026-06-21 14:59:21 +02:00

Owner

now that #1112 landed, this seems used still mostly for (in either case mostly for non-incus deployment methods, as that also offers incus exec):

deployment (currently notably our dev group)
diagnosing/restarting services (#599)

now that #1112 landed, this seems used still mostly for (in either case mostly for non-incus deployment methods, as that also offers `incus exec`): - deployment (currently notably our dev group) - diagnosing/restarting services (#599)

kiara added a new dependency

2026-06-21 18:35:18 +02:00

#883 infra includes hypervisor

kiara added a new dependency

2026-06-21 18:35:24 +02:00

#599 diagnosing services

kiara added a new dependency

2026-06-21 18:35:57 +02:00

#295 limit security impact of SSH access to service VMs