limit security impact of SSH access to service VMs #295

New issue

Open

opened 2025-04-01 21:01:07 +02:00 by kiara · 1 comment

kiara commented

2025-04-01 21:01:07 +02:00

Owner

notes

c.f. #24
split off from #272

implementation notes

ideas:

restrict ssh key commands
~~alternatively, access machines not by ssh but thru e.g. proxmox?~~
- such an endpoint is allegedly/apparently missing (/cc @kevin)

## notes - c.f. #24 - split off from #272 ### implementation notes ideas: - [restrict ssh key commands](https://research.kudelskisecurity.com/2013/05/14/restrict-ssh-logins-to-a-single-command/) - ~~alternatively, access machines not by ssh but thru e.g. proxmox?~~ - such an endpoint is [allegedly](https://forum.proxmox.com/threads/execute-command-in-node-with-api.112290/#post-484964)/[apparently](https://pve.proxmox.com/pve-docs/api-viewer/) missing (/cc @kevin)

kiara added a new dependency

2025-04-01 22:57:17 +02:00

#291 code passes security check

kiara added the

type

task

label

2025-05-01 11:58:46 +02:00

kiara changed title from ~~limit security impact of ssh access to service vms~~ to limit security impact of SSH access to service VMs

2025-12-02 19:48:36 +01:00

kiara added the

points

label

2025-12-02 19:50:03 +01:00

kiara referenced this issue

2026-05-15 18:05:47 +02:00

enqueuing deployment syncs #242

kiara commented

2026-06-06 14:35:33 +02:00

Author

Owner

incus however can execute commands on instances (TF docs) - paving the way for non-ssh deployment (#24)

incus however [can](https://linuxcontainers.org/incus/docs/main/instance-exec/) execute commands on instances ([TF docs](https://github.com/lxc/terraform-provider-incus/commit/f579ccf4aab7be8e95f70fb4f8c793437e55da2d)) - paving the way for non-ssh deployment (#24)

kiara referenced this issue

2026-06-06 14:51:50 +02:00

Disable root SSH authentication altogether #24

kiara added the

ambition

security

label

2026-06-11 15:31:58 +02:00

kiara referenced this issue

2026-06-21 01:01:46 +02:00

feat(tf-incus): deploy via incus exec, drop deployment SSH #1112

kiara added a new dependency