Day 3 - Power trip [Automatically] #3

New Issue

john · 2022-02-09T16:10:11Z

john commented

2022-02-09 16:10:11 +00:00

Phase 1: open the correct access channel

Perform these actions via Ansible, root / public key auth already configured.

Create a standard user.
Install public keys to user's ~/.ssh/authorized_keys.
Install sudo and give the new user passwordless group membership.
Generate new ansible inventory/config to access the server with this admin user.

Phase 2: close the incorrect access channels (Basic Hardening)

Perform these actions via Ansible, admin user / public key auth configured in the previous step

Disable password login over SSH.
Disable root login over SSH.
install fail2ban.
change SSH port.
Generate new ansible inventory/config to access the server over the new port.

Phase 1: open the correct access channel Perform these actions via Ansible, root / public key auth already configured. * Create a standard user. * Install public keys to user's `~/.ssh/authorized_keys`. * Install `sudo` and give the new user passwordless group membership. * Generate new ansible inventory/config to access the server with this admin user. Phase 2: close the incorrect access channels *(Basic Hardening)* Perform these actions via Ansible, admin user / public key auth configured in the previous step * Disable password login over SSH. * Disable root login over SSH. * install fail2ban. * change SSH port. * Generate new ansible inventory/config to access the server over the new port.

john commented

2022-02-10 01:43:06 +00:00

generating the user's password requires putting a hash into the playbook.

mkpasswd --method=sha-512 (debian whois package)

To correct this, I'm using the vars and vars_prompt sections. passlib Linux module is now required.

To avoid the prompt, the passhash variable can be given a value at the command line. Just setting the variable doesn't work, it has to be encrypted:

PASSHASH=$(mkpasswd --method=sha-512 -s << EOF
swordfish
EOF
) ansible-playbook phase1user.yml -e "passhash=$PASSHASH"

But this doesn't hash correctly, because the password gets a trailing newline. So, I'm struggling to make this fully unattended.

generating the user's password requires putting a hash into the playbook. `mkpasswd --method=sha-512` (debian `whois` package) To correct this, I'm using the `vars` and `vars_prompt` sections. `passlib` Linux module is now required. To avoid the prompt, the `passhash` variable can be given a value at the command line. Just setting the variable doesn't work, it has to be encrypted: ``` PASSHASH=$(mkpasswd --method=sha-512 -s << EOF swordfish EOF ) ansible-playbook phase1user.yml -e "passhash=$PASSHASH" ``` But this doesn't hash correctly, because the password gets a trailing newline. So, I'm struggling to make this fully unattended.

john referenced this issue from a commit

2022-02-10 02:46:09 +00:00

Day three: enhance SSH security in two separate phases. Closes #3

john closed this issue

2022-02-10 02:46:09 +00:00

john commented

2022-02-12 02:57:36 +00:00

I'm an idiot, because mkpasswd takes a password as an argument.

PASSHASH=$(mkpasswd $PW --method=sha-512 -s)

I'm an idiot, because `mkpasswd` takes a password as an argument. `PASSHASH=$(mkpasswd $PW --method=sha-512 -s)`

This repo is archived. You cannot comment on issues.