hardened the ssh and no remote root login#98
Conversation
WalkthroughSeveral configuration and service files were added or modified to enhance SSH security and streamline system management. SSH root login is now disabled, stricter authentication rules are enforced, and new systemd service units ensure SSH services and key generation run at startup. Shell aliases were also simplified for easier command usage. Changes
Sequence Diagram(s)sequenceDiagram
participant Systemd
participant SshdGenKeys as sshdgenkeys.service
participant Sshd as sshd.service
Systemd->>SshdGenKeys: Start at boot (multi-user.target)
SshdGenKeys->>Systemd: Generate SSH host keys (ssh-keygen -A)
Systemd->>Sshd: Start SSH daemon (after keys generated)
Sshd->>Systemd: SSH daemon runs and listens for connections
Poem
✨ Finishing Touches
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (4)
configs/airootfs/etc/ssh/sshd_config.d/10-archiso.conf (1)
1-1: Update misleading comment to reflect root login being disabled.The comment on line 1 still reads “Allow root login using password authentication” even though
PermitRootLogin nodisallows root login. Adjust the comment to accurately describe the intent, for example:-# Allow root login using password authentication +# Disallow root login while allowing other users to authenticate with a passwordconfigs/releng/airootfs/etc/ssh/sshd_config (1)
1-7: Consider explicitly enforcing public-key authentication.Although password auth is disabled, adding the following lines can make the intent clearer and harder to override:
PermitRootLogin no PasswordAuthentication no +PubkeyAuthentication yes +AuthenticationMethods publickey AllowUsers yourusername PermitEmptyPasswords no ChallengeResponseAuthentication no UsePAM yes X11Forwarding noconfigs/releng/airootfs/etc/systemd/system/multi-user.target.wants/sshd.service (2)
1-4: Usenetwork-online.targetto ensure network readiness.Replace
After=network.targetwith:[Unit] -After=network.target +Wants=network-online.target +After=network-online.targetso SSH starts only once the network is fully up.
5-10: Add service sandboxing and hardening options.To reduce the attack surface of the SSH daemon, consider adding:
[Service] ExecStart=/usr/bin/sshd -D ExecReload=/bin/kill -HUP $MAINPID Restart=always User=root +PrivateTmp=yes +ProtectSystem=full +NoNewPrivileges=yes
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
configs/airootfs/etc/profile.d/pit-aliases.sh(1 hunks)configs/airootfs/etc/ssh/sshd_config.d/10-archiso.conf(1 hunks)configs/releng/airootfs/etc/ssh/sshd_config(1 hunks)configs/releng/airootfs/etc/systemd/system-preset/99-ferrari.preset(1 hunks)configs/releng/airootfs/etc/systemd/system/multi-user.target.wants/sshd.service(1 hunks)configs/releng/airootfs/etc/systemd/system/sshdgenkeys.service(1 hunks)
🔇 Additional comments (3)
configs/releng/airootfs/etc/systemd/system-preset/99-ferrari.preset (1)
1-2: Systemd preset file enabling SSH services is correctly configured.The directives
enable sshd.serviceandenable sshdgenkeys.servicewill ensure both units are enabled by default.configs/releng/airootfs/etc/systemd/system/sshdgenkeys.service (1)
1-10: New SSH host key generation service unit looks good.The
Type=oneshotunit runningssh-keygen -Abeforesshd.serviceand enabled formulti-user.targetis correctly defined.configs/releng/airootfs/etc/ssh/sshd_config (1)
3-3: Replace placeholder username in 'AllowUsers' directive.Line 3 uses
AllowUsers yourusernameas a placeholder. Ensure this is updated to the actual user account(s) allowed SSH access.
| alias update='pit -Syu' | ||
| alias install='pit -S' | ||
| alias remove='pit -R' | ||
| alias search='pit -Ss' | ||
| alias clean='pit -Sc' | ||
| alias info='pit -Si' | ||
| alias packages='pit -Q' |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Prevent alias collisions and improve naming consistency
Defining generic aliases like update, install, remove, search, clean, info, and packages will shadow common utilities and confuse users. I recommend the following improvements:
- Prefix aliases (e.g.
pit-update,pit-install, …) to avoid collisions. - Use consistent verb-based names (e.g.
listorlist-packagesinstead of the nounpackages). - Scope these aliases to interactive shells, wrapping them in a check such as:
+ if [[ $- == *i* ]]; then
- alias update='pit -Syu'
+ alias pit-update='pit -Syu'
alias pit-install='pit -S'
alias pit-remove='pit -R'
alias pit-search='pit -Ss'
alias pit-clean='pit -Sc'
alias pit-info='pit -Si'
- alias packages='pit -Q'
+ alias pit-list='pit -Q'
+ fiCommittable suggestion skipped: line range outside the PR's diff.
2 participants
Summary by CodeRabbit
New Features
Refactor
Security