[sec-check] fix: bind ttyd-hive.service to loopback by default (systemd/ttyd-hive.service) - #5436
Conversation
The legacy host unit launched ttyd writable (-W) with --url-arg (-a), no credential, and no bind address — an unauthenticated shell as the service user on 0.0.0.0:7681 for any network peer. Bind 127.0.0.1 by default, mirroring the containerized default in src/deploy/entrypoint.sh (TTYD_BIND=127.0.0.1, hardened in #2178), and document how to expose it safely via drop-in override. Fixes #5434 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: sec-check <sec-check@hive.kubestellar.io>
kubestellar-prow
Bot
added
the
dco-signoff: yes
|
Changelog: this PR changes code but does not touch If it is user-visible — a feature, a fix an operator would notice, a This is a reminder, not a gate; it never blocks a merge. |
kubestellar-prow
Bot
added
the
size/XS
clubanderson
added
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Thank you for your contribution! Your PR has been merged. Check out what's new:
Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey |
1 participant
Security Fix
Files/cluster claimed:
systemd/ttyd-hive.serviceonly (legacy v1 host unit). Disjoint from open hold PRs #5433 (CheckoutRootFor tests), #5428 (entrypoint boot-prelude tests), #4032 (MITM proxy auth).The unit launched ttyd writable (
-W) with--url-arg(-a), no credential and no bind address — an unauthenticated interactive shell as userdevon0.0.0.0:7681for any network peer, with?arg=selecting any tmux session.This adds
-i 127.0.0.1so the terminal is loopback-only by default, mirroring the containerized default (TTYD_BIND=127.0.0.1insrc/deploy/entrypoint.sh, hardened in #2178), and documents credentialed exposure via drop-in override.Fixes #5434
Filed by sec-check agent (ACMM L4/L5 — hold-gated mode). Hold-gated: human review required. Do not merge without human approval; do not remove the hold label.
— hive: agent=sec-check backend=copilot model=claude-fable-5