Build the SSH hardening and key registry module

Abierto
  • ¿Algo no está bien?
#76 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
45/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
bash, linux, powershell
Área
security

Línea de trabajo

Start from branch phase-4/ssh and read spec design 04 section 4. Create module lockout.ssh in phases/lockout/modules/ssh/ implementing the key registry and sshd drop-in hardening. Write the bats and Pester acceptance tests listed in the issue first; 'done' means all those tests pass and sshd -T shows Labyrinth's settings.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

area: accounts phase: lockout platform: linux platform: windows type: build

Location & Context

Roadmap branch phase-4/ssh. Spec: design 04 section 4. Planned module ID: lockout.ssh, in phases/lockout/modules/ssh/.

Current Behavior

Remote admin is not hardened and there is no registry of allowed SSH keys, so an attacker's planted key or a root-login override stays in effect.

Remediation Plan

  1. Build the key registry: unregistered keys are removed and backed up; registered keys stay.
  2. Harden sshd through a drop-in; test syntax before any reload.
  3. Quarantine planted drop-ins that allow root login, and Match blocks, so sshd -T shows Labyrinth's settings.
  4. Keep password login for scored-admin accounts where SSH is scored.
  5. Write these acceptance tests first (bats and Pester):
    • An unregistered key is removed and backed up; a registered key stays.
    • A key with a wrong source address cannot log in.
    • A bad sshd configuration is rejected by the syntax test and does not reload.
    • A dead-man revert restores SSH access when verify is failed on purpose.
    • A planted 00-x.conf allowing root login is quarantined.
    • Where SSH is scored, a scored-admin account still logs in with its password and an unlisted admin account cannot use a password.
    • An unregistered key removed in a run that is not kept stays removed after the timer fires; rollback <run> --all puts it back.
    • A negative test: protected accounts and scored services are untouched before and after.
Lenguaje dominante
PowerShell
Estrellas
0
Forks
0
Merge medio
54 min
PR fusionados (30 d)
43

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de dotnetdork/Labyrinth

Todos los issues de dotnetdork/Labyrinth

Issues similares

Más issues de Security

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.