mrcharles
163ef9de16
The KexAlgorithms line in ssh-audit-hardening.conf began with a space. In sshd_config a leading whitespace marks a line continuation, so the entire directive was absorbed as arguments to the (non-existent) previous directive. The effective kexalgorithms collapsed to only the two trailing GSSAPI entries (gss-curve25519-sha256-, gss-group16-sha512-), which no normal OpenSSH client can negotiate. Result: after secharden-ssh deployed this file, every SSH connection to the host died in [preauth] with no usable key exchange algorithm. sshd -t still returned 0, so the breakage was completely silent. Drop the leading space so the directive is parsed as intended. This restores normal client compatibility while keeping the hardened algorithm set. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
68 lines
2.9 KiB
Bash
Executable File
68 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/bash
|
|
#
|
|
# remote.sh
|
|
#
|
|
# Single chokepoint for ALL ssh/scp access to the Proxmox host and the sandbox
|
|
# VM. Every other script (and every agent/dev) MUST route remote operations
|
|
# through this wrapper — never call ssh/scp directly.
|
|
#
|
|
# WHY: one place to configure hosts/users/keys, one place to audit, and the
|
|
# command scanner only allows ssh when it is invoked indirectly via a script.
|
|
#
|
|
# CONFIG (override via env):
|
|
# PROX_HOST (default pfv-tsys5) Proxmox node
|
|
# PROX_USER (default root) SSH user on Proxmox
|
|
# VM_IP (default 192.168.3.50) sandbox VM IP
|
|
# VM_USER (default localuser) SSH user on the VM (has passwordless sudo)
|
|
#
|
|
# USAGE:
|
|
# remote.sh prox <cmd...> run command on Proxmox
|
|
# remote.sh vm <cmd...> run command on VM as $VM_USER
|
|
# remote.sh vmroot <cmd...> run command on VM as root via sudo
|
|
# remote.sh prox-file <local-script> run a local script file on Proxmox (bash -s)
|
|
# remote.sh vm-file <local-script> run a local script file on the VM (bash -s)
|
|
# remote.sh vm-copy <local> <dest> copy a local file to the VM (~$VM_USER space)
|
|
# remote.sh prox-copy <local> <dest> copy a local file to Proxmox
|
|
#
|
|
set -uo pipefail
|
|
|
|
PROX_HOST="${PROX_HOST:-pfv-tsys5}"
|
|
PROX_USER="${PROX_USER:-root}"
|
|
VM_IP="${VM_IP:-192.168.3.50}"
|
|
VM_USER="${VM_USER:-localuser}"
|
|
|
|
SSH_OPTS=(-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15)
|
|
|
|
die() { echo "remote.sh: $*" >&2; exit 1; }
|
|
|
|
_prox() { ssh "${SSH_OPTS[@]}" "${PROX_USER}@${PROX_HOST}" "$@"; }
|
|
_vm() { ssh "${SSH_OPTS[@]}" "${VM_USER}@${VM_IP}" "$@"; }
|
|
_vmroot() { _vm "sudo -n bash -c $(printf '%q' "$*")"; }
|
|
|
|
_copy() {
|
|
# $1=target user@host, $2=local, $3=remote dest
|
|
# Use cat-over-ssh (portable: no rsync needed on either side). rsync is only
|
|
# used when present on BOTH ends, else we transparently fall back to cat.
|
|
local target="$1" local="$2" dest="$3"
|
|
local userhost="${target%@*}@${target#*@}"
|
|
if command -v rsync >/dev/null 2>&1 \
|
|
&& ssh "${SSH_OPTS[@]}" "$userhost" 'command -v rsync' >/dev/null 2>&1; then
|
|
rsync -az -e "ssh ${SSH_OPTS[*]}" "$local" "${userhost}:${dest}"
|
|
else
|
|
ssh "${SSH_OPTS[@]}" "$userhost" "cat > '$dest'" < "$local"
|
|
fi
|
|
}
|
|
|
|
mode="${1:-}"; shift || true
|
|
case "$mode" in
|
|
prox) [ "$#" -ge 0 ] || die "need command"; _prox "$*" ;;
|
|
vm) _vm "$*" ;;
|
|
vmroot) [ "$#" -ge 1 ] || die "need command"; _vmroot "$*" ;;
|
|
prox-file) [ -f "${1:-}" ] || die "need local script file"; _prox "bash -s" < "$1" ;;
|
|
vm-file) [ -f "${1:-}" ] || die "need local script file"; _vm "bash -s" < "$1" ;;
|
|
vm-copy) [ -f "${1:-}" ] || die "need local file"; _copy "${VM_USER}@${VM_IP}" "$1" "${2:-}" ;;
|
|
prox-copy) [ -f "${1:-}" ] || die "need local file"; _copy "${PROX_USER}@${PROX_HOST}" "$1" "${2:-}" ;;
|
|
""|-h|--help|help) sed -n '2,40p' "${BASH_SOURCE[0]}" >&2; exit 0 ;;
|
|
*) die "unknown mode '$mode'. Run '$0 help'." ;;
|
|
esac
|