OpeItcLoc03/admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tasks(books-ssh-audit-shared-vds): close 🟢 — audit clean (1 retained, 0 revoked)

Browse Source 
SSH audit на shared VDS vds-kzntsv (89.253.255.94, hosts books Slovo +
Bookva в shared compose-стеке) перед Phase 3 cutover'ом tenant-split.

Findings:
- 1 retained key: vitya@DESKTOP-NSEF0UK (core dev, sole admin)
- 0 keys to revoke — никаких analyst / former employee / unknown keys
- 1 cosmetic cleanup: removed dead root authorized_keys entry (was
  duplicate of vitya's key, dead из-за `permitrootlogin no`)
- sshd hardening verified via `sshd -T` (effective config: root-no,
  password-no, kbd-no). **Gotcha** noted: raw grep of /etc/ssh/sshd_config
  shows defaults; sshd_config.d/ overrides делают effective. Future
  audits use `sshd -T`, not raw grep.
- fail2ban active, 2670 failed / 37 banned hist, currently 0
- last 7 days journalctl ssh: только vitya@94.19.247.14 (мой home IP)

Acceptance per spec (Фаза 3, шаг 2 tenant-split):
✅ authorized_keys reviewed
✅ Non-core keys revoked (N/A — none existed)
✅ Analyst keys revoked (N/A — never issued)
✅ Documented in .wiki/concepts/books-ssh-access.md

Ingest: .wiki/concepts/books-ssh-access.md — retained keys table +
sshd state + fail2ban + login history + add/revoke processes +
cross-refs. Logged + indexed.

STATUS.md ⚪ block → ARCHIVE.md (per-task file kept in .tasks/).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
vitya
2026-05-24 15:59:50 +03:00
parent 66d2060bff
commit b7b8e27a27
6 changed files with 180 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

89
.wiki/concepts/books-ssh-access.md Normal file
View File

@@ -0,0 +1,89 @@
---
title: books shared VDS — SSH access audit + retained keys
status: live
tags: [vds, ssh, audit, books, tenant-split, ops]
related: [[vds-kzntsv]], [[../sources/vds-kzntsv-bootstrap-2026-05-20]]
---
# books shared VDS — SSH access (post-audit 2026-05-24)
Snapshot SSH-доступа к `vds-kzntsv` (89.253.255.94 / vds.kzntsv.site), на котором сейчас живёт shared `books`-инсталляция (Slovo + Bookva в одном compose-стеке, до physical split Фазы 4 в [`tenant-split`](https://git.kzntsv.site/victor/books/src/branch/master/.wiki/concepts/tenant-split.md)).
Создан 2026-05-24 в результате таски `[books-ssh-audit-shared-vds]` 🟢 (см. spec в Фазе 3 §SSH-аудит).
## Retained keys
| User | Key (truncated) | Owner | Date added | Reason | Source machine |
|---|---|---|---|---|---|
| `vitya` | `ssh-ed25519 AAAA…ER/Z vitya@DESKTOP-NSEF0UK` | Виктор Кузнецов (core dev) | 2026-05-20 (bootstrap) | Core developer, sole administrator. Single key for both dev + ops. | `DESKTOP-NSEF0UK` (home workstation) |
**Только 1 ключ.** Никаких аналитических, бывших-сотрудников, неопознанных ключей не найдено в audit'е 2026-05-24.
## Removed keys (audit cleanup)
| Path | Key | Status | Removed | Note |
|---|---|---|---|---|
| `/root/.ssh/authorized_keys` | `ssh-ed25519 AAAA…ER/Z vitya@DESKTOP-NSEF0UK` (duplicate vitya key) | Cosmetic dead | 2026-05-24 | Был dead с момента bootstrap'а — `sshd -T` показывает `permitrootlogin no`, root SSH disabled независимо от authorized_keys. Удалён для чистоты (backup в `/root/.ssh/authorized_keys.bak-pre-ssh-audit-2026-05-24`, но overwrite затёр содержимое — restoration trivial since key identical to vitya's main). |
## sshd hardening state
Effective config от `sshd -T 2>&1 | grep -E "^(permitrootlogin|passwordauthentication|pubkeyauthentication|challengeresponseauthentication|kbdinteractiveauthentication)"`:
```
permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
kbdinteractiveauthentication no
```
**Note:** raw grep `/etc/ssh/sshd_config` может показать `PermitRootLogin yes` / `PasswordAuthentication yes` — это default-config от пакета. Override'ы в `/etc/ssh/sshd_config.d/*.conf` (или drop-in от cloud-init) делают finальный config. Всегда проверять через `sshd -T`, не плоский config.
## fail2ban state (2026-05-24)
- `systemctl is-active fail2ban` → `active`
- Total failed attempts (since deploy): **2670**
- Total IPs ever banned: **37**
- Currently banned: **0** (бан выходит по TTL)
- Configured jail: `sshd` (default debian jail)
Brute-force protection adequate; нет required action.
## SSH login history (last 7 days)
`sudo journalctl -u ssh -u sshd --since="7 days ago" | grep Accepted` показал **только** `vitya from 94.19.247.14` (мой home public IP). Никаких других source-IP — clean.
## Tenant-split implications (Phase 3 acceptance)
Spec `tenant-split.md` §«Двухуровневая изоляция пользователей → Infra-level»:
> на промежуточной стадии не давать аналитикам Bookva SSH к VDS, только app-level. SSH-аудит до cutover'а.
**Verified clean** as of 2026-05-24 — никаких аналитических SSH-ключей не было выдано. Single-developer setup; analyst access всегда был app-level only. Pre-cutover sigh of relief.
После Phase 4 (physical split на 2 VDS):
- vds-kzntsv (Slovo) — продолжит хостить остальную нашу инфру (gitea, registry, ntfy, mssql, minio, owncloud, board-viewer) + books-slovo стек. SSH = vitya only.
- vds-bookva-new (Bookva) — отдельная box, отдельный SSH. Заводить core-dev key (vitya) + опционально formally-named Bookva admin.
## How to add a new key (process)
1. Получить от пользователя `<key-type> <key-data> <comment>` (full one-line pubkey).
2. Verify identity: comment должен match human-readable identifier (`alice@laptop`, не just `id_ed25519`).
3. Document **before** adding: append row to "Retained keys" table выше с rationale.
4. Commit doc change (PR / direct push depending on grant).
5. После doc-commit: `ssh vitya@vds.kzntsv.site 'echo "<key-line>" >> ~/.ssh/authorized_keys'`.
6. Verify new user can login via new key.
7. **NEVER** add key without doc update — иначе через 3 месяца забудем кто/зачем.
## How to revoke a key
1. Backup: `sudo cp ~/.ssh/authorized_keys ~/.ssh/authorized_keys.bak-$(date +%F)`.
2. Edit `~/.ssh/authorized_keys` — delete the line.
3. Update doc — переместить row из "Retained" в новый "Revoked" section с datestamp + reason.
4. Verify revoked key fails: `ssh -i <revoked-key> vitya@vds.kzntsv.site` returns publickey rejection.
5. Commit doc change.
## Cross-refs
- [[vds-kzntsv]] — entity page (host details).
- [[../sources/vds-kzntsv-bootstrap-2026-05-20]] — bootstrap chronology, contains initial sshd hardening setup.
- `victor/books` `.wiki/concepts/tenant-split.md` §«Двухуровневая изоляция пользователей» — design context для этого аудита.
- `.tasks/books-ssh-audit-shared-vds.md` — close-note + decisions.

1
.wiki/index.md
View File

@@ -18,6 +18,7 @@ Catalog of all wiki pages. One line per page, organized by type. Updated on ever
## Concepts
- [admin-infra-project](concepts/admin-infra-project.md) — design + migration plan для OpeItcLoc03/admin (canonical)
- [books-ssh-access](concepts/books-ssh-access.md) — SSH access audit на shared VDS (books Slovo+Bookva), retained keys + add/revoke processes
- [compose-bcrypt-escape-trap](concepts/compose-bcrypt-escape-trap.md) — Docker Compose ест `$` в bcrypt hashes
- [db-tls-self-signed-via-traefik-raw-tcp](concepts/db-tls-self-signed-via-traefik-raw-tcp.md) — DB TLS через traefik raw TCP с self-signed certs
- [docker-host-loopback-detect](concepts/docker-host-loopback-detect.md) — Docker host-loopback detection — как доказать что host.docker.internal не петля

2
.wiki/log.md
View File

@@ -19,3 +19,5 @@ Append-only log of wiki operations (ingests, promotions, lints, migrations).
## [2026-05-22] update | concepts/ocis-on-vds-deploy-recipe — Gotcha 5: 60s HTTP timeout caps slow-uplink uploads at ~200MB on 3 MiB/s link; traefik buffering NOT the fix (500 from oxy buffer); workaround = VDS-side curl PUT loopback via throwaway sftp key. Source: .tasks/owncloud-vds-deploy.md close-note.
## [2026-05-23] ingest | concepts/windows-server-2025-core-bootstrap — default-blockers (SMB closed, IIS/URL-Rewrite/.NET unverified) + transfer-методов матрица (RDP-redirect / SMB / WinRM / SFTP); recommendation = SMB inbound с source-IP whitelist на время migration. Source: failed-robocopy инцидент 2026-05-23 18:08 (.tasks/iis-migration-to-ruvds.md Decisions log).
## [2026-05-24] ingest | concepts/books-ssh-access — SSH access audit на shared VDS pre-cutover Фазы 3 tenant-split. Retained keys table (1 key, vitya core dev), removed cosmetic dead root key, sshd hardening verified via `sshd -T` (not raw config), fail2ban active 2670 failed/37 banned, only vitya@94.19.247.14 в access log last 7 days. Source: .tasks/books-ssh-audit-shared-vds.md.