Go to file

vitya b7b8e27a27 tasks(books-ssh-audit-shared-vds): close 🟢 — audit clean (1 retained, 0 revoked)

SSH audit на shared VDS vds-kzntsv (89.253.255.94, hosts books Slovo +
Bookva в shared compose-стеке) перед Phase 3 cutover'ом tenant-split.

Findings:
- 1 retained key: vitya@DESKTOP-NSEF0UK (core dev, sole admin)
- 0 keys to revoke — никаких analyst / former employee / unknown keys
- 1 cosmetic cleanup: removed dead root authorized_keys entry (was
  duplicate of vitya's key, dead из-за `permitrootlogin no`)
- sshd hardening verified via `sshd -T` (effective config: root-no,
  password-no, kbd-no). **Gotcha** noted: raw grep of /etc/ssh/sshd_config
  shows defaults; sshd_config.d/ overrides делают effective. Future
  audits use `sshd -T`, not raw grep.
- fail2ban active, 2670 failed / 37 banned hist, currently 0
- last 7 days journalctl ssh: только vitya@94.19.247.14 (мой home IP)

Acceptance per spec (Фаза 3, шаг 2 tenant-split):
✅ authorized_keys reviewed
✅ Non-core keys revoked (N/A — none existed)
✅ Analyst keys revoked (N/A — never issued)
✅ Documented in .wiki/concepts/books-ssh-access.md

Ingest: .wiki/concepts/books-ssh-access.md — retained keys table +
sshd state + fail2ban + login history + add/revoke processes +
cross-refs. Logged + indexed.

STATUS.md ⚪ block → ARCHIVE.md (per-task file kept in .tasks/).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-24 15:59:50 +03:00

.tasks

tasks(books-ssh-audit-shared-vds): close 🟢 — audit clean (1 retained, 0 revoked)

2026-05-24 15:59:50 +03:00

.wiki

tasks(books-ssh-audit-shared-vds): close 🟢 — audit clean (1 retained, 0 revoked)

2026-05-24 15:59:50 +03:00

scripts

scripts(windows-host-fallback-backup-daily): add setup.ps1 + run.ps1 + README

2026-05-24 13:38:31 +03:00

.gitignore

tasks(iis-migration-to-ruvds): pause после failed-robocopy + ingest SMB-default finding