tasks(books-ssh-audit-shared-vds): close 🟢 — audit clean (1 retained, 0 revoked)
SSH audit на shared VDS vds-kzntsv (89.253.255.94, hosts books Slovo +
Bookva в shared compose-стеке) перед Phase 3 cutover'ом tenant-split.
Findings:
- 1 retained key: vitya@DESKTOP-NSEF0UK (core dev, sole admin)
- 0 keys to revoke — никаких analyst / former employee / unknown keys
- 1 cosmetic cleanup: removed dead root authorized_keys entry (was
duplicate of vitya's key, dead из-за `permitrootlogin no`)
- sshd hardening verified via `sshd -T` (effective config: root-no,
password-no, kbd-no). **Gotcha** noted: raw grep of /etc/ssh/sshd_config
shows defaults; sshd_config.d/ overrides делают effective. Future
audits use `sshd -T`, not raw grep.
- fail2ban active, 2670 failed / 37 banned hist, currently 0
- last 7 days journalctl ssh: только vitya@94.19.247.14 (мой home IP)
Acceptance per spec (Фаза 3, шаг 2 tenant-split):
✅ authorized_keys reviewed
✅ Non-core keys revoked (N/A — none existed)
✅ Analyst keys revoked (N/A — never issued)
✅ Documented in .wiki/concepts/books-ssh-access.md
Ingest: .wiki/concepts/books-ssh-access.md — retained keys table +
sshd state + fail2ban + login history + add/revoke processes +
cross-refs. Logged + indexed.
STATUS.md ⚪ block → ARCHIVE.md (per-task file kept in .tasks/).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
vitya
b7b8e27a27