streamline package naming

2026-07-29 13:07:34 +02:00
parent 1ba1c2a32a
commit 7e703c93b1
100 changed files with 141 additions and 139 deletions
@@ -0,0 +1,41 @@
+# armor-fail2ban
+
+**Install and enable fail2ban**
+
+## Purpose
+
+This cube installs and configures Fail2ban, an intrusion prevention software that protects your server from brute-force attacks and unauthorized access attempts.
+
+## What is Fail2ban?
+
+Fail2ban monitors log files (e.g., `/var/log/auth.log`) for suspicious activity, such as repeated failed login attempts. When it detects malicious behavior patterns, it automatically:
+
+- Bans the offending IP address by updating firewall rules
+- Prevents the attacker from making further connection attempts
+- Can send email notifications about bans (if configured)
+
+Common use cases include:
+- Protecting SSH from brute-force password attacks
+- Blocking repeated failed login attempts on web applications
+- Preventing DoS attacks from specific IP addresses
+
+## What This Cube Does
+
+1. Installs the `fail2ban` package via apt
+2. Deploys a custom configuration file (`jail.local`) to `/etc/fail2ban/jail.local`
+3. Configures fail2ban with sensible defaults for common services
+
+## Configuration
+
+This cube currently has no configurable parameters. The default configuration is applied from the included `jail.local` file.
+
+## Dependencies
+
+None - this cube can run standalone.
+
+## Notes
+
+After deployment, you can:
+- Check fail2ban status: `sudo fail2ban-client status`
+- View banned IPs: `sudo fail2ban-client status sshd`
+- Unban an IP: `sudo fail2ban-client set sshd unbanip <IP_ADDRESS>`
@@ -0,0 +1,18 @@
+from pyinfra.operations import apt, files, server
+
+# Install Fail2ban
+apt.packages(
+    name='Install Fail2ban',
+    packages=['fail2ban'],
+    update=True,
+    _sudo=True
+)
+
+# Configure Fail2ban
+files.put(
+    name='Configure Fail2ban',
+    src='jail.local',
+    dest='/etc/fail2ban/jail.local',
+    mode='0644',
+    _sudo=True
+)
@@ -0,0 +1,8 @@
+[sshd]
+enabled  = true
+port     = ssh
+filter   = sshd
+logpath  = /var/log/auth.log
+maxretry = 3
+findtime  = 600
+bantime  = 3600
@@ -0,0 +1,7 @@
+import { Manifest } from '@bitsquare/nopy-cubes';
+
+export default Manifest({
+  id: 'armor:fail2ban',
+  name: 'Install and enable fail2ban',
+  dependencies: () => [],
+});
@@ -0,0 +1,83 @@
+# armor-ssh
+
+**Secure SSH server by disabling password authentication**
+
+## Purpose
+
+This cube hardens your SSH server configuration by disabling less secure authentication methods, enforcing SSH key-based authentication only.
+
+## Why Disable Password Authentication?
+
+Password-based SSH authentication is vulnerable to:
+- **Brute-force attacks**: Automated scripts trying millions of password combinations
+- **Dictionary attacks**: Guessing common passwords
+- **Credential stuffing**: Using leaked passwords from other breaches
+- **Weak passwords**: Users choosing easily guessable passwords
+
+**SSH key authentication is more secure** because:
+- Keys are cryptographically strong (2048+ bit keys vs 8-12 character passwords)
+- Private keys never travel over the network
+- Immune to brute-force attacks
+- Can be protected with passphrases for additional security
+
+## What This Cube Does
+
+1. **Disables challenge-response authentication**
+   - Prevents keyboard-interactive authentication prompts
+
+2. **Optionally disables password authentication** (default: enabled)
+   - Forces users to authenticate with SSH keys only
+   - Prevents password-based login attempts
+
+3. **Optionally disables PAM** (Pluggable Authentication Modules)
+   - Disables PAM-based authentication methods
+   - Reduces attack surface
+
+4. **Restarts SSH service**
+   - Applies the new configuration immediately
+
+## Configuration
+
+### Parameters
+
+- **DISABLE_PASSWORD** (boolean, default: `true`)
+  - Disable password authentication for SSH connections
+  - ⚠️ **WARNING**: Ensure you have SSH key access configured before enabling this!
+
+- **DISABLE_PAM** (boolean, default: `true`)
+  - Disable PAM (Pluggable Authentication Modules) for SSH
+  - Recommended for key-only authentication setups
+
+## Dependencies
+
+None - this cube can run standalone.
+
+## Security Best Practices
+
+**Before deploying this cube**:
+1. Ensure you have SSH key authentication set up and tested
+2. Keep an alternative access method available (console access, VNC, etc.)
+3. Test SSH key login before disabling passwords
+4. Consider using the `user-add` or `ssh-keyman` cubes first
+
+**After deployment**:
+- Only SSH key authentication will work
+- Password login attempts will be rejected
+- Make sure to back up your private SSH key securely
+
+## Post-Installation
+
+The SSH service will restart automatically. Your current SSH session will remain active, but new connections must use SSH keys.
+
+To verify the configuration:
+```bash
+sudo grep -E "PasswordAuthentication|ChallengeResponseAuthentication|UsePAM" /etc/ssh/sshd_config
+```
+
+## Recovery
+
+If you get locked out:
+1. Access the server via console (physical or cloud provider's web console)
+2. Edit `/etc/ssh/sshd_config`
+3. Set `PasswordAuthentication yes`
+4. Restart SSH: `sudo systemctl restart ssh`
@@ -0,0 +1,43 @@
+from pyinfra.operations import files, server
+from pyinfra import host
+from pyinfra import config
+import logging
+
+DISABLE_PASSWORD=host.data.DISABLE_PASSWORD
+DISABLE_PAM=host.data.DISABLE_PAM
+
+logger = logging.getLogger(__name__)
+config.SUDO = True
+
+files.line(
+    name='Disable challenge-response authentication in SSH',
+    path='/etc/ssh/sshd_config',
+    line='ChallengeResponseAuthentication yes',
+    replace='ChallengeResponseAuthentication no',
+)
+
+if DISABLE_PASSWORD:
+    files.line(
+        name='Disable password authentication in SSH',
+        path='/etc/ssh/sshd_config',
+        line='PasswordAuthentication yes',
+        replace='PasswordAuthentication no',
+)
+else:
+    logger.info('Password authentication allowed')
+
+if DISABLE_PAM:
+    files.line(
+        name='Disable PAM in SSH',
+        path='/etc/ssh/sshd_config',
+        line='UsePAM yes',
+        replace='UsePAM no',
+    )
+
+# Restart SSH service
+server.service(
+    'ssh', 
+    running=True, 
+    restarted=True, 
+    reloaded=True
+)
@@ -0,0 +1,18 @@
+import { Manifest } from '@bitsquare/nopy-cubes';
+import { z } from 'zod';
+
+export default Manifest({
+  id: 'armor:ssh',
+  name: 'Secure SSH server by disabling password authentication',
+  dependencies: () => [],
+  schema: z.object({
+    DISABLE_PASSWORD: z
+      .boolean()
+      .describe('Disable password authentication for SSH connections')
+      .default(true),
+    DISABLE_PAM: z
+      .boolean()
+      .describe('Disable PAM (Pluggable Authentication Modules) for SSH')
+      .default(true),
+  }),
+});
@@ -0,0 +1,77 @@
+# armor-ufw
+
+**Activate UFW (Uncomplicated Firewall)**
+
+## Purpose
+
+This cube configures and enables UFW, a user-friendly firewall management tool for Linux systems, providing basic protection against unauthorized network access.
+
+## What is UFW?
+
+UFW (Uncomplicated Firewall) is a frontend for `iptables` designed to make firewall configuration simple and accessible. It provides:
+
+- **Easy-to-understand syntax**: Commands like `ufw allow ssh` instead of complex iptables rules
+- **Default deny policy**: Blocks all incoming connections except those explicitly allowed
+- **Connection tracking**: Automatically handles related and established connections
+- **Application profiles**: Pre-configured rules for common services
+
+Think of UFW as a security gate for your server - it controls which network traffic is allowed in and out.
+
+## What This Cube Does
+
+1. Configures UFW to allow SSH connections (port 22)
+   - Ensures you don't lock yourself out when enabling the firewall
+2. Optionally allows HTTP traffic (port 80) based on the `ALLOW_HTTP` parameter
+3. Enables the firewall with the configured rules
+
+## Configuration
+
+### Parameters
+
+- **ALLOW_HTTP** (boolean, default: `true`)
+  - Allow incoming HTTP traffic on port 80
+  - Set to `false` if you're only using HTTPS or don't need web traffic
+
+## Dependencies
+
+- **apt:essentials** - Required for basic system tools
+
+## Security Notes
+
+**Important**: This cube automatically allows SSH to prevent lockouts. If you need to allow additional services, you can run:
+
+```bash
+sudo ufw allow [port number]/[protocol]
+sudo ufw allow [service-name]
+```
+
+Examples:
+- `sudo ufw allow 443/tcp` - Allow HTTPS
+- `sudo ufw allow 3000/tcp` - Allow custom application port
+- `sudo ufw allow https` - Allow HTTPS by service name
+
+## Post-Installation
+
+Check firewall status:
+```bash
+sudo ufw status verbose
+sudo ufw status numbered
+```
+
+Common UFW commands:
+- Delete rule: `sudo ufw delete [rule number]`
+- Disable firewall: `sudo ufw disable`
+- Reset to defaults: `sudo ufw reset`
+
+## UFW File Locations
+
+UFW rules are stored in the `/etc/ufw` directory:
+
+- `/etc/ufw/user.rules` - Custom rules added via the `ufw` command
+- `/etc/ufw/before.rules` - Rules processed before user rules (high priority)
+- `/etc/ufw/after.rules` - Rules processed after user rules (exceptions)
+- `/etc/ufw/sysctl.conf` - Kernel network parameters (e.g., packet forwarding)
+- `/etc/ufw/applications.d/` - Application profiles for common services
+- `/etc/default/ufw` - Global UFW settings and default policies
+
+Understanding these locations is helpful for troubleshooting, manual edits, or backing up your firewall configuration.
@@ -0,0 +1,13 @@
+from pyinfra.operations import server
+from pyinfra import host
+
+ALLOW_HTTP=host.data.ALLOW_HTTP
+
+server.shell(
+    commands=[
+        f"ufw allow ssh",
+        f"ufw allow http" if ALLOW_HTTP else "",
+        f"ufw enable",
+    ],
+    _sudo=True
+)
@@ -0,0 +1,11 @@
+import { Manifest } from '@bitsquare/nopy-cubes';
+import { z } from 'zod';
+
+export default Manifest({
+  id: 'armor:ufw',
+  name: 'Activate ufw (uncomplicated firewall)',
+  dependencies: () => ['apt:essentials'],
+  schema: z.object({
+    ALLOW_HTTP: z.boolean().describe('Allow incoming HTTP traffic on port 80').default(true),
+  }),
+});