streamline package naming

2026-07-29 13:07:34 +02:00
parent 1ba1c2a32a
commit 7e703c93b1
100 changed files with 141 additions and 139 deletions
@@ -0,0 +1,83 @@
+# armor-ssh
+
+**Secure SSH server by disabling password authentication**
+
+## Purpose
+
+This cube hardens your SSH server configuration by disabling less secure authentication methods, enforcing SSH key-based authentication only.
+
+## Why Disable Password Authentication?
+
+Password-based SSH authentication is vulnerable to:
+- **Brute-force attacks**: Automated scripts trying millions of password combinations
+- **Dictionary attacks**: Guessing common passwords
+- **Credential stuffing**: Using leaked passwords from other breaches
+- **Weak passwords**: Users choosing easily guessable passwords
+
+**SSH key authentication is more secure** because:
+- Keys are cryptographically strong (2048+ bit keys vs 8-12 character passwords)
+- Private keys never travel over the network
+- Immune to brute-force attacks
+- Can be protected with passphrases for additional security
+
+## What This Cube Does
+
+1. **Disables challenge-response authentication**
+   - Prevents keyboard-interactive authentication prompts
+
+2. **Optionally disables password authentication** (default: enabled)
+   - Forces users to authenticate with SSH keys only
+   - Prevents password-based login attempts
+
+3. **Optionally disables PAM** (Pluggable Authentication Modules)
+   - Disables PAM-based authentication methods
+   - Reduces attack surface
+
+4. **Restarts SSH service**
+   - Applies the new configuration immediately
+
+## Configuration
+
+### Parameters
+
+- **DISABLE_PASSWORD** (boolean, default: `true`)
+  - Disable password authentication for SSH connections
+  - ⚠️ **WARNING**: Ensure you have SSH key access configured before enabling this!
+
+- **DISABLE_PAM** (boolean, default: `true`)
+  - Disable PAM (Pluggable Authentication Modules) for SSH
+  - Recommended for key-only authentication setups
+
+## Dependencies
+
+None - this cube can run standalone.
+
+## Security Best Practices
+
+**Before deploying this cube**:
+1. Ensure you have SSH key authentication set up and tested
+2. Keep an alternative access method available (console access, VNC, etc.)
+3. Test SSH key login before disabling passwords
+4. Consider using the `user-add` or `ssh-keyman` cubes first
+
+**After deployment**:
+- Only SSH key authentication will work
+- Password login attempts will be rejected
+- Make sure to back up your private SSH key securely
+
+## Post-Installation
+
+The SSH service will restart automatically. Your current SSH session will remain active, but new connections must use SSH keys.
+
+To verify the configuration:
+```bash
+sudo grep -E "PasswordAuthentication|ChallengeResponseAuthentication|UsePAM" /etc/ssh/sshd_config
+```
+
+## Recovery
+
+If you get locked out:
+1. Access the server via console (physical or cloud provider's web console)
+2. Edit `/etc/ssh/sshd_config`
+3. Set `PasswordAuthentication yes`
+4. Restart SSH: `sudo systemctl restart ssh`
@@ -0,0 +1,43 @@
+from pyinfra.operations import files, server
+from pyinfra import host
+from pyinfra import config
+import logging
+
+DISABLE_PASSWORD=host.data.DISABLE_PASSWORD
+DISABLE_PAM=host.data.DISABLE_PAM
+
+logger = logging.getLogger(__name__)
+config.SUDO = True
+
+files.line(
+    name='Disable challenge-response authentication in SSH',
+    path='/etc/ssh/sshd_config',
+    line='ChallengeResponseAuthentication yes',
+    replace='ChallengeResponseAuthentication no',
+)
+
+if DISABLE_PASSWORD:
+    files.line(
+        name='Disable password authentication in SSH',
+        path='/etc/ssh/sshd_config',
+        line='PasswordAuthentication yes',
+        replace='PasswordAuthentication no',
+)
+else:
+    logger.info('Password authentication allowed')
+
+if DISABLE_PAM:
+    files.line(
+        name='Disable PAM in SSH',
+        path='/etc/ssh/sshd_config',
+        line='UsePAM yes',
+        replace='UsePAM no',
+    )
+
+# Restart SSH service
+server.service(
+    'ssh', 
+    running=True, 
+    restarted=True, 
+    reloaded=True
+)
@@ -0,0 +1,18 @@
+import { Manifest } from '@bitsquare/nopy-cubes';
+import { z } from 'zod';
+
+export default Manifest({
+  id: 'armor:ssh',
+  name: 'Secure SSH server by disabling password authentication',
+  dependencies: () => [],
+  schema: z.object({
+    DISABLE_PASSWORD: z
+      .boolean()
+      .describe('Disable password authentication for SSH connections')
+      .default(true),
+    DISABLE_PAM: z
+      .boolean()
+      .describe('Disable PAM (Pluggable Authentication Modules) for SSH')
+      .default(true),
+  }),
+});