thaloco/banger
1
Fork 0
Code Pull requests Releases Packages Activity Actions
banger/internal/daemon
History
Thales Maciel 2e6e64bc04
guest sshd: drop DEBUG3 + StrictModes no; normalise /root perms 
Previously /etc/ssh/sshd_config.d/99-banger.conf landed with:

  LogLevel DEBUG3
  PermitRootLogin yes
  PubkeyAuthentication yes
  AuthorizedKeysFile /root/.ssh/authorized_keys
  StrictModes no

DEBUG3 was debug leftover that floods journald in normal use.
StrictModes no was a workaround for /root perm drift on the work
disk — the real fix is to make those perms correct at provisioning
time.

New drop-in:

  PermitRootLogin prohibit-password
  PubkeyAuthentication yes
  PasswordAuthentication no
  KbdInteractiveAuthentication no
  AuthorizedKeysFile /root/.ssh/authorized_keys

prohibit-password blocks password root login even if PasswordAuth
gets flipped on elsewhere; KbdInteractiveAuth no closes the last
interactive fallback; StrictModes is now on (sshd's default).

normaliseHomeDirPerms chown/chmods /root to 0755 root:root at every
work-disk mount (ensureAuthorizedKeyOnWorkDisk,
seedAuthorizedKeyOnExt4Image); the .ssh dir also explicitly
chown'd root:root. Verified end-to-end against a real VM:
`sshd -T` reports strictmodes yes and all five directives match.

Regression test (sshd_config_test.go) pins the allow-list and the
deny-list (DEBUG3, StrictModes no, bare `PermitRootLogin yes`) so
the next accidental reintroduction fails fast.

README's Security section updated to reflect the new posture.
2026-04-19 13:40:40 -03:00
..
dmsnap Extract opstate and dmsnap into subpackages 2026-04-15 16:02:43 -03:00
fcproc Extract fcproc subpackage for firecracker process helpers 2026-04-15 16:11:39 -03:00
imagemgr Remove image build --from-image; doctor treats catalog images as OK 2026-04-18 15:54:29 -03:00
opstate coverage: medium batch — hostnat runner, store guest-sessions, daemon helpers 2026-04-18 18:03:37 -03:00
session coverage: medium batch — hostnat runner, store guest-sessions, daemon helpers 2026-04-18 18:03:37 -03:00
workspace Extract workspace subpackage with pure repo helpers 2026-04-15 16:37:19 -03:00
ARCHITECTURE.md workspace prepare: release VM mutex before guest I/O 2026-04-19 13:32:42 -03:00
autopull_test.go vm create: auto-pull image and kernel from catalogs if missing 2026-04-18 15:10:26 -03:00
capabilities.go Remove opencode package + vm acp command (dead code) 2026-04-18 16:54:37 -03:00
capabilities_test.go Remove opencode package + vm acp command (dead code) 2026-04-18 16:54:37 -03:00
daemon.go workspace prepare: release VM mutex before guest I/O 2026-04-19 13:32:42 -03:00
daemon_test.go Remove image build --from-image; doctor treats catalog images as OK 2026-04-18 15:54:29 -03:00
dashboard.go Serve a local web UI from bangerd 2026-03-21 16:47:47 -03:00
dns_routing.go Route .vm DNS through systemd-resolved 2026-03-22 15:07:22 -03:00
dns_routing_test.go Route .vm DNS through systemd-resolved 2026-03-22 15:07:22 -03:00
doc.go Remove opencode package + vm acp command (dead code) 2026-04-18 16:54:37 -03:00
doctor.go vm defaults: host-aware sizing + spec line on spawn + doctor check 2026-04-19 13:06:51 -03:00
fastpath_test.go Manage image artifacts and show VM create progress 2026-03-21 14:48:01 -03:00
guest_sessions.go Extract workspace subpackage with pure repo helpers 2026-04-15 16:37:19 -03:00
guest_sessions_test.go Extract session subpackage with pure guest-session helpers 2026-04-15 16:33:12 -03:00
image_seed.go guest sshd: drop DEBUG3 + StrictModes no; normalise /root perms 2026-04-19 13:40:40 -03:00
images.go Remove image build --from-image; doctor treats catalog images as OK 2026-04-18 15:54:29 -03:00
images_helpers_test.go coverage: medium batch — hostnat runner, store guest-sessions, daemon helpers 2026-04-18 18:03:37 -03:00
images_pull.go vm create: auto-pull image and kernel from catalogs if missing 2026-04-18 15:10:26 -03:00
images_pull_bundle_test.go image pull: dispatch to imagecat bundle path before OCI 2026-04-17 15:43:33 -03:00
images_pull_test.go Phase B-2: pre-inject banger guest agents into pulled rootfs 2026-04-16 18:08:56 -03:00
kernels.go Phase 4: remote catalog + banger kernel pull 2026-04-16 15:05:42 -03:00
kernels_test.go Phase 4: remote catalog + banger kernel pull 2026-04-16 15:05:42 -03:00
logger.go Speed up VM create with work seeds 2026-03-18 21:22:12 -03:00
logger_test.go Remove image build --from-image; doctor treats catalog images as OK 2026-04-18 15:54:29 -03:00
nat.go Move helper NAT management into Go 2026-03-17 15:07:49 -03:00
nat_test.go Move helper NAT management into Go 2026-03-17 15:07:49 -03:00
ports.go Refine vm ports output 2026-03-19 18:21:04 -03:00
preflight.go Remove image build --from-image; doctor treats catalog images as OK 2026-04-18 15:54:29 -03:00
runtime_assets.go Remove runtime-bundle image dependencies 2026-03-21 18:34:53 -03:00
session_attach.go Extract session subpackage with pure guest-session helpers 2026-04-15 16:33:12 -03:00
session_controller.go Extract session subpackage with pure guest-session helpers 2026-04-15 16:33:12 -03:00
session_lifecycle.go Extract session subpackage with pure guest-session helpers 2026-04-15 16:33:12 -03:00
session_stream.go Extract session subpackage with pure guest-session helpers 2026-04-15 16:33:12 -03:00
snapshot.go Extract opstate and dmsnap into subpackages 2026-04-15 16:02:43 -03:00
snapshot_test.go Harden VM stop cleanup for stale snapshots 2026-03-18 12:28:15 -03:00
ssh_client_config.go Configure direct SSH access for .vm hosts 2026-03-22 16:48:42 -03:00
ssh_client_config_test.go Configure direct SSH access for .vm hosts 2026-03-22 16:48:42 -03:00
sshd_config_test.go guest sshd: drop DEBUG3 + StrictModes no; normalise /root perms 2026-04-19 13:40:40 -03:00
tap_pool.go Move subsystem state/locks off Daemon into owning types 2026-04-15 15:58:33 -03:00
vm.go Extract fcproc subpackage for firecracker process helpers 2026-04-15 16:11:39 -03:00
vm_authsync.go guest sshd: drop DEBUG3 + StrictModes no; normalise /root perms 2026-04-19 13:40:40 -03:00
vm_create.go vm create: auto-pull image and kernel from catalogs if missing 2026-04-18 15:10:26 -03:00
vm_create_ops.go Add lint targets, fix gofmt drift, broaden Makefile build inputs 2026-04-16 16:49:17 -03:00
vm_disk.go guest sshd: drop DEBUG3 + StrictModes no; normalise /root perms 2026-04-19 13:40:40 -03:00
vm_lifecycle.go vm_lifecycle: drop systemd.mask=dev-{ttyS0,vdb}.device 2026-04-18 14:58:42 -03:00
vm_locks.go Move subsystem state/locks off Daemon into owning types 2026-04-15 15:58:33 -03:00
vm_set.go Split internal/daemon vm.go and guest_sessions.go by concern 2026-04-15 15:47:08 -03:00
vm_stats.go Split internal/daemon vm.go and guest_sessions.go by concern 2026-04-15 15:47:08 -03:00
vm_test.go guest sshd: drop DEBUG3 + StrictModes no; normalise /root perms 2026-04-19 13:40:40 -03:00
web.go Serve a local web UI from bangerd 2026-03-21 16:47:47 -03:00
workspace.go workspace prepare: release VM mutex before guest I/O 2026-04-19 13:32:42 -03:00
workspace_test.go workspace prepare: release VM mutex before guest I/O 2026-04-19 13:32:42 -03:00