[PR #55] [MERGED] Fix: Improve robustness and safety of SSH hardening #59

New issue

Closed

opened 2026-03-02 02:59:35 +03:00 by kerem · 0 comments

kerem commented

2026-03-02 02:59:35 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/buildplan/du_setup/pull/55
Author: @buildplan
Created: 10/13/2025
Status: ✅ Merged
Merged: 10/13/2025
Merged by: @buildplan

Base: main ← Head: ownership_fix

📝 Commits (6)

98e26e6 fix ssh permissions error for new user
1f3932d Fix variable name for log file in SSH test
d12d50d Add backup for original SSH config
e1bef0b Refactor SSH service checks and error handling
a431785 Remove trap - ERR statements for error handling
6768913 sha256 for v0.69

📊 Changes

2 files changed (+37 additions, -15 deletions)

View changed files

📝 du_setup.sh (+36 -14)
📝 du_setup.sh.sha256 (+1 -1)

📄 Description

This PR addresses a critical bug where the script would fail during SSH hardening on a fresh install (e.g., Debian 13) if a new user was created without providing a local SSH key.

The primary issue was a Permission denied error during ssh-keygen, which was caused by incorrect directory ownership. This failure also exposed a secondary bug where the rollback mechanism would fail because the configuration backup had not yet been created.

Key Changes:

Fix ssh-keygen Failure: Correctly sets chown on the new user's .ssh directory before ssh-keygen is run, resolving the permission error.
Ensure Reliable Rollbacks: Moves the sshd_config backup to the beginning of the configure_ssh function. This guarantees the error trap and rollback mechanism are always reliable.
Add Proactive Syntax Check: Implements an sshd -t check to validate the new SSH configuration before restarting the service, preventing accidental lockouts.
Improve Cleanup Logic: The cleanup process for an aborted syntax check is now more comprehensive, removing any systemd override files that were created.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/buildplan/du_setup/pull/55 **Author:** [@buildplan](https://github.com/buildplan) **Created:** 10/13/2025 **Status:** ✅ Merged **Merged:** 10/13/2025 **Merged by:** [@buildplan](https://github.com/buildplan) **Base:** `main` ← **Head:** `ownership_fix` --- ### 📝 Commits (6) - [`98e26e6`](https://github.com/buildplan/du_setup/commit/98e26e612d3ff99eb7f155d1a7372b8ba54eb2fe) fix ssh permissions error for new user - [`1f3932d`](https://github.com/buildplan/du_setup/commit/1f3932d1e284d8be827253d53b27580ec874d675) Fix variable name for log file in SSH test - [`d12d50d`](https://github.com/buildplan/du_setup/commit/d12d50d5be471e4c97b1e7101f995e6ed1457413) Add backup for original SSH config - [`e1bef0b`](https://github.com/buildplan/du_setup/commit/e1bef0b150b20efd6758d49dd7fa7156221cf699) Refactor SSH service checks and error handling - [`a431785`](https://github.com/buildplan/du_setup/commit/a431785ed6b362d66694ef451e970ff749307f82) Remove trap - ERR statements for error handling - [`6768913`](https://github.com/buildplan/du_setup/commit/67689136a9de16e987243a1e9d327ee0362835a9) sha256 for v0.69 ### 📊 Changes **2 files changed** (+37 additions, -15 deletions) <details> <summary>View changed files</summary> 📝 `du_setup.sh` (+36 -14) 📝 `du_setup.sh.sha256` (+1 -1) </details> ### 📄 Description This PR addresses a critical bug where the script would fail during SSH hardening on a fresh install (e.g., Debian 13) if a new user was created without providing a local SSH key. The primary issue was a `Permission denied` error during `ssh-keygen`, which was caused by incorrect directory ownership. This failure also exposed a secondary bug where the rollback mechanism would fail because the configuration backup had not yet been created. ### Key Changes: - **Fix `ssh-keygen` Failure:** Correctly sets `chown` on the new user's `.ssh` directory *before* `ssh-keygen` is run, resolving the permission error. - **Ensure Reliable Rollbacks:** Moves the `sshd_config` backup to the beginning of the `configure_ssh` function. This guarantees the error trap and rollback mechanism are always reliable. - **Add Proactive Syntax Check:** Implements an `sshd -t` check to validate the new SSH configuration *before* restarting the service, preventing accidental lockouts. - **Improve Cleanup Logic:** The cleanup process for an aborted syntax check is now more comprehensive, removing any systemd override files that were created. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>