[PR #102] [MERGED] SSH hardening safety nets #99

New issue

Closed

opened 2026-03-02 02:59:49 +03:00 by kerem · 0 comments

kerem commented

2026-03-02 02:59:49 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/buildplan/du_setup/pull/102
Author: @buildplan
Created: 2/28/2026
Status: ✅ Merged
Merged: 2/28/2026
Merged by: @buildplan

Base: main ← Head: dev

📝 Commits (9)

27ded15 feat(confirm): add optional timeout for confirmation prompts
4a8670b feat(ssh): update version to 0.80.1 and add SSH key improvements
135462c feat(ssh): enhance SSH port detection to include socket and exclude specific ports
b1bf089 feat(ssh): SSH port configuration and hardening in single drop-in files
10416b2 feat(ssh): update SSH socket configuration to bind to both IPv4 and IPv6 addresses
46eae38 prompt formatting
4066654 feat(port-validation): enhance port validation
2adb555 checksum for v0.80.1
3a38d69 chore: update version and checksum

📊 Changes

3 files changed (+172 additions, -133 deletions)

View changed files

📝 README.md (+4 -4)
📝 du_setup.sh (+167 -128)
📝 du_setup.sh.sha256 (+1 -1)

📄 Description

Fallback protections suggested in #100 to prevent accidental lockouts.

Connection timeout: Added a 5-minute timeout to the SSH and 2FA connection tests so they auto-revert if the user's session drops.

Existing user key validation: The script now strictly requires existing users to provide or generate a valid SSH key before disabling password auth.

Config lexical ordering: Renamed the SSH drop-in to 10-hardening.conf so our hardening rules evaluate before provider defaults (like cloud-init).

Fixed an issue where roll-back only binds to IPv6 if a system has IPv6 enabled.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/buildplan/du_setup/pull/102 **Author:** [@buildplan](https://github.com/buildplan) **Created:** 2/28/2026 **Status:** ✅ Merged **Merged:** 2/28/2026 **Merged by:** [@buildplan](https://github.com/buildplan) **Base:** `main` ← **Head:** `dev` --- ### 📝 Commits (9) - [`27ded15`](https://github.com/buildplan/du_setup/commit/27ded15e21f4921af47f6b542c4e4fd200d1124a) feat(confirm): add optional timeout for confirmation prompts - [`4a8670b`](https://github.com/buildplan/du_setup/commit/4a8670b2e69ff4b7f190394d5c210fc417dc046b) feat(ssh): update version to 0.80.1 and add SSH key improvements - [`135462c`](https://github.com/buildplan/du_setup/commit/135462c95b8e5e7835769710902ebf8ab21dc57c) feat(ssh): enhance SSH port detection to include socket and exclude specific ports - [`b1bf089`](https://github.com/buildplan/du_setup/commit/b1bf0899837cb8a3e344417f7c7e206068ae8dca) feat(ssh): SSH port configuration and hardening in single drop-in files - [`10416b2`](https://github.com/buildplan/du_setup/commit/10416b2d948232f729944c3d9db01d4c5d9e4c0b) feat(ssh): update SSH socket configuration to bind to both IPv4 and IPv6 addresses - [`46eae38`](https://github.com/buildplan/du_setup/commit/46eae38bbab429b3701d6b8b91c5194595a333ea) prompt formatting - [`4066654`](https://github.com/buildplan/du_setup/commit/4066654037cea3ec4d78ba1a53a5acacf8a6cc52) feat(port-validation): enhance port validation - [`2adb555`](https://github.com/buildplan/du_setup/commit/2adb555859dcdbb8ebff0846b20e81023a87fd8d) checksum for v0.80.1 - [`3a38d69`](https://github.com/buildplan/du_setup/commit/3a38d6908bd8a0412f0aa9b926cd7c989e723928) chore: update version and checksum ### 📊 Changes **3 files changed** (+172 additions, -133 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+4 -4) 📝 `du_setup.sh` (+167 -128) 📝 `du_setup.sh.sha256` (+1 -1) </details> ### 📄 Description Fallback protections suggested in #100 to prevent accidental lockouts. Connection timeout: Added a 5-minute timeout to the SSH and 2FA connection tests so they auto-revert if the user's session drops. Existing user key validation: The script now strictly requires existing users to provide or generate a valid SSH key before disabling password auth. Config lexical ordering: Renamed the SSH drop-in to 10-hardening.conf so our hardening rules evaluate before provider defaults (like cloud-init). Fixed an issue where roll-back only binds to IPv6 if a system has IPv6 enabled. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>