Archived
This commit is contained in:
@@ -0,0 +1,133 @@
|
||||
#!/bin/bash
|
||||
# Read-only Stage 1 base-hardening audit. Checks the current state of a PVE
|
||||
# host against the checklist in docs/04-security-hardening.md and prints
|
||||
# PASS/FAIL per item. Exits non-zero if anything fails, so it can gate CI or
|
||||
# be run periodically as a compliance check. Makes no changes.
|
||||
#
|
||||
# Usage: ./audit.sh (run as root on the PVE host)
|
||||
set -uo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
AUDIT_FAIL=0
|
||||
|
||||
# --- apt repos: no enabled enterprise source ---
|
||||
ENTERPRISE_ENABLED=0
|
||||
for f in /etc/apt/sources.list.d/*.sources /etc/apt/sources.list.d/*.list; do
|
||||
[ -f "$f" ] || continue
|
||||
grep -qi 'enterprise.proxmox.com' "$f" 2>/dev/null && ENTERPRISE_ENABLED=1
|
||||
done
|
||||
if [ "$ENTERPRISE_ENABLED" -eq 0 ]; then
|
||||
audit_pass "no enabled enterprise apt repo"
|
||||
else
|
||||
audit_fail "an enterprise apt repo is still enabled (needs a subscription to update)"
|
||||
fi
|
||||
|
||||
# --- SSH ---
|
||||
SSHD_T="$(sshd -T 2>/dev/null)"
|
||||
if echo "$SSHD_T" | grep -qiE '^permitrootlogin (prohibit-password|without-password)'; then
|
||||
audit_pass "sshd: PermitRootLogin prohibit-password (key-only)"
|
||||
else
|
||||
audit_fail "sshd: PermitRootLogin is not key-only (prohibit-password/without-password)"
|
||||
fi
|
||||
if echo "$SSHD_T" | grep -qi '^passwordauthentication no'; then
|
||||
audit_pass "sshd: PasswordAuthentication no"
|
||||
else
|
||||
audit_fail "sshd: PasswordAuthentication is not disabled"
|
||||
fi
|
||||
|
||||
# --- fail2ban ---
|
||||
if systemctl is-active --quiet fail2ban 2>/dev/null; then
|
||||
audit_pass "fail2ban is active"
|
||||
else
|
||||
audit_fail "fail2ban is not active"
|
||||
fi
|
||||
|
||||
# --- PVE firewall ---
|
||||
FW_STATUS="$(pve-firewall status 2>/dev/null || true)"
|
||||
if echo "$FW_STATUS" | grep -qi '^Status: enabled'; then
|
||||
audit_pass "pve-firewall is enabled"
|
||||
else
|
||||
audit_fail "pve-firewall is not enabled (status: ${FW_STATUS:-unknown})"
|
||||
fi
|
||||
if [ -f /etc/pve/firewall/cluster.fw ] && grep -qi '^policy_in:\s*DROP' /etc/pve/firewall/cluster.fw 2>/dev/null; then
|
||||
audit_pass "cluster.fw has default-deny inbound policy"
|
||||
else
|
||||
audit_fail "cluster.fw missing or does not default-deny inbound"
|
||||
fi
|
||||
|
||||
# --- unattended-upgrades ---
|
||||
if dpkg -s unattended-upgrades >/dev/null 2>&1 && systemctl is-enabled --quiet unattended-upgrades 2>/dev/null; then
|
||||
audit_pass "unattended-upgrades installed and enabled"
|
||||
else
|
||||
audit_fail "unattended-upgrades not installed/enabled"
|
||||
fi
|
||||
if [ -f /var/run/reboot-required ]; then
|
||||
audit_warn "a reboot is pending (/var/run/reboot-required) - schedule one"
|
||||
fi
|
||||
|
||||
# --- Linux admin user with SSH key (for non-root SSH login) ---
|
||||
LINUX_ADMIN_OK=0
|
||||
for auth_file in /home/*/.ssh/authorized_keys; do
|
||||
[ -f "$auth_file" ] || continue
|
||||
# Must have at least one non-comment, non-empty key line.
|
||||
if grep -qE '^(ssh-rsa|ssh-ed25519|ecdsa-sha2-nistp[0-9]+) ' "$auth_file" 2>/dev/null; then
|
||||
LINUX_ADMIN_OK=1
|
||||
break
|
||||
fi
|
||||
done
|
||||
if [ "$LINUX_ADMIN_OK" -eq 1 ]; then
|
||||
audit_pass "a non-root Linux user has an SSH authorized key"
|
||||
else
|
||||
audit_fail "no non-root Linux user has an authorized SSH key (run setup-linux-admin-user.sh)"
|
||||
fi
|
||||
|
||||
# --- named admin user (not just root@pam) ---
|
||||
if pveum user list --output-format json 2>/dev/null | grep -q '"userid":"[^"]*@pve"'; then
|
||||
audit_pass "a named @pve admin user exists (root@pam is not the only account)"
|
||||
else
|
||||
audit_fail "no named @pve user found - root@pam is the only account"
|
||||
fi
|
||||
|
||||
# --- passwordless sudo for pvesh/qm/pct ---
|
||||
# The nixos flake's create-proxmox-resource.sh runs pvesh/qm/pct over
|
||||
# non-interactive SSH, so the admin user needs NOPASSWD for these tools.
|
||||
SUDO_OK=0
|
||||
for f in /etc/sudoers.d/*-proxmox; do
|
||||
[ -f "$f" ] || continue
|
||||
if grep -qE 'NOPASSWD:.*pvesh' "$f" && grep -qE 'NOPASSWD:.*\bqm\b' "$f" && grep -qE 'NOPASSWD:.*\bpct\b' "$f"; then
|
||||
SUDO_OK=1
|
||||
break
|
||||
fi
|
||||
done
|
||||
if [ "$SUDO_OK" -eq 1 ]; then
|
||||
audit_pass "admin user has NOPASSWD sudo for pvesh/qm/pct"
|
||||
else
|
||||
audit_fail "no sudoers file grants NOPASSWD for pvesh/qm/pct (run setup-admin-sudo.sh <username>)"
|
||||
fi
|
||||
|
||||
# --- time sync ---
|
||||
if timedatectl show -p NTPSynchronized --value 2>/dev/null | grep -qx 'yes'; then
|
||||
audit_pass "clock is NTP-synchronized"
|
||||
else
|
||||
audit_fail "clock is not NTP-synchronized"
|
||||
fi
|
||||
|
||||
# --- subscription nag (cosmetic - warn only, never fails the audit) ---
|
||||
JS_FILE="/usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js"
|
||||
if [ -f "$JS_FILE" ] && ! grep -qF "data.status.toLowerCase() !== 'active'" "$JS_FILE"; then
|
||||
audit_pass "subscription nag patch applied"
|
||||
else
|
||||
audit_warn "subscription nag patch not applied (cosmetic only, see scripts/disable-subscription-nag.sh)"
|
||||
fi
|
||||
|
||||
echo
|
||||
if [ "$AUDIT_FAIL" -eq 0 ]; then
|
||||
echo "All Stage 1 base-hardening checks passed."
|
||||
else
|
||||
echo "One or more checks failed - see FAIL lines above."
|
||||
fi
|
||||
exit "$AUDIT_FAIL"
|
||||
@@ -0,0 +1,67 @@
|
||||
#!/bin/bash
|
||||
# Stage 1 base config + hardening, end to end, for a single fresh PVE host.
|
||||
# Runs the individual scripts in order. Idempotent - safe to re-run.
|
||||
#
|
||||
# If ADMIN_USER and ADMIN_SSH_KEY are set, a Linux system user is created
|
||||
# with SSH key access and sudo before SSH hardening runs - so key-based
|
||||
# login is in place before password auth is disabled. If they are not set,
|
||||
# a reminder is printed at the end to run setup-linux-admin-user.sh manually
|
||||
# (but do this BEFORE disconnecting, since password auth will be disabled).
|
||||
#
|
||||
# Usage:
|
||||
# MGMT_CIDR=192.168.2.0/24 ./bootstrap.sh
|
||||
# MGMT_CIDR=192.168.2.0/24 ADMIN_USER=wayne ADMIN_SSH_KEY="ssh-ed25519 ..." ./bootstrap.sh
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
if [ -z "${MGMT_CIDR:-}" ]; then
|
||||
echo "MGMT_CIDR is not set. Example: MGMT_CIDR=192.168.2.0/24 $0" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
STEP=0
|
||||
next_step() { STEP=$((STEP + 1)); echo; echo "=== ${STEP}: $* ==="; }
|
||||
|
||||
next_step "remove enterprise repos, switch to no-subscription"
|
||||
"${SCRIPT_DIR}/switch-to-no-subscription-repo.sh"
|
||||
|
||||
# Create the Linux admin user before SSH hardening so that authorized_keys
|
||||
# is in place before password auth is disabled.
|
||||
if [ -n "${ADMIN_USER:-}" ] && [ -n "${ADMIN_SSH_KEY:-}" ]; then
|
||||
next_step "Linux admin user '${ADMIN_USER}' + SSH key + sudo group"
|
||||
"${SCRIPT_DIR}/setup-linux-admin-user.sh" "$ADMIN_USER" "$ADMIN_SSH_KEY"
|
||||
|
||||
next_step "passwordless sudo for pvesh/qm/pct (${ADMIN_USER})"
|
||||
"${SCRIPT_DIR}/setup-admin-sudo.sh" "$ADMIN_USER"
|
||||
else
|
||||
echo
|
||||
echo "WARNING: ADMIN_USER / ADMIN_SSH_KEY not set -- skipping Linux user setup."
|
||||
echo " Run setup-linux-admin-user.sh and setup-admin-sudo.sh BEFORE disconnecting"
|
||||
echo " from this session, since the next step disables password authentication."
|
||||
fi
|
||||
|
||||
next_step "SSH hardening (key-only root login + fail2ban)"
|
||||
"${SCRIPT_DIR}/harden-ssh.sh"
|
||||
|
||||
next_step "unattended security upgrades"
|
||||
"${SCRIPT_DIR}/setup-unattended-upgrades.sh"
|
||||
|
||||
next_step "PVE firewall (mgmt-only SSH/8006)"
|
||||
MGMT_CIDR="$MGMT_CIDR" "${SCRIPT_DIR}/deploy-firewall.sh"
|
||||
|
||||
next_step "disable subscription nag (cosmetic)"
|
||||
"${SCRIPT_DIR}/disable-subscription-nag.sh"
|
||||
|
||||
echo
|
||||
echo "=== Base hardening applied. Remaining manual/deliberate steps: ==="
|
||||
if [ -z "${ADMIN_USER:-}" ]; then
|
||||
echo " - ${SCRIPT_DIR}/setup-linux-admin-user.sh <username> <ssh-pubkey>"
|
||||
echo " - ${SCRIPT_DIR}/setup-admin-sudo.sh <username> (NOPASSWD for pvesh/qm/pct)"
|
||||
fi
|
||||
echo " - ${SCRIPT_DIR}/create-admin-user.sh <username> (PVE web UI account)"
|
||||
echo " - Enable 2FA/TOTP for that user and root@pam via the web UI"
|
||||
echo " - ${SCRIPT_DIR}/audit.sh (verify everything above)"
|
||||
@@ -0,0 +1,43 @@
|
||||
#!/bin/bash
|
||||
# Create a named PVE admin user (Administrator role) so root@pam can be
|
||||
# reserved for emergencies. Generates a random initial password, printed
|
||||
# once - change it and enable TOTP on first login (Datacenter -> Permissions
|
||||
# -> Two Factor, or the user icon menu in the top right).
|
||||
#
|
||||
# Idempotent - if the user already exists, does nothing (won't reset an
|
||||
# existing password). Run as root on the PVE host.
|
||||
#
|
||||
# Usage: ./create-admin-user.sh <username> (realm is always @pve)
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
USERNAME="${1:-}"
|
||||
if [ -z "$USERNAME" ]; then
|
||||
echo "Usage: $0 <username>" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
USERID="${USERNAME}@pve"
|
||||
|
||||
if pveum user list --output-format json 2>/dev/null | grep -q "\"${USERID}\""; then
|
||||
echo "${USERID} already exists - not touching password or role. Skipping."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
PASSWORD="$(openssl rand -base64 24)"
|
||||
|
||||
pveum user add "$USERID" --password "$PASSWORD" --comment "Named admin account, created by create-admin-user.sh"
|
||||
pveum acl modify / --users "$USERID" --roles Administrator
|
||||
|
||||
echo
|
||||
echo "Created ${USERID} with the Administrator role."
|
||||
echo "Initial password (shown once - not logged anywhere): ${PASSWORD}"
|
||||
echo
|
||||
echo "Next steps (do these before relying on this account):"
|
||||
echo " 1. Log in as ${USERID} and change the password."
|
||||
echo " 2. Enable TOTP/2FA for ${USERID} (and for root@pam)."
|
||||
echo " 3. Reserve root@pam for emergencies only from here on."
|
||||
@@ -0,0 +1,48 @@
|
||||
#!/bin/bash
|
||||
# Deploy the Proxmox datacenter-level firewall from
|
||||
# config/pve-firewall/cluster.fw.example, with the management CIDR filled
|
||||
# in, and enable it. Default-deny inbound; allow SSH/8006 from mgmt only.
|
||||
#
|
||||
# Idempotent - safe to re-run. Run as root on the PVE host.
|
||||
#
|
||||
# Usage: MGMT_CIDR=192.168.2.0/24 ./deploy-firewall.sh
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
if [ -z "${MGMT_CIDR:-}" ]; then
|
||||
echo "MGMT_CIDR is not set. Example: MGMT_CIDR=192.168.2.0/24 $0" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! [[ "$MGMT_CIDR" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$ ]]; then
|
||||
echo "MGMT_CIDR '${MGMT_CIDR}' doesn't look like a CIDR (e.g. 192.168.2.0/24)." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
TEMPLATE="${SCRIPT_DIR}/../config/pve-firewall/cluster.fw.example"
|
||||
if [ ! -f "$TEMPLATE" ]; then
|
||||
echo "Template not found: $TEMPLATE" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Corosync/Ceph rules stay commented placeholders until Stage 2 (cluster);
|
||||
# only the mgmt IPSET is real for a single Stage 1 node.
|
||||
mkdir -p /etc/pve/firewall
|
||||
write_if_changed "/etc/pve/firewall/cluster.fw" "$(sed "s|<MGMT_CIDR>|${MGMT_CIDR}|" "$TEMPLATE")"
|
||||
|
||||
echo "Validating ruleset..."
|
||||
pve-firewall compile
|
||||
|
||||
echo "Restarting pve-firewall..."
|
||||
pve-firewall restart
|
||||
sleep 1
|
||||
pve-firewall status
|
||||
|
||||
echo
|
||||
echo "Firewall enabled. SSH (22) and the web UI (8006) are now only reachable"
|
||||
echo "from ${MGMT_CIDR}. If your current SSH session is NOT from that range,"
|
||||
echo "reconnect and verify access before closing this session."
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
#!/bin/bash
|
||||
# Install the subscription-nag patch (lib/nag-patch.sh) as a persistent
|
||||
# standalone script under /usr/local/sbin, plus an apt Post-Invoke hook that
|
||||
# re-applies it after every dpkg run - a proxmox-widget-toolkit package
|
||||
# upgrade overwrites the patched file, so without the hook the patch would
|
||||
# silently revert on the next `apt upgrade`.
|
||||
#
|
||||
# Idempotent - safe to re-run. Run as root on the PVE host.
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
INSTALLED="/usr/local/sbin/pve-disable-subscription-nag.sh"
|
||||
write_if_changed "$INSTALLED" "$(cat "${SCRIPT_DIR}/lib/nag-patch.sh")"
|
||||
chmod +x "$INSTALLED"
|
||||
|
||||
HOOK="/etc/apt/apt.conf.d/85pve-nosubnag"
|
||||
write_if_changed "$HOOK" 'DPkg::Post-Invoke { "test -x /usr/local/sbin/pve-disable-subscription-nag.sh && /usr/local/sbin/pve-disable-subscription-nag.sh || true"; };'
|
||||
|
||||
"$INSTALLED"
|
||||
echo "Subscription nag patch installed; will reapply automatically after updates."
|
||||
@@ -0,0 +1,43 @@
|
||||
#!/bin/bash
|
||||
# Apply baseline SSH hardening to a Proxmox VE node: key-only root login
|
||||
# + fail2ban. Idempotent - safe to re-run. Run as root on the PVE host.
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
if ! authorized_keys_present=$(find /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys -type f 2>/dev/null | head -n1); then
|
||||
authorized_keys_present=""
|
||||
fi
|
||||
if [ -z "$authorized_keys_present" ]; then
|
||||
echo "WARNING: no authorized_keys found for any user yet." >&2
|
||||
echo "Add your SSH public key before disconnecting, or you'll lock yourself out." >&2
|
||||
fi
|
||||
|
||||
mkdir -p /etc/ssh/sshd_config.d
|
||||
write_if_changed "/etc/ssh/sshd_config.d/99-hardening.conf" "PermitRootLogin prohibit-password
|
||||
PasswordAuthentication no"
|
||||
|
||||
sshd -t
|
||||
systemctl reload sshd
|
||||
echo "sshd reloaded with key-only root login."
|
||||
|
||||
if ! dpkg -s fail2ban >/dev/null 2>&1; then
|
||||
apt-get update
|
||||
apt-get install -y fail2ban
|
||||
fi
|
||||
|
||||
mkdir -p /etc/fail2ban/jail.d
|
||||
write_if_changed "/etc/fail2ban/jail.d/sshd.local" "[sshd]
|
||||
enabled = true
|
||||
port = ssh
|
||||
backend = systemd
|
||||
maxretry = 5
|
||||
bantime = 1h
|
||||
findtime = 10m"
|
||||
|
||||
systemctl enable --now fail2ban
|
||||
systemctl restart fail2ban
|
||||
echo "fail2ban enabled for sshd."
|
||||
@@ -0,0 +1,47 @@
|
||||
#!/bin/bash
|
||||
# Shared helpers for proxmox-configuration scripts. Sourced, not executed
|
||||
# directly:
|
||||
# SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# source "${SCRIPT_DIR}/lib/common.sh"
|
||||
|
||||
require_root() {
|
||||
if [ "$(id -u)" -ne 0 ]; then
|
||||
echo "Must run as root." >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Codename of the running Debian/PVE release, e.g. "trixie".
|
||||
pve_codename() {
|
||||
(. /etc/os-release && echo "$VERSION_CODENAME")
|
||||
}
|
||||
|
||||
# backup_file <path>
|
||||
# Copies an existing file to <path>.bak.<epoch>. No-op if it doesn't exist.
|
||||
backup_file() {
|
||||
local path="$1"
|
||||
if [ -f "$path" ]; then
|
||||
cp "$path" "${path}.bak.$(date +%s)"
|
||||
echo "Backed up ${path}"
|
||||
fi
|
||||
}
|
||||
|
||||
# write_if_changed <path> <content>
|
||||
# Writes content to path only if it differs from what's already there,
|
||||
# backing up the previous version first. Prints what happened.
|
||||
write_if_changed() {
|
||||
local path="$1" content="$2"
|
||||
if [ -f "$path" ] && [ "$(cat "$path")" = "$content" ]; then
|
||||
echo "Already up to date: $path"
|
||||
return 0
|
||||
fi
|
||||
backup_file "$path"
|
||||
printf '%s\n' "$content" > "$path"
|
||||
echo "Wrote $path"
|
||||
}
|
||||
|
||||
# --- audit.sh status helpers ---
|
||||
# Callers should initialize: AUDIT_FAIL=0
|
||||
audit_pass() { echo "PASS $1"; }
|
||||
audit_fail() { echo "FAIL $1"; AUDIT_FAIL=1; }
|
||||
audit_warn() { echo "WARN $1"; }
|
||||
@@ -0,0 +1,22 @@
|
||||
#!/bin/bash
|
||||
# Neutralizes the Proxmox "No valid subscription" nag (login popup and the
|
||||
# dashboard subscription indicator) by patching proxmox-widget-toolkit's
|
||||
# proxmoxlib.js. Cosmetic only - doesn't create or spoof a subscription
|
||||
# anywhere except this UI check.
|
||||
#
|
||||
# This file is not run from the repo directly - disable-subscription-nag.sh
|
||||
# installs a copy of it to /usr/local/sbin and wires it into an apt
|
||||
# Post-Invoke hook, because a proxmox-widget-toolkit package upgrade
|
||||
# overwrites proxmoxlib.js and reverts the patch. Idempotent: exits quietly
|
||||
# if already patched or if the file isn't present.
|
||||
set -euo pipefail
|
||||
|
||||
JS_FILE="/usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js"
|
||||
[ -f "$JS_FILE" ] || exit 0
|
||||
|
||||
PATTERN="data.status.toLowerCase() !== 'active'"
|
||||
grep -qF "$PATTERN" "$JS_FILE" || exit 0
|
||||
|
||||
cp "$JS_FILE" "${JS_FILE}.bak.$(date +%s)"
|
||||
sed -i "s/${PATTERN}/false/g" "$JS_FILE"
|
||||
echo "Patched subscription nag in $JS_FILE"
|
||||
@@ -0,0 +1,61 @@
|
||||
#!/bin/bash
|
||||
# Grant a named admin user passwordless sudo for Proxmox management tools
|
||||
# (pvesh, qm, pct) and the Nix package manager so that scripts in the
|
||||
# nixos flake repo can run these over non-interactive SSH without a TTY.
|
||||
#
|
||||
# Nix is included because single-user Nix installations (common on PVE
|
||||
# hosts bootstrapped via codex-setup.sh) are owned by root; non-root
|
||||
# users can't touch the Nix store lock without sudo.
|
||||
#
|
||||
# Idempotent - safe to re-run (rewrites if paths have changed). Run as
|
||||
# root on the PVE host.
|
||||
#
|
||||
# Usage: ./setup-admin-sudo.sh <username>
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
USERNAME="${1:-}"
|
||||
if [ -z "$USERNAME" ]; then
|
||||
echo "Usage: $0 <username>" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Resolve actual binary paths at script time -- they differ across Proxmox
|
||||
# versions (pvesh moved from /usr/sbin to /usr/bin in PVE 8.x) and the
|
||||
# sudoers rule must match the real path or sudo will fall back to
|
||||
# prompting for a password.
|
||||
resolve_bin() {
|
||||
command -v "$1" 2>/dev/null || { echo "ERROR: $1 not found on PATH" >&2; exit 1; }
|
||||
}
|
||||
|
||||
PVESH="$(resolve_bin pvesh)"
|
||||
QM="$(resolve_bin qm)"
|
||||
PCT="$(resolve_bin pct)"
|
||||
# Nix installs to a fixed path regardless of which user bootstrapped it.
|
||||
NIX_BIN="/nix/var/nix/profiles/default/bin/nix"
|
||||
if [ ! -x "$NIX_BIN" ]; then
|
||||
echo "WARNING: $NIX_BIN not found -- Nix may not be installed yet." >&2
|
||||
echo " Re-run this script after running codex-setup.sh on the node." >&2
|
||||
NIX_BIN=""
|
||||
fi
|
||||
|
||||
SUDOERS_FILE="/etc/sudoers.d/${USERNAME}-proxmox"
|
||||
NIX_ENTRY="${NIX_BIN:+, ${NIX_BIN}}"
|
||||
CONTENT="${USERNAME} ALL=(root) NOPASSWD: ${PVESH}, ${QM}, ${PCT}${NIX_ENTRY}"
|
||||
|
||||
write_if_changed "$SUDOERS_FILE" "$CONTENT"
|
||||
|
||||
# visudo -c validates the file we just wrote before we walk away.
|
||||
if visudo -c -f "$SUDOERS_FILE" >/dev/null 2>&1; then
|
||||
chmod 0440 "$SUDOERS_FILE"
|
||||
echo "Sudoers rule for ${USERNAME} is valid and in place."
|
||||
echo " ${CONTENT}"
|
||||
else
|
||||
echo "ERROR: sudoers validation failed -- removing bad file." >&2
|
||||
rm -f "$SUDOERS_FILE"
|
||||
exit 1
|
||||
fi
|
||||
+82
@@ -0,0 +1,82 @@
|
||||
#!/bin/bash
|
||||
# Create a Linux system user for SSH access and sudo, and install their
|
||||
# authorized SSH public key. Run this before harden-ssh.sh so that
|
||||
# key-based access is in place before password authentication is disabled.
|
||||
#
|
||||
# Idempotent - safe to re-run. Run as root on the PVE host.
|
||||
#
|
||||
# Usage:
|
||||
# ./setup-linux-admin-user.sh <username> <ssh-public-key>
|
||||
# ./setup-linux-admin-user.sh <username> --key-file <path-to-.pub>
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
USERNAME="${1:-}"
|
||||
if [ -z "$USERNAME" ]; then
|
||||
echo "Usage: $0 <username> <ssh-public-key>" >&2
|
||||
echo " $0 <username> --key-file <path-to-.pub>" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
shift
|
||||
SSH_KEY=""
|
||||
if [ "${1:-}" = "--key-file" ]; then
|
||||
KEY_FILE="${2:-}"
|
||||
[ -z "$KEY_FILE" ] && { echo "ERROR: --key-file requires a path." >&2; exit 1; }
|
||||
[ -f "$KEY_FILE" ] || { echo "ERROR: key file not found: $KEY_FILE" >&2; exit 1; }
|
||||
SSH_KEY="$(cat "$KEY_FILE")"
|
||||
else
|
||||
SSH_KEY="${1:-}"
|
||||
fi
|
||||
|
||||
if [ -z "$SSH_KEY" ]; then
|
||||
echo "ERROR: an SSH public key is required (key string or --key-file <path>)." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! echo "$SSH_KEY" | grep -qE '^(ssh-rsa|ssh-ed25519|ecdsa-sha2-nistp[0-9]+) [A-Za-z0-9+/=]'; then
|
||||
echo "ERROR: argument doesn't look like a valid SSH public key." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# --- create Linux user if missing ---
|
||||
if id "$USERNAME" >/dev/null 2>&1; then
|
||||
echo "User '${USERNAME}' already exists - skipping useradd."
|
||||
else
|
||||
useradd --create-home --shell /bin/bash "$USERNAME"
|
||||
echo "Created Linux user '${USERNAME}'."
|
||||
fi
|
||||
|
||||
# --- sudo group membership ---
|
||||
if id -nG "$USERNAME" | grep -qw sudo; then
|
||||
echo "User '${USERNAME}' is already in the sudo group."
|
||||
else
|
||||
usermod --append --groups sudo "$USERNAME"
|
||||
echo "Added '${USERNAME}' to the sudo group."
|
||||
fi
|
||||
|
||||
# --- install authorized SSH key ---
|
||||
HOME_DIR="$(getent passwd "$USERNAME" | cut -d: -f6)"
|
||||
SSH_DIR="${HOME_DIR}/.ssh"
|
||||
AUTH_FILE="${SSH_DIR}/authorized_keys"
|
||||
|
||||
mkdir -p "$SSH_DIR"
|
||||
chmod 700 "$SSH_DIR"
|
||||
touch "$AUTH_FILE"
|
||||
chmod 600 "$AUTH_FILE"
|
||||
chown -R "${USERNAME}:${USERNAME}" "$SSH_DIR"
|
||||
|
||||
if grep -qF "$SSH_KEY" "$AUTH_FILE" 2>/dev/null; then
|
||||
echo "SSH key is already present in ${AUTH_FILE}."
|
||||
else
|
||||
echo "$SSH_KEY" >> "$AUTH_FILE"
|
||||
echo "Installed SSH key in ${AUTH_FILE}."
|
||||
fi
|
||||
|
||||
echo
|
||||
echo "Linux user '${USERNAME}' is ready for SSH key-based login with sudo access."
|
||||
echo "Next: run setup-admin-sudo.sh ${USERNAME} to grant NOPASSWD for pvesh/qm/pct."
|
||||
+46
@@ -0,0 +1,46 @@
|
||||
#!/bin/bash
|
||||
# Install and configure unattended-upgrades for security patches. Deliberately
|
||||
# conservative for a hypervisor: security-only origins (Debian security +
|
||||
# the active PVE repo), no automatic reboot ever - a flag file is left at
|
||||
# /var/run/reboot-required for you to act on manually.
|
||||
#
|
||||
# Idempotent - safe to re-run. Run as root on the PVE host.
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
if ! dpkg -s unattended-upgrades >/dev/null 2>&1; then
|
||||
apt-get update
|
||||
apt-get install -y unattended-upgrades
|
||||
fi
|
||||
|
||||
CODENAME="$(pve_codename)"
|
||||
|
||||
write_if_changed "/etc/apt/apt.conf.d/51pve-unattended-upgrades.conf" "// Managed by proxmox-configuration/scripts/setup-unattended-upgrades.sh
|
||||
Unattended-Upgrade::Origins-Pattern {
|
||||
\"origin=Debian,codename=${CODENAME},label=Debian-Security\";
|
||||
\"origin=Debian,codename=${CODENAME}-security,label=Debian-Security\";
|
||||
\"origin=Proxmox\";
|
||||
};
|
||||
|
||||
// Never auto-reboot a hypervisor. Check /var/run/reboot-required manually
|
||||
// (or via scripts/audit.sh) and reboot during a planned maintenance window.
|
||||
Unattended-Upgrade::Automatic-Reboot \"false\";
|
||||
|
||||
// Don't remove packages automatically; review before doing so by hand.
|
||||
Unattended-Upgrade::Remove-Unused-Dependencies \"false\";
|
||||
Unattended-Upgrade::Remove-Unused-Kernel-Packages \"false\";"
|
||||
|
||||
write_if_changed "/etc/apt/apt.conf.d/20auto-upgrades" '// Managed by proxmox-configuration/scripts/setup-unattended-upgrades.sh
|
||||
APT::Periodic::Update-Package-Lists "1";
|
||||
APT::Periodic::Unattended-Upgrade "1";
|
||||
APT::Periodic::Download-Upgradeable-Packages "1";
|
||||
APT::Periodic::AutocleanInterval "7";'
|
||||
|
||||
systemctl enable --now unattended-upgrades.service >/dev/null
|
||||
echo "unattended-upgrades enabled (security-only origins, no auto-reboot)."
|
||||
echo "Dry run:"
|
||||
unattended-upgrade --dry-run --debug 2>&1 | tail -20
|
||||
+133
@@ -0,0 +1,133 @@
|
||||
#!/bin/bash
|
||||
# Reproduces pve-test's wifi-primary networking: vmbr0 bridged over a wifi
|
||||
# NIC in 4addr (WDS) client-bridge mode, active-backup bonded with a wired
|
||||
# NIC as an automatic LAN fallback. See docs/06-pve-test-wifi-network.md for
|
||||
# why this exists and how it was validated. Idempotent - safe to re-run.
|
||||
#
|
||||
# Requires: a wifi NIC whose driver/AP both support 4addr mode (verify with
|
||||
# docs/06-pve-test-wifi-network.md's isolated-namespace test *before*
|
||||
# trusting this against a live management IP - a wifi NIC or AP that
|
||||
# doesn't support 4addr will associate fine but silently drop bridged
|
||||
# frames from any MAC other than the card's own).
|
||||
#
|
||||
# Usage (run as root on the target PVE host):
|
||||
# WIFI_SSID="..." WIFI_PASSPHRASE="..." \
|
||||
# MGMT_ADDR=192.168.2.251/24 MGMT_GATEWAY=192.168.2.254 \
|
||||
# ./setup-wifi-bond-network.sh
|
||||
#
|
||||
# Optional overrides: WIFI_IFACE (default wlp3s0), LAN_IFACE (default nic0)
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
WIFI_IFACE="${WIFI_IFACE:-wlp3s0}"
|
||||
LAN_IFACE="${LAN_IFACE:-nic0}"
|
||||
|
||||
for var in WIFI_SSID WIFI_PASSPHRASE MGMT_ADDR MGMT_GATEWAY; do
|
||||
if [ -z "${!var:-}" ]; then
|
||||
echo "$var is not set. See usage in this script's header." >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
if ! ip link show "$WIFI_IFACE" >/dev/null 2>&1; then
|
||||
echo "No interface named $WIFI_IFACE on this host. Run 'ip -br link' and set WIFI_IFACE=..." >&2
|
||||
exit 1
|
||||
fi
|
||||
if ! ip link show "$LAN_IFACE" >/dev/null 2>&1; then
|
||||
echo "No interface named $LAN_IFACE on this host. Run 'ip -br link' and set LAN_IFACE=..." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "=== 1/4: wifi tooling ==="
|
||||
apt-get install -y iw wpasupplicant >/dev/null
|
||||
echo "installed iw, wpasupplicant"
|
||||
|
||||
echo
|
||||
echo "=== 2/4: wpa_supplicant config (SSID: $WIFI_SSID, iface: $WIFI_IFACE) ==="
|
||||
WPA_CONF="/etc/wpa_supplicant/wpa_supplicant-${WIFI_IFACE}.conf"
|
||||
wpa_passphrase "$WIFI_SSID" "$WIFI_PASSPHRASE" > "$WPA_CONF"
|
||||
sed -i '/^\s*#psk=/d' "$WPA_CONF"
|
||||
chmod 600 "$WPA_CONF"
|
||||
echo "wrote $WPA_CONF (passphrase hashed, not stored in plaintext)"
|
||||
|
||||
echo
|
||||
echo "=== 3/4: systemd unit to set 4addr mode + start wpa_supplicant ==="
|
||||
UNIT="/etc/systemd/system/wpa-4addr-${WIFI_IFACE}.service"
|
||||
write_if_changed "$UNIT" "[Unit]
|
||||
Description=wpa_supplicant on ${WIFI_IFACE} with 4addr mode enabled
|
||||
Before=network-pre.target
|
||||
Wants=network-pre.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
ExecStartPre=/sbin/ip link set ${WIFI_IFACE} down
|
||||
ExecStartPre=/sbin/iw dev ${WIFI_IFACE} set 4addr on
|
||||
ExecStartPre=/sbin/ip link set ${WIFI_IFACE} up
|
||||
ExecStart=/sbin/wpa_supplicant -i ${WIFI_IFACE} -c ${WPA_CONF}
|
||||
Restart=on-failure
|
||||
RestartSec=3
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target"
|
||||
systemctl daemon-reload
|
||||
systemctl enable --now "wpa-4addr-${WIFI_IFACE}.service"
|
||||
sleep 5
|
||||
if ! iw dev "$WIFI_IFACE" link | grep -q "^Connected"; then
|
||||
echo "WARNING: ${WIFI_IFACE} did not associate to '$WIFI_SSID' within 5s - check:" >&2
|
||||
echo " systemctl status wpa-4addr-${WIFI_IFACE}.service" >&2
|
||||
echo " journalctl -u wpa-4addr-${WIFI_IFACE}.service" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "associated: $(iw dev "$WIFI_IFACE" link | grep '^Connected')"
|
||||
|
||||
echo
|
||||
echo "=== 4/4: /etc/network/interfaces (bond0 active-backup: ${WIFI_IFACE} primary, ${LAN_IFACE} backup) ==="
|
||||
IFACES_FILE="/etc/network/interfaces"
|
||||
backup_file "$IFACES_FILE"
|
||||
cat > "$IFACES_FILE" <<EOF
|
||||
auto lo
|
||||
iface lo inet loopback
|
||||
|
||||
iface ${LAN_IFACE} inet manual
|
||||
|
||||
iface ${WIFI_IFACE} inet manual
|
||||
|
||||
auto bond0
|
||||
iface bond0 inet manual
|
||||
bond-slaves ${WIFI_IFACE} ${LAN_IFACE}
|
||||
bond-mode active-backup
|
||||
bond-miimon 100
|
||||
bond-primary ${WIFI_IFACE}
|
||||
bond-updelay 200
|
||||
bond-downdelay 200
|
||||
|
||||
auto vmbr0
|
||||
iface vmbr0 inet static
|
||||
address ${MGMT_ADDR}
|
||||
gateway ${MGMT_GATEWAY}
|
||||
bridge-ports bond0
|
||||
bridge-stp off
|
||||
bridge-fd 0
|
||||
|
||||
source /etc/network/interfaces.d/*
|
||||
EOF
|
||||
echo "wrote $IFACES_FILE"
|
||||
|
||||
echo
|
||||
echo "Config staged but NOT applied yet - applying it live can drop your"
|
||||
echo "current management connection for ~30-60s while the switch/AP"
|
||||
echo "relearns MAC locations (expected, self-resolves; see"
|
||||
echo "docs/06-pve-test-wifi-network.md). Recommended: run this from the"
|
||||
echo "physical console, or arm a revert-on-timeout watchdog first, e.g.:"
|
||||
echo
|
||||
echo " cp ${IFACES_FILE}.bak.* /tmp/interfaces.orig # pick the backup just made"
|
||||
echo " (sleep 45 && cp /tmp/interfaces.orig ${IFACES_FILE} && ifreload -a) &"
|
||||
echo " ifreload -a"
|
||||
echo " # then kill the backgrounded revert job once you confirm connectivity"
|
||||
echo
|
||||
echo "Apply now with: ifreload -a"
|
||||
echo "Verify after with: cat /proc/net/bonding/bond0 ; ip -4 -br addr show vmbr0"
|
||||
+42
@@ -0,0 +1,42 @@
|
||||
#!/bin/bash
|
||||
# Remove the Proxmox/Ceph enterprise apt sources (which fail on apt update
|
||||
# without a paid subscription) and switch to the no-subscription repo.
|
||||
# Handles both the legacy one-line .list format and the deb822 .sources
|
||||
# format current PVE installers write.
|
||||
# Idempotent - safe to re-run. Run as root on the PVE host.
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
# shellcheck source=lib/common.sh
|
||||
source "${SCRIPT_DIR}/lib/common.sh"
|
||||
require_root
|
||||
|
||||
SOURCES_DIR="/etc/apt/sources.list.d"
|
||||
|
||||
# Any sources file pointing at the enterprise host gets moved out of apt's
|
||||
# way entirely (renamed .disabled) rather than commented out in place -
|
||||
# apt only reads *.sources/*.list, so this fully removes it from
|
||||
# consideration while keeping a copy on disk for reference.
|
||||
for f in "${SOURCES_DIR}"/*.sources "${SOURCES_DIR}"/*.list; do
|
||||
[ -f "$f" ] || continue
|
||||
grep -qi 'enterprise.proxmox.com' "$f" 2>/dev/null || continue
|
||||
mv "$f" "${f}.disabled"
|
||||
echo "Removed enterprise source (renamed to .disabled): $f"
|
||||
done
|
||||
|
||||
write_if_changed "${SOURCES_DIR}/pve-no-subscription.sources" "Types: deb
|
||||
URIs: http://download.proxmox.com/debian/pve
|
||||
Suites: $(pve_codename)
|
||||
Components: pve-no-subscription
|
||||
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg"
|
||||
|
||||
# Clean up a legacy-format no-subscription file from a previous run of an
|
||||
# older version of this script, to avoid two sources for the same repo.
|
||||
LEGACY_NOSUB="${SOURCES_DIR}/pve-no-subscription.list"
|
||||
if [ -f "$LEGACY_NOSUB" ]; then
|
||||
rm -f "$LEGACY_NOSUB"
|
||||
echo "Removed superseded $LEGACY_NOSUB"
|
||||
fi
|
||||
|
||||
apt-get update
|
||||
echo "Repo switched. Review 'apt list --upgradable' before upgrading."
|
||||
Reference in New Issue
Block a user