Audit round 2: SSH hardening, update.sh, validator tests, naming cleanup #27
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/audit-round-2"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Round 2 of the kInit audit remediation — implements the prioritized fixes from
the latest end-to-end audit.
Security
PasswordAuthenticationandKbdInteractiveAuthentication(configurable viaSSH_PASSWORD_AUTH, defaultno); setLoginGraceTime 60(SSH_LOGIN_GRACE_TIME); drop the deprecatedauthorized_keys2fromAuthorizedKeysFile. Applied only where a key wasinstalled, so a host matching no
SSH_IP_RANGESentry is never locked out.Behavior
update.sh:apt-get upgrade --with-new-pkgsinstead offull-upgrade—upgrades all installed packages (incl. new kernels) but never auto-removes.
Tooling / maintenance
checksum.ps1generator (it omitted files andused a non-canonical format, corrupting the manifest).
batsunit tests for the validation helpers (tests/).currentMe->scriptName, modulecurrentName/currentVersion->moduleName/moduleVersion, kInitcurrentVersion->kinitVersion,isLXCstate var->runningInLxc,noOut->runQuiet.Validation
sha256sum -c checksums.sha256: 46/46 OK; embedded bootstrap hashes re-stamped.passed, SSH drop-in correct +
sshd -tOK,update.shverb correct, Fisher4.4.8 installed, zabbix-agent2 active, root shell fish, 0 color leakage.
- SSH: on the key-installed path, disable PasswordAuthentication and KbdInteractiveAuthentication (configurable via SSH_PASSWORD_AUTH), set LoginGraceTime 60, and drop the deprecated authorized_keys2 - update.sh: use `apt-get upgrade --with-new-pkgs` instead of full-upgrade so it upgrades all packages (incl. new kernels) but never auto-removes them - Re-pin Fisher 4.4.5 -> 4.4.8 (checksum updated) - Remove the divergent Windows checksum.ps1 generator - Clarity renames: currentMe->scriptName, current{Name,Version}->module{Name,Version}, kInit currentVersion->kinitVersion, isLXC state var->runningInLxc, noOut->runQuiet - Add bats unit tests for the validation helpers (tests/) - Regenerate the integrity manifestkReview review
Verdict: no findings
No findings to address in the reviewed diff.
Overall risk is low; I found no concrete regressions that can be verified from the supplied diff and context.
Reviewed by kReview at
c2baa732a3. This comment is conservative and based only on the PR diff, metadata, and supplied repository context.Est. cost ~$0.23 (44.0k in / 557 out / gpt-5.5).
Pull request closed