kleb/kInit
Watch
1
0
Fork
You've already forked kInit
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Audit round 2: SSH hardening, update.sh, validator tests, naming cleanup #28

Merged
kleb merged 2 commits from fix/audit-round-2 into main 2026-06-25 01:32:03 +02:00
Conversation 1 Commits 2 Files changed 17 +362 -246
kleb commented 2026-06-25 01:24:39 +02:00
Owner
Copy link

Summary

Round 2 of the kInit audit remediation — implements the prioritized fixes from
the latest end-to-end audit.

Security

  • SSH: on the key-installed path, disable PasswordAuthentication and
    KbdInteractiveAuthentication (configurable via SSH_PASSWORD_AUTH, default
    no); set LoginGraceTime 60 (SSH_LOGIN_GRACE_TIME); drop the deprecated
    authorized_keys2 from AuthorizedKeysFile. Applied only where a key was
    installed, so a host matching no SSH_IP_RANGES entry is never locked out.

Behavior

  • update.sh: apt-get upgrade --with-new-pkgs instead of full-upgrade —
    upgrades all installed packages (incl. new kernels) but never auto-removes.
  • Re-pin Fisher 4.4.5 -> 4.4.8 (checksum updated).

Tooling / maintenance

  • Remove the divergent Windows checksum.ps1 generator (it omitted files and
    used a non-canonical format, corrupting the manifest).
  • Add bats unit tests for the validation helpers (tests/).
  • Clarity renames: currentMe->scriptName, module
    currentName/currentVersion->moduleName/moduleVersion, kInit
    currentVersion->kinitVersion, isLXC state var->runningInLxc,
    noOut->runQuiet.
  • Regenerate the integrity manifest.

Validation

  • ShellCheck clean (only intentional SC2059/SC1091/SC2016).
  • sha256sum -c checksums.sha256: 46/46 OK; embedded bootstrap hashes re-stamped.
  • Validators exercised: 20/20 behaviors pass.
  • Live test on a fresh Debian 12 Incus VM: all 4 modules EXECUTED, analyze 10/10
    passed, SSH drop-in correct + sshd -t OK, update.sh verb correct, Fisher
    4.4.8 installed, zabbix-agent2 active, root shell fish, 0 color leakage.
## Summary Round 2 of the kInit audit remediation — implements the prioritized fixes from the latest end-to-end audit. ### Security - SSH: on the key-installed path, disable `PasswordAuthentication` and `KbdInteractiveAuthentication` (configurable via `SSH_PASSWORD_AUTH`, default `no`); set `LoginGraceTime 60` (`SSH_LOGIN_GRACE_TIME`); drop the deprecated `authorized_keys2` from `AuthorizedKeysFile`. Applied only where a key was installed, so a host matching no `SSH_IP_RANGES` entry is never locked out. ### Behavior - `update.sh`: `apt-get upgrade --with-new-pkgs` instead of `full-upgrade` — upgrades all installed packages (incl. new kernels) but never auto-removes. - Re-pin Fisher 4.4.5 -> 4.4.8 (checksum updated). ### Tooling / maintenance - Remove the divergent Windows `checksum.ps1` generator (it omitted files and used a non-canonical format, corrupting the manifest). - Add `bats` unit tests for the validation helpers (`tests/`). - Clarity renames: `currentMe`->`scriptName`, module `currentName`/`currentVersion`->`moduleName`/`moduleVersion`, kInit `currentVersion`->`kinitVersion`, `isLXC` state var->`runningInLxc`, `noOut`->`runQuiet`. - Regenerate the integrity manifest. ### Validation - ShellCheck clean (only intentional SC2059/SC1091/SC2016). - `sha256sum -c checksums.sha256`: 46/46 OK; embedded bootstrap hashes re-stamped. - Validators exercised: 20/20 behaviors pass. - Live test on a fresh Debian 12 Incus VM: all 4 modules EXECUTED, analyze 10/10 passed, SSH drop-in correct + `sshd -t` OK, `update.sh` verb correct, Fisher 4.4.8 installed, zabbix-agent2 active, root shell fish, 0 color leakage. 
- SSH: on the key-installed path, disable PasswordAuthentication and
  KbdInteractiveAuthentication (configurable via SSH_PASSWORD_AUTH), set
  LoginGraceTime 60, and drop the deprecated authorized_keys2
- update.sh: use `apt-get upgrade --with-new-pkgs` instead of full-upgrade so it
  upgrades all packages (incl. new kernels) but never auto-removes them
- Re-pin Fisher 4.4.5 -> 4.4.8 (checksum updated)
- Remove the divergent Windows checksum.ps1 generator
- Clarity renames: currentMe->scriptName, current{Name,Version}->module{Name,Version},
  kInit currentVersion->kinitVersion, isLXC state var->runningInLxc, noOut->runQuiet
- Add bats unit tests for the validation helpers (tests/)
- Regenerate the integrity manifest
kAgent commented 2026-06-25 01:24:40 +02:00
Collaborator
Copy link

kReview review

Verdict: no findings

No findings to address in the reviewed diff.

Overall risk is low; I found no verified correctness or security defects in the visible diff.

Reviewed by kReview at a2556a1581. This comment is conservative and based only on the PR diff, metadata, and supplied repository context.

Est. cost ~$0.46 total (88.7k in / 1.3k out) · this run ~$0.23 (44.7k in / 553 out) / gpt-5.5.

<!-- codex-forgejo-review --> <!-- codex-forgejo-review-head:a2556a15819ebc9ca30821e731fa4f004cc94fcc --> ## kReview review **Verdict:** no findings No findings to address in the reviewed diff. Overall risk is low; I found no verified correctness or security defects in the visible diff. _Reviewed by kReview at `a2556a1581`. This comment is conservative and based only on the PR diff, metadata, and supplied repository context._ _Est. cost ~$0.46 total (88.7k in / 1.3k out) · this run ~$0.23 (44.7k in / 553 out) / gpt-5.5._ <!-- codex-forgejo-review-state:eyJoZWFkU2hhIjoiYTI1NTZhMTU4MTllYmM5Y2EzMDgyMWU3MzFmYTRmMDA0Y2M5NGZjYyIsInN1bW1hcnkiOiJPdmVyYWxsIHJpc2sgaXMgbG93OyBJIGZvdW5kIG5vIHZlcmlmaWVkIGNvcnJlY3RuZXNzIG9yIHNlY3VyaXR5IGRlZmVjdHMgaW4gdGhlIHZpc2libGUgZGlmZi4iLCJmaW5kaW5ncyI6W10sImN1bXVsYXRpdmVDb3N0Ijp7InVzZCI6MC40NTk5NjIsImlucHV0VG9rZW5zIjo4ODcwOCwib3V0cHV0VG9rZW5zIjoxMjc3LCJtb2RlbCI6ImdwdC01LjUifX0= -->
The sshd hardening (PermitRootLogin prohibit-password, PasswordAuthentication no,
KbdInteractiveAuthentication no, LoginGraceTime) ran whenever a key URL was
selected, even if the downloaded file yielded zero valid keys. That could lock a
host out of SSH (no working key AND password disabled). Gate the whole block on
keysAdded > 0; when no valid key was added, skip hardening with a warning.
Regenerate the integrity manifest.
kleb merged commit 12e9d80e88 into main 2026-06-25 01:32:03 +02:00
kleb deleted branch fix/audit-round-2 2026-06-25 01:32:03 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kleb/kInit!28
No description provided.