Repository navigation
feat: unattended config support and Docker UFW hardening - #127
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved critical defects risk SSH lockout, allow Docker traffic to bypass UFW protections, and enable spoofed packets to trigger bans against innocent users.
7 open issues
What changed in this PR
Adds unattended provisioning to the Debian/Ubuntu hardening script and optional Docker firewall protection, alongside SSH safety and runtime reliability improvements.
Changes:
- Adds safe
DU_*configuration parsing, quiet-mode defaults, validation, and an example configuration. - Adds Docker
DOCKER-USERrules and updates SSH, 2FA, intrusion prevention, and credential handling. - Updates usage and recovery documentation, release metadata, and script checksums.
| File | Description |
|---|---|
| README.md | Documents unattended setup, Docker protection, and revised SSH recovery steps. |
| du_setup.sh.sha256 | Updates the published script checksum. |
| du_setup.sh | Implements configuration-driven provisioning, firewall hardening, and reliability fixes. |
| du_setup.env.example | Provides documented configuration options for unattended runs. |
Review effort: Balanced
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved Docker firewall flaws can expose published ports without UFW allowances through unsafe bridge rules or skipped hardening when the image pull fails.
9 open issues
7 resolved since last review
Review effort: Balanced
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved critical SSH key installation flaws permit privileged file modification through user-controlled symlinks and can lock administrators out when other login methods are disabled.
5 open issues
9 resolved since last review
Review effort: Balanced
There was a problem hiding this comment.
🟡 Changes recommended
Critical SSH pre-flight gaps accept unusable keys and non-login accounts and miss client-specific restrictions, allowing quiet mode to disable existing access without ensuring a working administrator login.
6 open issues
5 resolved since last review
Review effort: Balanced
| local opts="$1" | ||
| [[ -n "$opts" ]] || return 1 | ||
| local flag_re='^(restrict|cert-authority|no-touch-required|verify-required|(no-)?(port-forwarding|agent-forwarding|x11-forwarding|pty|user-rc))(,(.*))?$' | ||
| local val_re='^(command|principals|from|expiry-time|environment|permitopen|permitlisten|tunnel)="(([^"\\]|\\.)*)"(,(.*))?$' |
Comment on lines
+2942
to
+2943
| # Enforce >= 1024-bit RSA modulus minimum matching sshd | ||
| (( blob_len >= 143 )) || rc=1 |
|
|
||
| local host_val sshd_dump | ||
| host_val=$(hostname 2>/dev/null || printf 'localhost') | ||
| if ! sshd_dump=$("$sshd_bin" -T -C "user=${username},host=${host_val},addr=127.0.0.1" 2>/dev/null); then |
| print_error "Quiet mode aborted: User '$DU_USERNAME' already exists and DU_USE_EXISTING_USER is false." | ||
| exit 1 | ||
| fi | ||
| existing_home=$(getent passwd "$DU_USERNAME" | cut -d: -f6) |
| print_info "Skipping custom .bashrc configuration." | ||
| log "Skipped custom .bashrc for $USERNAME." | ||
| return 0 | ||
| fi | ||
|
|
||
| print_info "Preparing custom .bashrc for '$USERNAME'..." | ||
|
|
||
| temp_source_bashrc=$(mktemp "/tmp/custom_bashrc_source.XXXXXX") | ||
| temp_source_bashrc=$(mktemp "${RUN_TMP_DIR:-/tmp}/custom_bashrc_source.XXXXXX") |
Comment on lines
+6238
to
+6241
| if [[ -n "${DU_TAILSCALE_FLAGS:-}" ]]; then | ||
| local -a raw_ts_flags=() | ||
| local flag | ||
| read -ra raw_ts_flags <<< "${DU_TAILSCALE_FLAGS}" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.