Repository navigation
Jumpbox: optional staff-only SSH filter - #73
Merged
Merged
Conversation
Students route through the jumpbox and never log in, but its 10.x.x.1 gateway addresses fall inside the advertised 10.0.0.0/8 route, so a Headscale ACL cannot close SSH. Generate a separate nftables table (input hook, priority -10, policy accept) that accepts tcp/22 on lo, the management interface and tailscale0 from JUMPBOX_SSH_STAFF_IPS, and counts and drops the rest, plus a oneshot unit that loads it before the network and sshd. Forwarding is untouched. Validated with nft -c -f; refuses when the staff list is empty and the management interface is unknown. Co-Authored-By: Claude <noreply@anthropic.com>
…lockout guards - Collect the ports sshd (-T) and ssh.socket actually listen on and render them as a port set; validate --ports (1-65535). Non-22 listeners no longer bypass the filter. - Unit gains ExecReload and a "-" ExecStop; the script uses reload-or-restart on an active unit (start otherwise), never restart, so the table is never deleted while SSH is up. - Applying over SSH refuses unless the session provably survives (loopback, management NIC, or listed staff source on tailscale0) or --i-have-console. - --apply requires nft and always validates with nft -c -f; dry run without nft prints the ruleset with a note. Co-Authored-By: Claude <noreply@anthropic.com>
…t guard - Parse sshd -T listenaddress ports (host:port, [v6]:port; bare address means the port values apply). If sshd or ssh.socket cannot be read, or sshd reports no port, --apply refuses instead of assuming 22; 22 is the default only when neither exists. - Decide whether an SSH session survives from the interface `ip route get` picks for its source (lo, management NIC, or tailscale0 with a staff source), not from the destination address. Validate SSH_CONNECTION strictly, fold IPv4-mapped IPv6, pass values after `--`, and refuse when the route or the value cannot be determined unless --i-have-console. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
--ssh-staff-onlytoscripts/jumpbox_configure.sh. Students route through the jumpbox and never log in to it, but its lab gateway addresses sit inside the advertised10.0.0.0/8route, so a VPN ACL alone can't close SSH. This generates a separate nftables table that allows tcp/22 only from loopback, the management interface, and listed staff tailnet addresses (JUMPBOX_SSH_STAFF_IPS), and drops the rest. Forwarding and ICMP are untouched. It is loaded by a oneshot systemd unit. Dry-run/diff by default;--applyvalidates withnft -cfirst; a lockout guard refuses with no staff list and no management interface.Tests (red first): rule order, mixed v4/v6/CIDR sets, determinism, empty-staff table, dry-run writes nothing, apply writes and enables, idempotence, nft rejection, lockout guard, unit ordering. Validated with real
nft -c -f/nft -fon Ubuntu 24.04. Docs:docs/JUMPBOX.md(why an ACL is not enough, adding a staff device, rollback).