Close challenge shortcuts and make each challenge test its skill

[madebygps]

Why

A review of all 18 challenges on a live Azure VM found that every challenge was solvable, but many could be shortcut without the skill they teach:

• All flags shared one random suffix, so solving challenge 1 revealed the other 17.
• One grep -r 'CTF{' without sudo found 13 of 18 flags.
• Several challenges (8, 9, 11, 13) didn't actually check what the README described.

What changed

#	Change
All	Each flag gets its own random suffix
5	Hint adds -type f (the old command printed ~9,000 lines)
6	README no longer names the port
8	Flag is awarded only after a real SSH key login and shown in the login banner
9	A private DNS zone replaces the flag-in-a-comment design
10	Only files uploaded via scp/sftp count (checked with auditd); flag no longer written to /tmp
11	Port 8083 serves a decoy; the flag appears only once nginx is moved to port 80. 8083 closed in all firewall rules
12	Flag no longer present in the ping script or its log
13	Cron job publishes its output briefly; learners trace the job and its script
14	Flag loaded via root-only EnvironmentFile=, not visible via systemctl
16	Flag is in the final target's path, so the link chain must be resolved
17	History file needs sudo; content is a realistic leaked credential
18	Disk image is root-only so it must be mounted; README wording fixed

New VM packages: auditd, dnsmasq-base, dnsutils. Challenge 8 is renamed "SSH Key Authentication" in verify list and the certificate.

The test suite now includes shortcut regression checks, and the reboot phase checks the new services.

Testing

• deploy_and_test.sh azure --with-reboot: 41/41 before reboot, 9/9 after, resources cleaned up
• ShellCheck (CI severity) passes
• Not yet tested on AWS or GCP. Challenges 8–10 depend on sshd, auditd and systemd-resolved behavior, so those runs should happen before release.

[madebygps]

Follow-up changes from review

1. Split challenge-specific concerns out of setup/system.py (03683ac)

• New setup/external_rewards.py holds the login-banner reward plumbing used only by ch08 and ch10 (rewards dir, profile.d banner, and the ExposeAuthInfo sshd drop-in). ch08/ch10 call grant_command(n) instead of hardcoding /var/lib/ctf-rewards.
• Challenges now declare their own apt packages via a module-level PACKAGES list (ch06 netcat-openbsd, ch09 dnsmasq-base, ch10 auditd/inotify-tools, ch11 nginx). system.py only lists learner tools. The installed package set is unchanged.
• CHALLENGE_DIR and DONE_MARKER live in helpers.py, replacing hardcoded paths in 8 files (ch10 previously duplicated the done-marker path).
• Single CHALLENGES registry in setup/challenges/__init__.py; contributor docs updated.

2. Drop unused PROGRESS_FILE import and a placeholder-free f-string in verify (42f5622)

3. Remove the legacy /var/log/setup_complete marker (ef1e769)
Nothing depended on it alone; every readiness check still accepts /var/lib/linux-ctfs/setup.done or the cloud-init instance marker.

4. Fix a boot ordering cycle from ch09's ctf-dns.service (88b8eab)
Before=systemd-resolved.service created two systemd ordering cycles (resolved starts before sysinit.target/network.target; ctf-dns starts after both). systemd broke them by dropping jobs at boot, which left DNS down after reboot and, in one run, SSH unreachable. Removed the Before= (resolved only forwards ctf.internal queries on demand) and added post-reboot checks for ordering cycles and a running systemd-resolved.

Testing

• Rendered ch08/ch10 scripts and the banner are byte-identical to the previous commit, aside from the new ExposeAuthInfo drop-in file.
• shellcheck, ruff, bash -n, and terraform fmt pass.
• Azure basic test: 41/41 passed.
• Azure full test with reboot: 41/41 pre-reboot, 11/11 post-reboot. The run before the ch09 fix failed with SSH unreachable after reboot.