← Back to branch summary

~vcs-imports/ipfire/ipfire-2.x

« back to all changes in this revision

Viewing changes to src/initscripts/helper/oci-setup

  • Committer: Peter Müller
  • Date: 2022-04-23 14:27:56 UTC
  • mto: This revision was merged to the branch mainline in revision 9750.
  • Revision ID: git-v1:7a981d94cb2c3e48ecaf07c506c8353a2c839d79
SSH: do not send spoofable TCP keep alive messages

By default, both SSH server and client rely on TCP-based keep alive
messages to detect broken sessions, which can be spoofed rather easily
in order to keep a broken session opened (and vice versa).

Since we rely on SSH-based keep alive messages, which are not vulnerable
to this kind of tampering, there is no need to double-check connections
via TCP keep alive as well.

This patch thereof disables using TCP keep alive for both SSH client and
server scenario. For usability reasons, a timeout of 5 minutes (10
seconds * 30 keep alive messages = 300 seconds) will be used for both
client and server configuration, as 60 seconds were found to be too
short for unstable connectivity scenarios.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/initscripts/helper/oci-setup
147
147
                fi
148
148
        done <<<"$(get instance/metadata/ssh_authorized_keys)"
149
149
 
 
150
        # Download the user-data script only on the first boot
 
151
        if [ ! -e "/var/ipfire/main/firstsetup_ok" ]; then
 
152
                # Download a startup script
 
153
                local script="$(get instance/metadata/user_data)"
 
154
 
 
155
                # Try to decode this
 
156
                script="$(try_base64_decode "${script}")"
 
157
 
 
158
                # Execute the script
 
159
                if [ "${script:0:2}" = "#!" ]; then
 
160
                        echo "${script}" > /tmp/user-data.script
 
161
                        chmod 700 /tmp/user-data.script
 
162
 
 
163
                        # Run the script
 
164
                        local now="$(date -u +"%s")"
 
165
                        /tmp/user-data.script &>/var/log/user-data.log.${now}
 
166
 
 
167
                        # Delete the script right away
 
168
                        rm /tmp/user-data.script
 
169
                fi
 
170
        fi
 
171
 
150
172
        # Import network configuration
151
173
        # After this, no network connectivity will be available from this script due to the
152
174
        # renaming of the network interfaces for which they have to be shut down
263
285
                        echo "2,ACCEPT,INPUTFW,ON,std_net_src,ALL,ipfire,RED1,,TCP,,,ON,,,TGT_PORT,444,,,,,,,,,,,00:00,00:00,,AUTO,,dnat,,,,,second"
264
286
                ) >> /var/ipfire/firewall/input
265
287
 
266
 
                # Download a startup script
267
 
                local script="$(get instance/metadata/user_data)"
268
 
 
269
 
                # Try to decode this
270
 
                script="$(try_base64_decode "${script}")"
271
 
 
272
 
                # Execute the script
273
 
                if [ "${script:0:2}" = "#!" ]; then
274
 
                        echo "${script}" > /tmp/user-data.script
275
 
                        chmod 700 /tmp/user-data.script
276
 
 
277
 
                        # Run the script
278
 
                        local now="$(date -u +"%s")"
279
 
                        /tmp/user-data.script &>/var/log/user-data.log.${now}
280
 
 
281
 
                        # Delete the script right away
282
 
                        rm /tmp/user-data.script
283
 
                fi
284
 
 
285
288
                # This script has now completed the first steps of setup
286
289
                touch /var/ipfire/main/firstsetup_ok
287
290
        fi