cfauth

Description

Generic configuration of system security:

• Update SSH config and strip unused features
• Enable only SSHv2 public key authentication
• Enable SSH login only for members of ssh_access group
• Create special user for admin access
• Setup encrypted admin password
• Setup sudoers
• Harden /bin/su to allow access only from wheel group
• Configure firewall for SSH access only from whitelisted hosts

Technical Support

• Example configuration
• Free & Commercial support: support@codingfuture.net

Setup

Up to date installation instructions are available in Puppet Forge: https://forge.puppet.com/codingfuture/cfauth

Please use librarian-puppet or cfpuppetserver module to deal with dependencies.

There is a known r10k issue RK-3 which prevents automatic dependencies of dependencies installation.

Examples

Please check codingufuture/puppet-test for example of a complete infrastructure configuration and Vagrant provisioning.

Implicitly created resources

cfnetwork::describe_services:
    cfssh:
        server: prefix(any2array($cfauth::sshd_ports), 'tcp/')
cfnetwork::service_ports:
    'any:cfssh:cfauth':
        src: 'ipset:cfauth_admin'
cfnetwork::ipsets:
    cfauth_admin:
        type: net
        addr: $cfauth::admin_hosts
        dynamic: true
    whitelist:cfauth:
        type: net
        addr: 'ipset:cfauth_admin'

cfauth parameters

• admin_auth_keys - mandatory required list of allowed SSH public keys in format of suitable for create_resources(ssh_authorized_key, $admin_auth_keys, { user => $admin_user, type => 'ssh-rsa' }).
• admin_user = 'adminaccess' - setup non-root user for SSH access capable of sudo
• admin_password = undef - encrypted password for root and $admin_user, if set Note: use the following command for generation mkpasswd -m sha-512
• admin_hosts = undef - passed as src paramter to cfnetwork::service_port
• sudo_no_password_all = false - allow sudo for $admin_user without password. See below.
• sudo_no_password_commands = []` - optional list of commands which are allowed to run without password
• sudo_env_keep = [] - optional list of environment variables allowed to be preserved in sudo
• sudo_entries = {} - optional resources of type cfauth::sudoentry
• clear_sudoers = true - clear unmanaged /etc/sudoers.d
• custom_sudoers = [] - arbitrary lines to add to global sudoers file
• sshd_ports = '22',
• sshd_config_template = 'cfauth/sshd_config.epp',
• secure_path = [<system default>] - array of global trusted paths
• ssh_max_startups = 10 - parameter for SSH MaxStartups
• freeipa = undef - optional FreeIPA client support:
  • server - FreeIPA server address,
  • domain - FreeIPA domain,
  • groups - FreeIPA groups to allow SSH access.

sudo_no_password_all purpose

Enabling it is useful for bulk administration of less privileged VMs.

Even if password is required, the following commands can be run without password:

• /opt/puppetlabs/puppet/bin/puppet agent --test - deploy puppet
• /usr/bin/apt-get update - update apt repository metadata
• /usr/bin/apt-get dist-upgrade - run system upgrade with optional parameter, like -s -y (for simulation( and -y (for install)
• /usr/bin/apt-get autoremove - run automatic unusued package remove
• /usr/sbin/cfntpdate - force run pre-configured ntpdate from cfsystem module

The following environment variables are allowed in sudo by default:

• DEBIAN_FRONTEND

cfauth::sudoentry type

• title - name of file under '/etc/sudoers.d'
• command = [] - command to allow to execute without password
  • String or Array of Strings
• env_keep = [] - list of environment variables for env_keep
• user = $cfauth::admin_user - user for the entry
• custom_config = [] - arbitrary lines to add

SFTP only users

A standalone cfauth::sftp class has to be included.

All users are created with sftp_ prefix. Their home folders are located under $cfauth::sftp::root/home. All users are chrooted under $cfauth::sftp::root/chroot/%u. Each use has data folder under chroot - the default selected.

Note: if disk quota is configured then filesystem must be mounted by any type of user quota support.

cfauth::sftp class

• root = '/mnt/sftp' - root for SFTP location.
• users = {} - cfauth::sftp::user definitions

cfauth::sftp::user type

• name - name of user without sftp_ prefix.
• auth_keys = {} - definition of SSH authentication keys.
• user_hosts = [] - list of SSH-accepted IP addresses to allow access from.
• block_limit = undef - passed to setquota hard block limit
• inode_limit = undef - passed to setquota hard inode limit

Change Log

All notable changes to this project will be documented in this file. This project adheres to Semantic Versioning.

1.3.0 (2019-04-14)

• CHANGED: root user to be defined with purge_ssh_keys
• NEW: FreeIPA cleanup support

1.1.0 (2018-12-09)

• CHANGED: updated for Ubuntu 18.04 Bionic support
• NEW: FreeIPA support

0.12.1 (2018-03-19)

• CHANGED: hardened /bin/su to allow only wheel group

0.12.0

• NEW: sftp_only users feature
• NEW: SSH MaxStartups configuration

0.11.1

• Added Puppet 5.x support
• Added Ubuntu Zesty support

0.11.0

• Added generic cfauth::sudoentry support
• Fixed to cleanup /etc/sudoers.d
• Added `cfauth::sudo_entries', 'cfauth::clear_sudoers' and 'cfauth::custom_sudoers' parameters
• Minor refactoring
• Added cfauth::secure_path parameter

0.10.1

• Fixed Debian Stretch support
• Updated to cfnetwork 0.10.1

0.10.0

• Updated CF deps to v0.10.x
• Version bump

0.9.8

• Updated to cfnetwork 0.9.11+ ipset support
• Added strict parameter type checking
• Automatic newer puppet-lint fixes
• Fixed puppet-lint and metadata-json-lint warnings

0.9.7

• Changed to define root user with explicit home to be more friendly to cfdb

0.9.6

• Updated supported OS list

0.9.5

• Updated deps to latest versions

0.9.4

• Added sudo_env_keep parameter support
• Added forceful /home folder permissions to avoid accidents with not accessible authorized_keys
• Added apt-get autoremove to list of sudo no password commands

0.9.3

• Fixed to install sudo & openssh-server in cfauth instead of cfsystem
• Fixed dependency in deployment on bare system (after debootstrap)

0.9.2

• Updated dependencies

0.9.1

• Added hiera.yaml version 4 support

0.9.0

Initial release