Add a temporary firewall rule for current SSH port#66
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR improves SSH port transition handling by adding temporary firewall rules during SSH port changes and fixing SSH port validation logic. The changes ensure that users don't lose SSH access when changing ports by maintaining connectivity to both the old and new ports during the transition.
- Fix SSH port validation to properly handle existing SSH ports during configuration
- Add temporary firewall rules for the current SSH port during transitions
- Improve rollback functionality to handle firewall rules when SSH changes fail
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| du_setup.sh | Core script updates with improved SSH port handling and firewall transition logic |
| du_setup.sh.sha256 | Updated checksum for the modified script |
| README.md | Updated checksum reference in documentation |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
|
|
||
| print_section "SSH Hardening" | ||
| local CURRENT_SSH_PORT USER_HOME SSH_DIR SSH_KEY AUTH_KEYS NEW_SSH_CONFIG PREVIOUS_SSH_PORT | ||
| local CURRENT_SSH_PORT USER_HOME SSH_DIR SSH_KEY AUTH_KEYS |
There was a problem hiding this comment.
The variable CURRENT_SSH_PORT is declared but never used in this function. Consider removing it or using the global PREVIOUS_SSH_PORT variable instead to maintain consistency.
| local CURRENT_SSH_PORT USER_HOME SSH_DIR SSH_KEY AUTH_KEYS | |
| local USER_HOME SSH_DIR SSH_KEY AUTH_KEYS |
| # Store the current active port as the previous port for rollback purposes | ||
| PREVIOUS_SSH_PORT=$(ss -tlpn | grep sshd | grep -oP ':\K\d+' | head -n 1) | ||
|
|
||
| # Check globally detected port, falling back to 22 if detection failed |
There was a problem hiding this comment.
The comment mentions 'falling back to 22' but the actual fallback logic is not visible in this diff. The comment should be updated to accurately reflect what happens when PREVIOUS_SSH_PORT is empty.
| # Check globally detected port, falling back to 22 if detection failed | |
| # Check globally detected port; if PREVIOUS_SSH_PORT is empty, set it to 22 as fallback |
No description provided.