koncreet v0.2.4

koncreet v0.2.4

Changes

• ssh: after apply, also fail closed when a Match block re-enables password/root/kbd-interactive auth (global sshd -T misses those); probe effective settings with sshd -T -C for root and the admin user
• firewall: refuse to enable ufw when SSH listen ports cannot be detected (no more silent default to port 22); dry-run still completes and plans the refuse (CI smoke images often have no sshd Port)
• baseline: restore umask after writing /root/USER.koncreet-password; write_file forces world-readable modes for /etc drop-ins so a tight umask cannot leave apt/sysctl/journald config root-only
• doctor: SSH harden readiness requires keys and sudo (same gate as ssh apply); checks 00-koncreet.conf (and flags legacy 99-*) and reports when sshd -T still shows password/root login on
• doctor: as non-root, warn when /etc/ssh/sshd_config.d is unreadable instead of skipping; never block on a sudo password prompt when probing sudoers (sudo -n); suggest chmod if older koncreet left /etc drop-ins root-only
• ssh: drop-in renamed to 00-koncreet.conf so it wins over 50-cloud-init.conf (sshd keeps the first value); ssh apply verifies effective settings with sshd -T and rolls back on override; ssh status shows effective values. Legacy 99-koncreet.conf is migrated.
• ssh: hardening gate now requires the key user to have sudo, and asks you to confirm a koncreet-generated sudo password was saved before root login is disabled
• fail2ban: detect your SSH client IP under sudo (walks parent process environment, then who -m); warn when it can't; whitelist validates the IP
• firewall: parse Ubuntu 24.04 ListenStream=0.0.0.0:22 as port 22 (was 0, which made ufw allow fail)
• Error/warning/info messages (including every die) were silently dropped from the terminal; they now print
• apply: SSH hardening is decided once before the run, so a plan that says "SKIP SSH harden" no longer hardens SSH after baseline creates the user in the same run
• CI: tests/integration.sh runs lockout scenarios against a real sshd, sudo and ufw rule parser on Debian 12/13 and Ubuntu 22.04/24.04
• dry-run: no longer asks the fail2ban whitelist question (shown as a PLAN: line instead), no longer prints the "Before you disconnect" checklist, and ends with "Dry-run done - nothing changed"
• log: dry-run as root logs to /var/log/koncreet.log (tagged dry-run) instead of /opt/koncreet/koncreet.log, which install.sh and uninstall delete; non-root runs log to ~/.local/state/koncreet/
• Thanks @lord-helicon for #2 (SSH/sudo lockout and silent-failure fixes) and for reporting the doctor edge cases (unreadable /etc/ssh, non-blocking sudoers probe, root-only /etc mode hints)

Install (no git required)

curl -fsSL https://github.com/jimididit/koncreet/releases/latest/download/install.sh | sudo bash

Pin this version:

KONCREET_VERSION=0.2.4 curl -fsSL https://github.com/jimididit/koncreet/releases/download/v0.2.4/install.sh | sudo bash

koncreet v0.2.3

koncreet v0.2.3

Install (no git required)

curl -fsSL https://github.com/jimididit/koncreet/releases/latest/download/install.sh | sudo bash

Pin this version:

KONCREET_VERSION=0.2.3 curl -fsSL https://github.com/jimididit/koncreet/releases/download/v0.2.3/install.sh | sudo bash

koncreet v0.2.2

koncreet v0.2.2

Install (no git required)

curl -fsSL https://github.com/jimididit/koncreet/releases/latest/download/install.sh | sudo bash

Pin this version:

KONCREET_VERSION=0.2.2 curl -fsSL https://github.com/jimididit/koncreet/releases/download/v0.2.2/install.sh | sudo bash