Add hardened key-only SSH admin access over the mesh (keepadmin, mesh-only)#58
Conversation
|
Warning Review limit reached
Next review available in: 34 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
WalkthroughThis PR adds a new NixOS module ( ChangesMesh Admin SSH Access
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant NodeA
participant Mesh
participant NodeB_sshd
NodeA->>Mesh: nvpn ip --peer --discover-secs 0
Mesh-->>NodeA: resolved meshB IP
NodeA->>NodeB_sshd: ssh keepadmin@meshB (mesh IP)
NodeB_sshd-->>NodeA: connection succeeds
NodeA->>NodeB_sshd: sudo -n (passwordless)
NodeB_sshd-->>NodeA: sudo succeeds
NodeA->>NodeB_sshd: ssh keepadmin@underlayB (LAN IP)
NodeB_sshd-->>NodeA: connection refused
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
tests/mesh-admin-ssh.nix (1)
89-96: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winExtend hardened-posture assertions to cover AllowUsers and forwarding.
The sshd -T checks verify password/kbd-interactive/root-login/maxauthtries, but the PR objectives also claim
AllowUsers = [ "keepadmin" ]and forwarding disabled as part of the hardened posture — neither is asserted here, so a regression in those specific settings wouldn't be caught by this test.♻️ Proposed additional assertions
for prop in [ "passwordauthentication no", "kbdinteractiveauthentication no", "permitrootlogin no", "maxauthtries 3", + "allowusers keepadmin", + "allowtcpforwarding no", + "x11forwarding no", ]: nodeB.succeed(f"sshd -T | grep -qx '{prop}'")🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/mesh-admin-ssh.nix` around lines 89 - 96, The hardened sshd posture check in the sshd -T assertion block only verifies password, kbd-interactive, root login, and maxauthtries, so it misses the claimed AllowUsers and forwarding restrictions. Extend the existing loop or add adjacent assertions in the same test to verify the effective sshd config also includes AllowUsers for keepadmin and that forwarding is disabled, using the same nodeB.succeed("sshd -T | grep -qx ...") pattern so regressions in those settings are caught.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@tests/mesh-admin-ssh.nix`:
- Around line 89-96: The hardened sshd posture check in the sshd -T assertion
block only verifies password, kbd-interactive, root login, and maxauthtries, so
it misses the claimed AllowUsers and forwarding restrictions. Extend the
existing loop or add adjacent assertions in the same test to verify the
effective sshd config also includes AllowUsers for keepadmin and that forwarding
is disabled, using the same nodeB.succeed("sshd -T | grep -qx ...") pattern so
regressions in those settings are caught.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 97a8c7da-756a-43e9-acfc-f926715b009e
📒 Files selected for processing (4)
flake.nixnixos/admin-access.nixnixos/keep-node.nixtests/mesh-admin-ssh.nix
…rtions, negative tests
1 participant
Second onboarding increment (bead keep-node-xp4): give a HARDENED keepnode a secure way in, so the insecure debug profile (known root password, password SSH, open signups) is no longer the only access path. Retires that debug profile for the DECLARATIVE-deploy path; the generic-ISO first-boot key enrollment is a tracked follow-up (keep-node-4r4).
Design is research-backed (cited): the perimeter is the mesh, not the daemon. SSH is opened ONLY on the nvpn mesh interface (like the rsync replica receiver), so a hostile LAN never reaches sshd -- only rostered, WireGuard-authenticated peers. This mirrors how comparable appliances work (Start9 gates SSH behind Tor/web-console, Umbrel steers remote access to a WireGuard mesh).
nixos/admin-access.nix(newkeepNode.adminAccess): key-only OpenSSH, a dedicatedkeepadmin(wheel + passwordless sudo, since a key-only account has no password to type -- still auditable, not root-by-default),PermitRootLogin=no(root is not a network username),KbdInteractiveAuthentication=false,AllowUsers=[keepadmin],MaxAuthTries=3, forwarding off, ed25519 host key only. Deliberately does NOT pin Ciphers/Kex/MACs -- the modern OpenSSH defaults are the curated strong set, and pinning freezes crypto policy / blocks the PQ-KEX upgrade path. No fail2ban (it does nothing for key-only auth; sshd's built-in PerSourcePenalties covers it).keepNode.adminAuthorizedKeystakes inline operator pubkeys (public keys, no secret manager). An anti-lockout assertion refuses to build with SSH password-off + zero keys (permanent remote lockout otherwise).openFirewall=falseso OpenSSH's default global port-22 opening can't defeat the mesh-only rule.nixos/keep-node.nix: import the module.flake.nix: anadminKeyFixture(ed25519 operator keypair) + themesh-admin-sshcheck.tests/mesh-admin-ssh.nix: two nodes onboarded onto the mesh; the "operator" (a mesh peer) keys into keepadmin OVER THE MESH with passwordless sudo, the SAME SSH is REFUSED on the LAN/underlay address (proving mesh-only), and sshd's effective config is the hardened posture. The negative test caught a real bug during development: OpenSSH'sopenFirewalldefault would have silently exposed SSH to the LAN.Summary by CodeRabbit
New Features
keepadminaccount and mesh-only port 22 access.Bug Fixes
Tests