sliftutils 1.7.124 → 1.7.125

package/CLAUDE.md

@@ -8,10 +8,12 @@ from `.cursor/rules/*.mdc` so Claude reads them automatically.
 - The code automatically updates on save, so do not ever run commands to rerun the site.
 - Don't run shell commands when you need to create or move small code files. Use tool calls. Use tool calls to make files within folders — you don't need to make the folder, just make the file, the folder will be created automatically.
 - If you need to add a dependency, don't just edit `package.json`. Use `yarn add` so you get the latest version, unless the user specifies a version.
-- Use tool calls to read files and directories instead of running `ls`, `dir`, etc.
+- Use tool calls to read and write files and directories, as opposed to shell commands running `ls`, `dir`, etc.
+  
 
 ## Coding styles
 
+- Do not use synchronous file IO, or synchronous child_process functions.
 - Times should almost always be in milliseconds; assume milliseconds if not told otherwise.
 - Don't make functions that will never be reused and are short. If under 5 lines and not reused, don't create it unless explicitly told to.
 - Comments are used sparingly and only when required to explain what's being done. A comment that just restates the function name is forbidden.

package/bin/securessh.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+"use strict";
+// Manages which repos a host takes its root authorized_keys from, and installs the daemon that
+// keeps them applied.
+require("typenode");
+
+require("../security/authorizedKeys/secureSSH").main().catch(e => {
+    console.error(`${e}`);
+    process.exitCode = 1;
+}).finally(() => process.exit());

package/bin/setupnotify.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+"use strict";
+// Sets a Discord webhook up on a remote host, so anything on it can raise notifications.
+require("typenode");
+
+require("../security/notifications/setupNotify").main().catch(e => {
+    console.error(`${e}`);
+    process.exitCode = 1;
+}).finally(() => process.exit());

package/bin/signfiles.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+"use strict";
+// Signs the files of the repo in the current directory, so a machine pulling it can tell who
+// published what it is about to trust.
+require("typenode");
+
+require("../security/signedFiles/signFiles").main().catch(e => {
+    console.error(`${e}`);
+    process.exitCode = 1;
+}).finally(() => process.exit());

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sliftutils",
-    "version": "1.7.124",
+    "version": "1.7.125",
     "main": "index.js",
     "license": "MIT",
     "files": [
@@ -28,7 +28,10 @@
         "notes": "mobx, preact, socket-function, typenode SHOULD be peerDependencies. But we want to use yarn (better dependency deduplication), so we can't use peerDependencies (as they aren't installed by default, which makes them a nightmare to use). If you want to override the versions, feel free to use overrides/resolutions.",
         "test": "typenode ./test.ts",
         "filehoster": "node ./bin/filehoster.js",
-        "autohost": "node ./bin/autohost.js"
+        "autohost": "node ./bin/autohost.js",
+        "setupnotify": "node ./bin/setupnotify.js",
+        "securessh": "node ./bin/securessh.js",
+        "signfiles": "node ./bin/signfiles.js"
     },
     "bin": {
         "filehoster": "./bin/filehoster.js",
@@ -45,7 +48,10 @@
         "slift-watch": "./builders/watchRun.js",
         "sliftwatch": "./builders/watchRun.js",
         "slift-setup": "./builders/setupRun.js",
-        "sliftsetup": "./builders/setupRun.js"
+        "sliftsetup": "./builders/setupRun.js",
+        "setupnotify": "./bin/setupnotify.js",
+        "securessh": "./bin/securessh.js",
+        "signfiles": "./bin/signfiles.js"
     },
     "dependencies": {
         "@types/chrome": "^0.0.237",

package/security/README.md

@@ -0,0 +1,77 @@
+# security
+
+Tools for locking down machines. One folder per kind of security concern.
+
+## notifications
+
+Discord notifications, so a machine can raise the alarm somewhere a person will see it.
+
+The webhook lives on the machine that sends, in `/etc/portsecure/discord-webhook`, and nothing
+starts without one. `configureDiscordNotifications` loads it and aborts the process if it is
+missing, then watches the file and warns the old webhook if it is ever swapped.
+
+    yarn setupnotify <host> <discord-webhook-url> [replace]
+
+`replace` is required to overwrite a host's existing webhook with a different one.
+
+## authorizedKeys
+
+Keeps root's `authorized_keys` equal to the merged contents of one or more git repos, and turns
+off every other way in.
+
+    yarn securessh <host> add <repo-private-key> [repo-url]
+    yarn securessh <host> remove [repo-url]
+    yarn securessh <host> list
+
+With no repo url, the repo you are standing in is used, as long as it holds keys and has an
+origin to clone from.
+
+Each source repo keeps its own deploy key. Both verbs refuse to run if the key you log in with
+would not survive the change, since that would lock you out of the host permanently.
+
+`daemon/portsecureDaemon.js` is what actually runs on the host, under systemd. It is plain
+JavaScript on the Node built-ins alone so a target machine needs nothing installed. It:
+
+- rewrites root's `authorized_keys` from the merged sources, archiving whatever it replaces
+- reverts and reports edits made outside it, every 60 seconds
+- reports changes to any other account's `authorized_keys`, without touching them
+- polls every source every 5 minutes, and reports a repo whose history was rewritten
+- disables password authentication, after checking `sshd` accepts the config
+
+With no sources, or none readable, it leaves `authorized_keys` exactly as it is rather than
+locking everyone out.
+
+The daemon carries hand ports of several TypeScript files here, because it cannot import them.
+Both copies are marked `PORTED CODE` and have to be changed together.
+
+## signedFiles
+
+Signs everything in a repo, so a machine pulling it can tell who published what it is about to
+trust. Run it inside the repo you want signed.
+
+    yarn signfiles [signing-key] [git]
+
+`signedfiles.json` lists every non-ignored file with its size and sha256, and
+`signedfiles.json.sig` is an ssh signature over it. With no key given, a hardware backed
+`ed25519-sk` key at `~/.ssh/signfiles_ed25519_sk` is used, and created if missing - a key on disk
+is compromised the moment the machine is, so the hardware key is the point. `git` also commits
+and pushes, after signing, so a failed push never costs a second touch of the key.
+
+### How authorizedKeys uses it
+
+The daemon records the signer it last accepted for each source, and the keys it accepted from
+them, on disk. Those recorded values are the reference, not the repo, because the repo is what an
+attacker would be rewriting.
+
+When a source starts being signed by a different key, the daemon warns on Discord and keeps
+applying the keys it last accepted. It applies the new ones only after 24 hours of that same new
+signer. Any different signer restarts the wait, so publishing twice in a row gains nothing, and a
+return to the accepted signer cancels it. Losing a signature entirely counts as a change too, so
+stripping it does not get anything through faster.
+
+A signature that does not verify, or a manifest that does not match the files on disk, is never
+treated as an identity - that content is ignored and the last accepted keys stay.
+
+## helpers
+
+Shared plumbing: running commands over ssh, spawning child processes, and expanding `~`.

package/security/authorizedKeys/authorizedKeys.ts

@@ -0,0 +1,43 @@
+import fs from "fs/promises";
+import path from "path";
+
+// PORTED CODE: security/authorizedKeys/daemon/portsecureDaemon.js contains a plain JS port of normalizeKeys,
+// summarizeKey and readRepoKeys, so it can resolve the same keys with no dependencies. The two
+// must agree on which keys a repo produces - if you change one, make the matching change in the
+// other.
+
+export function normalizeKeys(contents: string) {
+    return contents.split("\n").map(line => line.trim()).filter(line => line && !line.startsWith("#"));
+}
+
+/** Enough to recognise whose key this is without printing the whole blob. */
+export function summarizeKey(keyLine: string) {
+    let parts = keyLine.trim().split(/\s+/);
+    let typeIndex = parts.findIndex(part => /^(ssh-|ecdsa-|sk-)/.test(part));
+    if (typeIndex < 0) {
+        return keyLine.slice(0, 60);
+    }
+    let type = parts[typeIndex];
+    let blob = parts[typeIndex + 1] || "";
+    let comment = parts.slice(typeIndex + 2).join(" ");
+    return `${type} ...${blob.slice(-12)}${comment && ` ${comment}` || ""}`;
+}
+
+/** Reads the authorized keys a repo checkout wants applied. Prefers a top level authorized_keys
+    file and otherwise concatenates every .pub at the top level. */
+export async function readRepoKeys(repoPath: string) {
+    let combinedPath = path.join(repoPath, "authorized_keys");
+    let entries = await fs.readdir(repoPath);
+    if (entries.includes("authorized_keys")) {
+        return normalizeKeys(await fs.readFile(combinedPath, "utf8"));
+    }
+    let pubFiles = entries.filter(name => name.endsWith(".pub")).sort();
+    if (!pubFiles.length) {
+        throw new Error(`Expected authorized_keys or at least one .pub file in ${repoPath}, found neither`);
+    }
+    let keys: string[] = [];
+    for (let name of pubFiles) {
+        keys.push(...normalizeKeys(await fs.readFile(path.join(repoPath, name), "utf8")));
+    }
+    return keys;
+}

package/security/authorizedKeys/daemon/portsecure.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=portsecure authorized keys daemon
+Documentation=https://github.com/sliftist/portsecure
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/env node /opt/portsecure/portsecure-daemon.js
+User=root
+# Availability is the point of this daemon, so it always comes back.
+Restart=always
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target