sliftutils 1.7.124 → 1.7.126

package/CLAUDE.md

@@ -8,10 +8,12 @@ from `.cursor/rules/*.mdc` so Claude reads them automatically.
 - The code automatically updates on save, so do not ever run commands to rerun the site.
 - Don't run shell commands when you need to create or move small code files. Use tool calls. Use tool calls to make files within folders — you don't need to make the folder, just make the file, the folder will be created automatically.
 - If you need to add a dependency, don't just edit `package.json`. Use `yarn add` so you get the latest version, unless the user specifies a version.
-- Use tool calls to read files and directories instead of running `ls`, `dir`, etc.
+- Use tool calls to read and write files and directories, as opposed to shell commands running `ls`, `dir`, etc.
+  
 
 ## Coding styles
 
+- Do not use synchronous file IO, or synchronous child_process functions.
 - Times should almost always be in milliseconds; assume milliseconds if not told otherwise.
 - Don't make functions that will never be reused and are short. If under 5 lines and not reused, don't create it unless explicitly told to.
 - Comments are used sparingly and only when required to explain what's being done. A comment that just restates the function name is forbidden.

package/bin/derivekey.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+"use strict";
+// Derives a second ed25519 key from an existing one, so one key can stand behind several
+// identities without any of them being stored.
+require("typenode");
+
+require("../security/keys/deriveKey").main().catch(e => {
+    console.error(`${e}`);
+    process.exitCode = 1;
+}).finally(() => process.exit());

package/bin/portsecuredaemon.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+"use strict";
+// The daemon that keeps a machine's root authorized_keys equal to its key repos. Installed and
+// started by securessh, and normally only run by systemd.
+//
+// Deliberately without the usual finally(process.exit) of the other entry points: this one is
+// meant to keep running after main resolves, and exiting there would stop it dead on startup.
+require("typenode");
+
+require("../security/authorizedKeys/daemon/daemon").main().catch(e => {
+    console.error(`portsecure: failed to start. ${e && e.stack || e}`);
+    process.exit(1);
+});

package/bin/securessh.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+"use strict";
+// Manages which repos a host takes its root authorized_keys from, and installs the daemon that
+// keeps them applied.
+require("typenode");
+
+require("../security/authorizedKeys/secureSSH").main().catch(e => {
+    console.error(`${e}`);
+    process.exitCode = 1;
+}).finally(() => process.exit());

package/bin/setupnotify.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+"use strict";
+// Sets a Discord webhook up on a remote host, so anything on it can raise notifications.
+require("typenode");
+
+require("../security/notifications/setupNotify").main().catch(e => {
+    console.error(`${e}`);
+    process.exitCode = 1;
+}).finally(() => process.exit());

package/bin/signfiles.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+"use strict";
+// Signs the files of the repo in the current directory, so a machine pulling it can tell who
+// published what it is about to trust.
+require("typenode");
+
+require("../security/signedFiles/signFiles").main().catch(e => {
+    console.error(`${e}`);
+    process.exitCode = 1;
+}).finally(() => process.exit());

package/bin/unrevoke.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+"use strict";
+// Undoes revocations, by writing a file into the keys repo naming the ones to undo.
+require("typenode");
+
+require("../security/authorizedKeys/unrevoke").main().catch(e => {
+    console.error(`${e}`);
+    process.exitCode = 1;
+}).finally(() => process.exit());

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sliftutils",
-    "version": "1.7.124",
+    "version": "1.7.126",
     "main": "index.js",
     "license": "MIT",
     "files": [
@@ -28,7 +28,12 @@
         "notes": "mobx, preact, socket-function, typenode SHOULD be peerDependencies. But we want to use yarn (better dependency deduplication), so we can't use peerDependencies (as they aren't installed by default, which makes them a nightmare to use). If you want to override the versions, feel free to use overrides/resolutions.",
         "test": "typenode ./test.ts",
         "filehoster": "node ./bin/filehoster.js",
-        "autohost": "node ./bin/autohost.js"
+        "autohost": "node ./bin/autohost.js",
+        "setupnotify": "node ./bin/setupnotify.js",
+        "securessh": "node ./bin/securessh.js",
+        "signfiles": "node ./bin/signfiles.js",
+        "derivekey": "node ./bin/derivekey.js",
+        "unrevoke": "node ./bin/unrevoke.js"
     },
     "bin": {
         "filehoster": "./bin/filehoster.js",
@@ -45,7 +50,13 @@
         "slift-watch": "./builders/watchRun.js",
         "sliftwatch": "./builders/watchRun.js",
         "slift-setup": "./builders/setupRun.js",
-        "sliftsetup": "./builders/setupRun.js"
+        "sliftsetup": "./builders/setupRun.js",
+        "setupnotify": "./bin/setupnotify.js",
+        "securessh": "./bin/securessh.js",
+        "signfiles": "./bin/signfiles.js",
+        "derivekey": "./bin/derivekey.js",
+        "portsecuredaemon": "./bin/portsecuredaemon.js",
+        "unrevoke": "./bin/unrevoke.js"
     },
     "dependencies": {
         "@types/chrome": "^0.0.237",

package/security/README.md

@@ -0,0 +1,141 @@
+# security
+
+Tools for locking down machines. One folder per kind of security concern.
+
+## notifications
+
+Discord notifications, so a machine can raise the alarm somewhere a person will see it.
+
+The webhook lives on the machine that sends, in `/etc/portsecure/discord-webhook`, and nothing
+starts without one. `configureDiscordNotifications` loads it and aborts the process if it is
+missing, then watches the file and warns the old webhook if it is ever swapped.
+
+    yarn setupnotify <host> <discord-webhook-url> [replace]
+
+`replace` is required to overwrite a host's existing webhook with a different one.
+
+## authorizedKeys
+
+Keeps root's `authorized_keys` equal to the merged contents of one or more git repos, and turns
+off every other way in.
+
+    yarn securessh <host> add <repo-private-key> [repo-url]
+    yarn securessh <host> remove [repo-url]
+    yarn securessh <host> list
+    yarn securessh <host> update
+
+With no repo url, the repo you are standing in is used, as long as it holds keys and has an
+origin to clone from.
+
+The daemon runs on the host, so `update` is how a host picks up a newer build of it. It changes
+nothing about which keys that host trusts.
+
+`update` installs the daemon from this checkout, not from anything the host fetches, so it pulls
+this checkout first and stops if that pull does not fast forward. It never installs code it
+cannot account for.
+
+Each source repo keeps its own deploy key. Both verbs refuse to run if the key you log in with
+would not survive the change, since that would lock you out of the host permanently.
+
+`daemon/portsecureDaemon.js` is what actually runs on the host, under systemd. It is plain
+JavaScript on the Node built-ins alone so a target machine needs nothing installed. It:
+
+- rewrites root's `authorized_keys` from the merged sources, archiving whatever it replaces
+- reverts and reports edits made outside it, every 60 seconds
+- reports changes to any other account's `authorized_keys`, without touching them
+- polls every source every 5 minutes, and reports a repo whose history was rewritten
+- disables password authentication, after checking `sshd` accepts the config
+
+With no sources, or none readable, it leaves `authorized_keys` exactly as it is rather than
+locking everyone out.
+
+The daemon carries hand ports of several TypeScript files here, because it cannot import them.
+Both copies are marked `PORTED CODE` and have to be changed together.
+
+## signedFiles
+
+Signs everything in a repo, so a machine pulling it can tell who published what it is about to
+trust. Run it inside the repo you want signed.
+
+    yarn signfiles [signing-key] [git]
+
+`signedfiles.json` lists every non-ignored file with its size and sha256, and
+`signedfiles.json.sig` is an ssh signature over it. With no key given, a hardware backed
+`ed25519-sk` key at `~/.ssh/signfiles_ed25519_sk` is used, and created if missing - a key on disk
+is compromised the moment the machine is, so the hardware key is the point. `git` also commits
+and pushes, after signing, so a failed push never costs a second touch of the key.
+
+### How authorizedKeys uses it
+
+The daemon records the signer it last accepted for each source, and the keys it accepted from
+them, on disk. Those recorded values are the reference, not the repo, because the repo is what an
+attacker would be rewriting.
+
+When a source starts being signed by a different key, the daemon warns on Discord and keeps
+applying the keys it last accepted. It applies the new ones only after 24 hours of that same new
+signer. Any different signer restarts the wait, so publishing twice in a row gains nothing, and a
+return to the accepted signer cancels it. Losing a signature entirely counts as a change too, so
+stripping it does not get anything through faster. Going the other way, from unsigned to signed,
+is only ever an improvement and applies right away.
+
+Every one of those messages names the public key, in the same `type base64` form `signfiles`
+prints, or `<no public key>` when there is none.
+
+A signature that does not verify, or a manifest that does not match the files on disk, is never
+treated as an identity - that content is ignored and the last accepted keys stay. Which of the
+two it is gets reported:
+
+- the signature is byte for byte the one we already accepted, so the repo changed and nobody
+  re-signed it. The changes are ignored until someone runs `signfiles` again.
+- the signature did change and does not hold up, so it is corrupt.
+
+Either way it is reported once, not every time it is polled.
+
+## keys
+
+Derives a second ed25519 key from an existing one, by mixing a label into the source key's secret.
+The same label and source always give the same key, so a derived key is something you can work out
+again rather than something you have to keep a backup of.
+
+    yarn derivekey <label> <source-key> <derived-key>
+    yarn derivekey revokegithubkey ~/authorized_keys_access/id_ed25519 ~/authorized_keys_access/id_ed25519_revoke
+
+It writes an ordinary OpenSSH key pair, so the public key can be handed to anything that takes one.
+`deriveEd25519Key` in `deriveKey.ts` is the part to import elsewhere, and `sshKeyFile.ts` reads and
+writes the OpenSSH private key container that node itself cannot.
+
+### Revoking keys
+
+A key that is used from an address its `from=` restriction does not allow is revoked everywhere,
+not just refused. The daemon reads sshd's log for exactly that refusal, takes the fingerprint sshd
+names for the same connection, and writes a revocation to the source's revoke repo.
+
+The revoke repo is derived from the source: `…/authorized_keys.git` gets `…/authorized_keys_revoked.git`,
+reached with a key derived from the source's deploy key under the label `revokegithubkey`. Github
+will not take one public key on two repos, which is why it is derived rather than reused, and it
+means nothing extra has to be configured or uploaded - anything holding the source key can work it
+out. `securessh add` checks that repo exists and is writable, and prints the deploy key to add if
+it is not.
+
+- One revocation per key, ever. The file is named after the fingerprint, and the key is checked
+  against local state before any network work, so a flood of unknown keys cannot become a flood of
+  commits.
+- A revocation is sticky once seen. Deleting it from the repo does not bring the key back: the key
+  that writes revocations is on every server, so whoever stole one could otherwise erase the record
+  that locked them out. Recovering from that means making a new key, which you would want anyway.
+- Each machine says so on Discord when a revoked key actually leaves its authorized_keys, once.
+
+    yarn unrevoke [keys-repo]
+
+Run in the keys repo, or name one. It uses whatever git credentials the machine already has, since
+the derived deploy key is for servers rather than for people. It reads the revoke repo and writes
+one file under `unrevoked/` naming the revocations to undo, which then needs signing and pushing. Machines report when they see it, hold
+it for an hour, then report again when it takes effect - so a signing key that was itself stolen
+cannot instantly undo the revocation that shut it out.
+
+Deleting a revoked key from the repo is usually the right answer instead. Both `signfiles` and
+`securessh` refuse while a repo still holds a revoked key, and say which one it is.
+
+## helpers
+
+Shared plumbing: running commands over ssh, spawning child processes, and expanding `~`.

package/security/authorizedKeys/authorizedKeys.ts

@@ -0,0 +1,66 @@
+import crypto from "crypto";
+import fs from "fs/promises";
+import path from "path";
+
+// PORTED CODE: security/authorizedKeys/daemon/portsecureDaemon.js contains a plain JS port of normalizeKeys,
+// summarizeKey and readRepoKeys, so it can resolve the same keys with no dependencies. The two
+// must agree on which keys a repo produces - if you change one, make the matching change in the
+// other.
+
+export function normalizeKeys(contents: string) {
+    return contents.split("\n").map(line => line.trim()).filter(line => line && !line.startsWith("#"));
+}
+
+/** The fingerprint ssh itself reports for a key, which is what the sshd log names and therefore
+    what a revocation is keyed by. Returns "" for a line that holds no key. */
+export function keyFingerprint(keyLine: string) {
+    let parts = keyLine.trim().split(/\s+/);
+    let typeIndex = parts.findIndex(part => /^(ssh-|ecdsa-|sk-)/.test(part));
+    let blob = typeIndex >= 0 && parts[typeIndex + 1] || "";
+    if (!blob) {
+        return "";
+    }
+    return "SHA256:" + crypto.createHash("sha256").update(Buffer.from(blob, "base64")).digest("base64").replace(/=+$/, "");
+}
+
+/** The addresses a key may be used from, which is the part of an authorized_keys line that
+    decides how much a stolen key is worth. A key with no restriction says so loudly. */
+export function keyRestriction(keyLine: string) {
+    let match = keyLine.match(/from="([^"]*)"/);
+    if (!match) {
+        return "ANY ADDRESS (no from= restriction)";
+    }
+    return match[1];
+}
+
+/** Enough to recognise whose key this is without printing the whole blob. */
+export function summarizeKey(keyLine: string) {
+    let parts = keyLine.trim().split(/\s+/);
+    let typeIndex = parts.findIndex(part => /^(ssh-|ecdsa-|sk-)/.test(part));
+    if (typeIndex < 0) {
+        return keyLine.slice(0, 60);
+    }
+    let type = parts[typeIndex];
+    let blob = parts[typeIndex + 1] || "";
+    let comment = parts.slice(typeIndex + 2).join(" ");
+    return `${type} ...${blob.slice(-12)}${comment && ` ${comment}` || ""}`;
+}
+
+/** Reads the authorized keys a repo checkout wants applied. Prefers a top level authorized_keys
+    file and otherwise concatenates every .pub at the top level. */
+export async function readRepoKeys(repoPath: string) {
+    let combinedPath = path.join(repoPath, "authorized_keys");
+    let entries = await fs.readdir(repoPath);
+    if (entries.includes("authorized_keys")) {
+        return normalizeKeys(await fs.readFile(combinedPath, "utf8"));
+    }
+    let pubFiles = entries.filter(name => name.endsWith(".pub")).sort();
+    if (!pubFiles.length) {
+        throw new Error(`Expected authorized_keys or at least one .pub file in ${repoPath}, found neither`);
+    }
+    let keys: string[] = [];
+    for (let name of pubFiles) {
+        keys.push(...normalizeKeys(await fs.readFile(path.join(repoPath, name), "utf8")));
+    }
+    return keys;
+}

package/security/authorizedKeys/daemon/authLog.ts

@@ -0,0 +1,117 @@
+import crypto from "crypto";
+import fs from "fs/promises";
+import { spawnPromise } from "../../helpers/spawn";
+import { AUTH_LOG_PATH } from "./paths";
+import { getState, saveState } from "./state";
+import { Attempt } from "./revocation";
+
+// sshd says an attempt was refused in one line and names the key in another, both for the same
+// connection, so they are tied together by the process id the log puts on every line.
+const REFUSED = /Authentication tried for (\S+) with correct key but not from a permitted host \(host=([^,]*), ip=([^,]*), required=([^)]*)\)/;
+const FAILED_KEY = /Failed publickey for (\S+) from (\S+) port (\d+) ssh2: \S+ (SHA256:[A-Za-z0-9+/=]+)/;
+const PROCESS_ID = /(?:sshd|sshd-session)\[(\d+)\]/;
+// Enough of the head of the file to notice it was rotated out from under us.
+const SIGNATURE_LENGTH = 512;
+
+export type RefusedAttempt = { fingerprint: string; attempt: Attempt };
+
+/** Pairs each refusal with the fingerprint sshd logged for the same connection. A refusal we
+    cannot tie to a key is dropped: revoking the wrong key would lock out the wrong person. */
+export function parseAuthLog(contents: string) {
+    let refusals = new Map<string, { user: string; ip: string; required: string; line: string }[]>();
+    let fingerprints = new Map<string, { fingerprint: string; port: string }>();
+    for (let line of contents.split("\n")) {
+        let processMatch = line.match(PROCESS_ID);
+        if (!processMatch) {
+            continue;
+        }
+        let processId = processMatch[1];
+        let refused = line.match(REFUSED);
+        if (refused) {
+            let existing = refusals.get(processId) || [];
+            existing.push({ user: refused[1], ip: refused[3], required: refused[4], line: line.trim() });
+            refusals.set(processId, existing);
+            continue;
+        }
+        let failed = line.match(FAILED_KEY);
+        if (failed) {
+            fingerprints.set(processId, { fingerprint: failed[4], port: failed[3] });
+        }
+    }
+
+    let attempts: RefusedAttempt[] = [];
+    for (let [processId, entries] of refusals) {
+        let key = fingerprints.get(processId);
+        if (!key) {
+            console.log(`A refused attempt named no key, so nothing is being revoked for it: ${entries[0].line}`);
+            continue;
+        }
+        for (let entry of entries) {
+            attempts.push({
+                fingerprint: key.fingerprint,
+                attempt: {
+                    ip: entry.ip,
+                    user: entry.user,
+                    port: key.port,
+                    required: entry.required,
+                    line: entry.line,
+                },
+            });
+        }
+    }
+    return attempts;
+}
+
+/** Only what has been written since last time. A rotated file starts again from the beginning,
+    and a file that only grew is read from where we stopped. */
+export async function readNewAuthLog() {
+    let state = getState();
+    let handle;
+    try {
+        handle = await fs.open(AUTH_LOG_PATH, "r");
+    } catch (e) {
+        // Some machines only keep this in the journal.
+        let result = await spawnPromise({
+            command: "journalctl",
+            args: ["-u", "ssh", "-u", "sshd", "--no-pager", "--since", "-10min"],
+        });
+        if (result.status !== 0) {
+            console.log(`No auth log to read: ${AUTH_LOG_PATH} is unreadable and journalctl exited ${result.status}`);
+            return "";
+        }
+        return result.stdout;
+    }
+    try {
+        let stats = await handle.stat();
+        let head = Buffer.alloc(Math.min(SIGNATURE_LENGTH, stats.size));
+        await handle.read(head, 0, head.length, 0);
+        let signature = crypto.createHash("sha256").update(head).digest("hex");
+
+        if (!state.authLogSignature) {
+            // First time we have ever looked. Start from the end: the log holds history from
+            // before this machine watched it, and revoking keys over refusals nobody was watching
+            // for could take away access that is still in use.
+            state.authLogOffset = stats.size;
+            state.authLogSignature = signature;
+            await saveState();
+            console.log(`Watching ${AUTH_LOG_PATH} from its current end, ${stats.size} bytes in`);
+            return "";
+        }
+        let offset = state.authLogOffset;
+        if (signature !== state.authLogSignature || stats.size < offset) {
+            // Rotated, or replaced. Everything in the new file is new.
+            offset = 0;
+        }
+        if (stats.size === offset) {
+            return "";
+        }
+        let contents = Buffer.alloc(stats.size - offset);
+        await handle.read(contents, 0, contents.length, offset);
+        state.authLogOffset = stats.size;
+        state.authLogSignature = signature;
+        await saveState();
+        return contents.toString("utf8");
+    } finally {
+        await handle.close();
+    }
+}