sliftutils 1.7.125 → 1.7.127

package/bin/derivekey.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+"use strict";
+// Derives a second ed25519 key from an existing one, so one key can stand behind several
+// identities without any of them being stored.
+require("typenode");
+
+require("../security/keys/deriveKey").main().catch(e => {
+    console.error(`${e}`);
+    process.exitCode = 1;
+}).finally(() => process.exit());

package/bin/portsecuredaemon.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+"use strict";
+// The daemon that keeps a machine's root authorized_keys equal to its key repos. Installed and
+// started by securessh, and normally only run by systemd.
+//
+// Deliberately without the usual finally(process.exit) of the other entry points: this one is
+// meant to keep running after main resolves, and exiting there would stop it dead on startup.
+require("typenode");
+
+require("../security/authorizedKeys/daemon/daemon").main().catch(e => {
+    console.error(`portsecure: failed to start. ${e && e.stack || e}`);
+    process.exit(1);
+});

package/bin/testnotify.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+"use strict";
+// Sends one message to a webhook, to prove notifications work.
+require("typenode");
+
+require("../security/notifications/testNotify").main().catch(e => {
+    console.error(`${e}`);
+    process.exitCode = 1;
+}).finally(() => process.exit());

package/bin/unrevoke.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+"use strict";
+// Undoes revocations, by writing a file into the keys repo naming the ones to undo.
+require("typenode");
+
+require("../security/authorizedKeys/unrevoke").main().catch(e => {
+    console.error(`${e}`);
+    process.exitCode = 1;
+}).finally(() => process.exit());

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sliftutils",
-    "version": "1.7.125",
+    "version": "1.7.127",
     "main": "index.js",
     "license": "MIT",
     "files": [
@@ -31,7 +31,10 @@
         "autohost": "node ./bin/autohost.js",
         "setupnotify": "node ./bin/setupnotify.js",
         "securessh": "node ./bin/securessh.js",
-        "signfiles": "node ./bin/signfiles.js"
+        "signfiles": "node ./bin/signfiles.js",
+        "derivekey": "node ./bin/derivekey.js",
+        "unrevoke": "node ./bin/unrevoke.js",
+        "testnotify": "node ./bin/testnotify.js"
     },
     "bin": {
         "filehoster": "./bin/filehoster.js",
@@ -51,7 +54,11 @@
         "sliftsetup": "./builders/setupRun.js",
         "setupnotify": "./bin/setupnotify.js",
         "securessh": "./bin/securessh.js",
-        "signfiles": "./bin/signfiles.js"
+        "signfiles": "./bin/signfiles.js",
+        "derivekey": "./bin/derivekey.js",
+        "portsecuredaemon": "./bin/portsecuredaemon.js",
+        "unrevoke": "./bin/unrevoke.js",
+        "testnotify": "./bin/testnotify.js"
     },
     "dependencies": {
         "@types/chrome": "^0.0.237",

package/security/README.md

@@ -22,10 +22,18 @@ off every other way in.
     yarn securessh <host> add <repo-private-key> [repo-url]
     yarn securessh <host> remove [repo-url]
     yarn securessh <host> list
+    yarn securessh <host> update
 
 With no repo url, the repo you are standing in is used, as long as it holds keys and has an
 origin to clone from.
 
+The daemon runs on the host, so `update` is how a host picks up a newer build of it. It changes
+nothing about which keys that host trusts.
+
+`update` installs the daemon from this checkout, not from anything the host fetches, so it pulls
+this checkout first and stops if that pull does not fast forward. It never installs code it
+cannot account for.
+
 Each source repo keeps its own deploy key. Both verbs refuse to run if the key you log in with
 would not survive the change, since that would lock you out of the host permanently.
 
@@ -67,10 +75,66 @@ When a source starts being signed by a different key, the daemon warns on Discor
 applying the keys it last accepted. It applies the new ones only after 24 hours of that same new
 signer. Any different signer restarts the wait, so publishing twice in a row gains nothing, and a
 return to the accepted signer cancels it. Losing a signature entirely counts as a change too, so
-stripping it does not get anything through faster.
+stripping it does not get anything through faster. Going the other way, from unsigned to signed,
+is only ever an improvement and applies right away.
+
+Every one of those messages names the public key, in the same `type base64` form `signfiles`
+prints, or `<no public key>` when there is none.
 
 A signature that does not verify, or a manifest that does not match the files on disk, is never
-treated as an identity - that content is ignored and the last accepted keys stay.
+treated as an identity - that content is ignored and the last accepted keys stay. Which of the
+two it is gets reported:
+
+- the signature is byte for byte the one we already accepted, so the repo changed and nobody
+  re-signed it. The changes are ignored until someone runs `signfiles` again.
+- the signature did change and does not hold up, so it is corrupt.
+
+Either way it is reported once, not every time it is polled.
+
+## keys
+
+Derives a second ed25519 key from an existing one, by mixing a label into the source key's secret.
+The same label and source always give the same key, so a derived key is something you can work out
+again rather than something you have to keep a backup of.
+
+    yarn derivekey <label> <source-key> <derived-key>
+    yarn derivekey revokegithubkey ~/authorized_keys_access/id_ed25519 ~/authorized_keys_access/id_ed25519_revoke
+
+It writes an ordinary OpenSSH key pair, so the public key can be handed to anything that takes one.
+`deriveEd25519Key` in `deriveKey.ts` is the part to import elsewhere, and `sshKeyFile.ts` reads and
+writes the OpenSSH private key container that node itself cannot.
+
+### Revoking keys
+
+A key that is used from an address its `from=` restriction does not allow is revoked everywhere,
+not just refused. The daemon reads sshd's log for exactly that refusal, takes the fingerprint sshd
+names for the same connection, and writes a revocation to the source's revoke repo.
+
+The revoke repo is derived from the source: `…/authorized_keys.git` gets `…/authorized_keys_revoked.git`,
+reached with a key derived from the source's deploy key under the label `revokegithubkey`. Github
+will not take one public key on two repos, which is why it is derived rather than reused, and it
+means nothing extra has to be configured or uploaded - anything holding the source key can work it
+out. `securessh add` checks that repo exists and is writable, and prints the deploy key to add if
+it is not.
+
+- One revocation per key, ever. The file is named after the fingerprint, and the key is checked
+  against local state before any network work, so a flood of unknown keys cannot become a flood of
+  commits.
+- A revocation is sticky once seen. Deleting it from the repo does not bring the key back: the key
+  that writes revocations is on every server, so whoever stole one could otherwise erase the record
+  that locked them out. Recovering from that means making a new key, which you would want anyway.
+- Each machine says so on Discord when a revoked key actually leaves its authorized_keys, once.
+
+    yarn unrevoke [keys-repo]
+
+Run in the keys repo, or name one. It uses whatever git credentials the machine already has, since
+the derived deploy key is for servers rather than for people. It reads the revoke repo and writes
+one file under `unrevoked/` naming the revocations to undo, which then needs signing and pushing. Machines report when they see it, hold
+it for an hour, then report again when it takes effect - so a signing key that was itself stolen
+cannot instantly undo the revocation that shut it out.
+
+Deleting a revoked key from the repo is usually the right answer instead. Both `signfiles` and
+`securessh` refuse while a repo still holds a revoked key, and say which one it is.
 
 ## helpers
 

package/security/authorizedKeys/authorizedKeys.ts

@@ -1,15 +1,45 @@
+import crypto from "crypto";
 import fs from "fs/promises";
 import path from "path";
 
-// PORTED CODE: security/authorizedKeys/daemon/portsecureDaemon.js contains a plain JS port of normalizeKeys,
-// summarizeKey and readRepoKeys, so it can resolve the same keys with no dependencies. The two
-// must agree on which keys a repo produces - if you change one, make the matching change in the
-// other.
-
 export function normalizeKeys(contents: string) {
     return contents.split("\n").map(line => line.trim()).filter(line => line && !line.startsWith("#"));
 }
 
+/** The fingerprint ssh itself reports for a key, which is what the sshd log names and therefore
+    what a revocation is keyed by. Returns "" for a line that holds no key. */
+export function keyFingerprint(keyLine: string) {
+    let parts = keyLine.trim().split(/\s+/);
+    let typeIndex = parts.findIndex(part => /^(ssh-|ecdsa-|sk-)/.test(part));
+    let blob = typeIndex >= 0 && parts[typeIndex + 1] || "";
+    if (!blob) {
+        return "";
+    }
+    return "SHA256:" + crypto.createHash("sha256").update(Buffer.from(blob, "base64")).digest("base64").replace(/=+$/, "");
+}
+
+export const NO_RESTRICTION = "ANY ADDRESS (no from= restriction)";
+
+/** The addresses a key may be used from, one by one, or undefined when the key carries no from=
+    at all. Undefined and an empty list are very different things, so they stay distinguishable. */
+export function keyRestrictionList(keyLine: string) {
+    let match = keyLine.match(/from="([^"]*)"/);
+    if (!match) {
+        return undefined;
+    }
+    return match[1].split(",").map(entry => entry.trim()).filter(entry => entry);
+}
+
+/** The addresses a key may be used from, which is the part of an authorized_keys line that
+    decides how much a stolen key is worth. A key with no restriction says so loudly. */
+export function keyRestriction(keyLine: string) {
+    let list = keyRestrictionList(keyLine);
+    if (!list) {
+        return NO_RESTRICTION;
+    }
+    return list.join(",");
+}
+
 /** Enough to recognise whose key this is without printing the whole blob. */
 export function summarizeKey(keyLine: string) {
     let parts = keyLine.trim().split(/\s+/);
@@ -23,6 +53,39 @@ export function summarizeKey(keyLine: string) {
     return `${type} ...${blob.slice(-12)}${comment && ` ${comment}` || ""}`;
 }
 
+/** What a set of keys has to satisfy before it is worth signing, as a list of complaints.
+
+    Every key needs a from=, because an unrestricted key can never be caught being used from the
+    wrong place, and being caught is the only thing that triggers a revocation.
+
+    No two keys may allow the same addresses, because that is one person holding two keys: revoking
+    one of them leaves the other working, so the revocation achieves nothing. */
+export function findKeyProblems(keys: string[]) {
+    let problems: string[] = [];
+    let byRestriction = new Map<string, string[]>();
+    for (let key of keys) {
+        let restriction = keyRestrictionList(key);
+        if (!restriction) {
+            problems.push(`no from= restriction, so it can be used from anywhere:\n      ${summarizeKey(key)}`);
+            continue;
+        }
+        // Sorted, so the same addresses written in a different order still count as the same.
+        let identity = [...restriction].sort().join(",");
+        byRestriction.set(identity, [...(byRestriction.get(identity) || []), key]);
+    }
+    for (let [restriction, sharing] of byRestriction) {
+        if (sharing.length < 2) {
+            continue;
+        }
+        problems.push(
+            `${sharing.length} keys allow exactly the same addresses (${restriction}), which is one`
+            + ` person holding more than one key:\n`
+            + sharing.map(key => `      ${summarizeKey(key)}`).join("\n")
+        );
+    }
+    return problems;
+}
+
 /** Reads the authorized keys a repo checkout wants applied. Prefers a top level authorized_keys
     file and otherwise concatenates every .pub at the top level. */
 export async function readRepoKeys(repoPath: string) {

package/security/authorizedKeys/daemon/authLog.ts

@@ -0,0 +1,186 @@
+import crypto from "crypto";
+import { watch } from "fs";
+import fs from "fs/promises";
+import path from "path";
+import { spawnPromise } from "../../helpers/spawn";
+import { AUTH_LOG_PATH } from "./paths";
+import { getState, saveState } from "./state";
+import { Attempt } from "./revocation";
+
+// sshd says an attempt was refused in one line and names the key in another, both for the same
+// connection, so they are tied together by the process id the log puts on every line.
+const REFUSED = /Authentication tried for (\S+) with correct key but not from a permitted host \(host=([^,]*), ip=([^,]*), required=([^)]*)\)/;
+const FAILED_KEY = /Failed publickey for (\S+) from (\S+) port (\d+) ssh2: \S+ (SHA256:[A-Za-z0-9+/=]+)/;
+const PROCESS_ID = /(?:sshd|sshd-session)\[(\d+)\]/;
+// Enough of the head of the file to notice it was rotated out from under us.
+const SIGNATURE_LENGTH = 512;
+
+export type RefusedAttempt = { fingerprint: string; attempt: Attempt };
+
+// The two halves of one refusal are separate log lines, written milliseconds apart, and a watcher
+// woken by the first of them reads only as far as that. So the halves are kept between reads and
+// paired when both have arrived, keyed by the connection's process id.
+let refusals = new Map<string, { user: string; ip: string; required: string; line: string }[]>();
+let fingerprints = new Map<string, { fingerprint: string; port: string }>();
+// A half that never finds its other half would otherwise sit there forever. Maps keep insertion
+// order, so the oldest are the ones to drop.
+const MAX_HALVES = 500;
+
+function forget(half: Map<string, unknown>) {
+    while (half.size > MAX_HALVES) {
+        let oldest = half.keys().next().value;
+        if (oldest === undefined) {
+            return;
+        }
+        half.delete(oldest);
+    }
+}
+
+/** Pairs each refusal with the fingerprint sshd logged for the same connection. A refusal we
+    cannot tie to a key is held rather than acted on: revoking the wrong key would lock out the
+    wrong person, and the line naming the key usually arrives a moment later. */
+export function parseAuthLog(contents: string) {
+    for (let line of contents.split("\n")) {
+        let processMatch = line.match(PROCESS_ID);
+        if (!processMatch) {
+            continue;
+        }
+        let processId = processMatch[1];
+        let refused = line.match(REFUSED);
+        if (refused) {
+            let existing = refusals.get(processId) || [];
+            existing.push({ user: refused[1], ip: refused[3], required: refused[4], line: line.trim() });
+            refusals.set(processId, existing);
+            continue;
+        }
+        let failed = line.match(FAILED_KEY);
+        if (failed) {
+            fingerprints.set(processId, { fingerprint: failed[4], port: failed[3] });
+        }
+    }
+
+    let attempts: RefusedAttempt[] = [];
+    for (let [processId, entries] of [...refusals]) {
+        let key = fingerprints.get(processId);
+        if (!key) {
+            // The line naming the key has not been written yet, or not been read yet. Kept for the
+            // next read rather than thrown away.
+            continue;
+        }
+        for (let entry of entries) {
+            attempts.push({
+                fingerprint: key.fingerprint,
+                attempt: {
+                    ip: entry.ip,
+                    user: entry.user,
+                    port: key.port,
+                    required: entry.required,
+                    line: entry.line,
+                },
+            });
+        }
+        // Paired, so neither half is needed again.
+        refusals.delete(processId);
+        fingerprints.delete(processId);
+    }
+    forget(refusals);
+    forget(fingerprints);
+    return attempts;
+}
+
+/** Only what has been written since last time. A rotated file starts again from the beginning,
+    and a file that only grew is read from where we stopped. */
+export async function readNewAuthLog() {
+    let state = getState();
+    let handle;
+    try {
+        handle = await fs.open(AUTH_LOG_PATH, "r");
+    } catch (e) {
+        // Some machines only keep this in the journal.
+        let result = await spawnPromise({
+            command: "journalctl",
+            args: ["-u", "ssh", "-u", "sshd", "--no-pager", "--since", "-10min"],
+        });
+        if (result.status !== 0) {
+            console.log(`No auth log to read: ${AUTH_LOG_PATH} is unreadable and journalctl exited ${result.status}`);
+            return "";
+        }
+        return result.stdout;
+    }
+    try {
+        let stats = await handle.stat();
+        let head = Buffer.alloc(Math.min(SIGNATURE_LENGTH, stats.size));
+        await handle.read(head, 0, head.length, 0);
+        let signature = crypto.createHash("sha256").update(head).digest("hex");
+
+        if (!state.authLogSignature) {
+            // First time we have ever looked. Start from the end: the log holds history from
+            // before this machine watched it, and revoking keys over refusals nobody was watching
+            // for could take away access that is still in use.
+            state.authLogOffset = stats.size;
+            state.authLogSignature = signature;
+            await saveState();
+            console.log(`Watching ${AUTH_LOG_PATH} from its current end, ${stats.size} bytes in`);
+            return "";
+        }
+        let offset = state.authLogOffset;
+        if (signature !== state.authLogSignature || stats.size < offset) {
+            // Rotated, or replaced. Everything in the new file is new.
+            offset = 0;
+        }
+        if (stats.size === offset) {
+            return "";
+        }
+        let contents = Buffer.alloc(stats.size - offset);
+        await handle.read(contents, 0, contents.length, offset);
+        state.authLogOffset = stats.size;
+        state.authLogSignature = signature;
+        await saveState();
+        return contents.toString("utf8");
+    } finally {
+        await handle.close();
+    }
+}
+
+/** Reacts when sshd writes, rather than on a timer. A refused login is worth acting on at once,
+    and nothing is gained by hearing about it up to a minute later.
+
+    The directory is watched rather than the file. A watch on the file follows the inode, so it
+    goes silent the moment the log is rotated out from under it, while the directory keeps
+    reporting both the writes and the rotation. */
+export function watchAuthLog(onChange: () => Promise<void>) {
+    let running = false;
+    let againWhenDone = false;
+    let run = async () => {
+        // One at a time. Whatever arrives mid run is covered by a single further pass, rather than
+        // by however many events happened to fire.
+        if (running) {
+            againWhenDone = true;
+            return;
+        }
+        running = true;
+        try {
+            await onChange();
+        } catch (e) {
+            console.log(`Reading ${AUTH_LOG_PATH} failed. ${e}`);
+        }
+        running = false;
+        if (againWhenDone) {
+            againWhenDone = false;
+            void run();
+        }
+    };
+
+    let name = path.basename(AUTH_LOG_PATH);
+    try {
+        watch(path.dirname(AUTH_LOG_PATH), (type, changed) => {
+            if (changed === name) {
+                void run();
+            }
+        });
+        console.log(`Watching ${AUTH_LOG_PATH} for refused logins`);
+    } catch (e) {
+        console.log(`Cannot watch ${AUTH_LOG_PATH}, so refused logins will not be noticed. ${e}`);
+    }
+    return run;
+}

package/security/authorizedKeys/daemon/changes.ts

@@ -0,0 +1,26 @@
+// Why root's authorized_keys is about to change, collected as it happens.
+//
+// Nothing announces itself at the moment it decides something. A revocation arriving, a key being
+// revoked here, an unrevoke taking effect, a repo moving on: each of those says what it is and
+// leaves it here. The file is then written, and only if it actually came out different does any of
+// it get reported, in one message.
+//
+// Doing it the other way round is what produced several messages for one event, and messages about
+// removing a key that had already gone.
+
+let reasons: string[] = [];
+
+export function addChangeReason(reason: string) {
+    // The same reason twice in one pass says nothing the once did not.
+    if (!reasons.includes(reason)) {
+        reasons.push(reason);
+    }
+}
+
+/** The reasons gathered since the last write, and clears them. Called whether or not anything
+    changed, so reasons that came to nothing cannot show up against some later change. */
+export function takeChangeReasons() {
+    let taken = reasons;
+    reasons = [];
+    return taken;
+}