underpost 3.2.90 → 3.3.0

package/src/cli/ssh.js

@@ -8,6 +8,14 @@ import { generateRandomPasswordSelection } from '../client/components/core/Commo
 import { pbcopy, shellExec } from '../server/process.js';
 import { loggerFactory } from '../server/logger.js';
 import { waitForPort } from '../server/conf.js';
+import {
+  runSELinuxCommands,
+  selinuxPackagesCommandFactory,
+  selinuxRestoreconCommandFactory,
+  selinuxSshContextCommandsFactory,
+  selinuxSshPortCommandsFactory,
+  shellArgumentFactory,
+} from '../server/selinux.js';
 import fs from 'fs-extra';
 import Underpost from '../index.js';
 
@@ -57,7 +65,7 @@ class UnderpostSSH {
      * @returns {boolean} True if user exists, false otherwise
      */
     checkUserExists: (username) => {
-      const result = shellExec(`id -u ${username} 2>/dev/null || echo "not_found"`, {
+      const result = shellExec(`id -u ${shellArgumentFactory(username)} 2>/dev/null || echo "not_found"`, {
         silent: true,
         stdout: true,
       }).trim();
@@ -73,7 +81,7 @@ class UnderpostSSH {
      * @returns {string} User's home directory path
      */
     getUserHome: (username) => {
-      return shellExec(`getent passwd ${username} | cut -d: -f6`, {
+      return shellExec(`getent passwd ${shellArgumentFactory(username)} | cut -d: -f6`, {
         silent: true,
         stdout: true,
       }).trim();
@@ -90,11 +98,13 @@ class UnderpostSSH {
      * @returns {void}
      */
     createSystemUser: (username, password, groups) => {
-      shellExec(`useradd -m -s /bin/bash ${username}`);
-      shellExec(`echo "${username}:${password}" | chpasswd`);
+      if (!/^[a-z_][a-z0-9_-]*[$]?$/i.test(username)) throw new TypeError('Invalid system username');
+      shellExec(`useradd -m -s /bin/bash ${shellArgumentFactory(username)}`);
+      shellExec(`printf '%s\n' ${shellArgumentFactory(`${username}:${password}`)} | chpasswd`, { disableLog: true });
       if (groups) {
         for (const group of groups.split(',').map((g) => g.trim())) {
-          shellExec(`usermod -aG "${group}" "${username}"`);
+          if (!/^[a-z_][a-z0-9_-]*[$]?$/i.test(group)) throw new TypeError('Invalid system group');
+          shellExec(`usermod -aG ${shellArgumentFactory(group)} ${shellArgumentFactory(username)}`);
         }
       }
     },
@@ -109,8 +119,8 @@ class UnderpostSSH {
      */
     ensureSSHDirectory: (sshDir) => {
       if (!fs.existsSync(sshDir)) {
-        shellExec(`mkdir -p ${sshDir}`);
-        shellExec(`chmod 700 ${sshDir}`);
+        shellExec(`mkdir -p ${shellArgumentFactory(sshDir)}`);
+        shellExec(`chmod 700 ${shellArgumentFactory(sshDir)}`);
       }
     },
 
@@ -126,11 +136,12 @@ class UnderpostSSH {
      * @returns {void}
      */
     setSSHFilePermissions: (sshDir, username, keyPath, pubKeyPath) => {
-      shellExec(`chmod 600 ${sshDir}/authorized_keys`);
-      shellExec(`chmod 644 ${sshDir}/known_hosts`);
-      if (keyPath) shellExec(`chmod 600 ${keyPath}`);
-      if (pubKeyPath) shellExec(`chmod 644 ${pubKeyPath}`);
-      shellExec(`chown -R ${username}:${username} ${sshDir}`);
+      shellExec(`chmod 600 ${shellArgumentFactory(`${sshDir}/authorized_keys`)}`);
+      shellExec(`chmod 644 ${shellArgumentFactory(`${sshDir}/known_hosts`)}`);
+      if (keyPath) shellExec(`chmod 600 ${shellArgumentFactory(keyPath)}`);
+      if (pubKeyPath) shellExec(`chmod 644 ${shellArgumentFactory(pubKeyPath)}`);
+      shellExec(`chown -R ${shellArgumentFactory(`${username}:${username}`)} ${shellArgumentFactory(sshDir)}`);
+      runSELinuxCommands(selinuxSshContextCommandsFactory({ sshDirectory: sshDir }), { execute: shellExec });
     },
 
     /**
@@ -144,13 +155,12 @@ class UnderpostSSH {
      * @returns {void}
      */
     configureAuthorizedKeys: (sshDir, pubKeyPath, disablePassword) => {
-      if (disablePassword) {
-        shellExec(`cat >> ${sshDir}/authorized_keys <<EOF
-no-port-forwarding,no-X11-forwarding,no-agent-forwarding ${fs.readFileSync(pubKeyPath, 'utf8')}
-EOF`);
-      } else {
-        shellExec(`cat ${pubKeyPath} >> ${sshDir}/authorized_keys`);
-      }
+      const key = fs.readFileSync(pubKeyPath, 'utf8').trim();
+      const entry = disablePassword ? `no-port-forwarding,no-X11-forwarding,no-agent-forwarding ${key}` : key;
+      const authorizedKeysPath = `${sshDir}/authorized_keys`;
+      shellExec(
+        `grep -qxF ${shellArgumentFactory(entry)} ${shellArgumentFactory(authorizedKeysPath)} || printf '%s\n' ${shellArgumentFactory(entry)} >> ${shellArgumentFactory(authorizedKeysPath)}`,
+      );
     },
 
     /**
@@ -164,9 +174,13 @@ EOF`);
      * @returns {void}
      */
     configureKnownHosts: (sshDir, port, host) => {
-      shellExec(`ssh-keyscan -p ${port} -H localhost >> ${sshDir}/known_hosts`);
-      shellExec(`ssh-keyscan -p ${port} -H 127.0.0.1 >> ${sshDir}/known_hosts`);
-      if (host) shellExec(`ssh-keyscan -p ${port} -H ${host} >> ${sshDir}/known_hosts`);
+      const sshPort = Number(port);
+      if (!Number.isInteger(sshPort) || sshPort < 1 || sshPort > 65535)
+        throw new RangeError('SSH port must be 1-65535');
+      const knownHostsPath = shellArgumentFactory(`${sshDir}/known_hosts`);
+      shellExec(`ssh-keyscan -p ${sshPort} -H localhost >> ${knownHostsPath}`);
+      shellExec(`ssh-keyscan -p ${sshPort} -H 127.0.0.1 >> ${knownHostsPath}`);
+      if (host) shellExec(`ssh-keyscan -p ${sshPort} -H ${shellArgumentFactory(host)} >> ${knownHostsPath}`);
     },
 
     /**
@@ -181,10 +195,78 @@ EOF`);
      */
     configureSudoAccess: (username, password, disablePassword) => {
       if (disablePassword) {
-        shellExec(`echo '${username} ALL=(ALL) NOPASSWD: ALL' | sudo tee /etc/sudoers.d/90_${username}`);
+        if (!/^[a-z_][a-z0-9_-]*[$]?$/i.test(username)) throw new TypeError('Invalid sudo username');
+        const sudoersPath = `/etc/sudoers.d/90_${username}`;
+        const temporaryPath = `/tmp/underpost-sudoers-${process.pid}-${username}`;
+        const rule = `${username} ALL=(ALL) NOPASSWD: ALL`;
+        try {
+          shellExec(`printf '%s\n' ${shellArgumentFactory(rule)} > ${shellArgumentFactory(temporaryPath)}`);
+          shellExec(`sudo visudo -cf ${shellArgumentFactory(temporaryPath)}`);
+          shellExec(
+            `sudo install -m 0440 -o root -g root ${shellArgumentFactory(temporaryPath)} ${shellArgumentFactory(sudoersPath)}`,
+          );
+          runSELinuxCommands([selinuxRestoreconCommandFactory(sudoersPath, { recursive: false })], {
+            execute: shellExec,
+          });
+        } finally {
+          fs.removeSync(temporaryPath);
+        }
       } else {
-        shellExec(`echo "${username}:${password}" | sudo chpasswd`);
+        shellExec(`printf '%s\n' ${shellArgumentFactory(`${username}:${password}`)} | sudo chpasswd`, {
+          disableLog: true,
+        });
+      }
+    },
+
+    /**
+     * Initializes the default SSH files and credentials for a local SSH service.
+     * @method
+     * @function initializeDefaultSshConfig
+     * @memberof UnderpostSSH
+     * @param {object} params - SSH configuration values.
+     * @param {string} params.userHome - Home directory of the SSH user.
+     * @param {string} params.user - SSH user name.
+     * @param {string} params.password - SSH key passphrase and user password.
+     * @param {string} params.host - Host used in the SSH key comment.
+     * @param {number} params.port - SSH port.
+     * @param {boolean} params.disablePassword - Whether to configure passwordless sudo.
+     * @param {string} [params.controllerPubKeyPath='./engine-private/deploy/id_rsa.pub'] - Preferred controller public key to authorize.
+     * @returns {void}
+     */
+    initializeDefaultSshConfig: ({
+      userHome,
+      user,
+      password,
+      host,
+      port,
+      disablePassword,
+      controllerPubKeyPath = './engine-private/deploy/id_rsa.pub',
+    }) => {
+      const sshDir = `${userHome}/.ssh`;
+      const keyPath = `${sshDir}/id_rsa`;
+      const pubKeyPath = `${sshDir}/id_rsa.pub`;
+
+      Underpost.ssh.ensureSSHDirectory(sshDir);
+      fs.ensureFileSync(`${sshDir}/authorized_keys`);
+      fs.ensureFileSync(`${sshDir}/known_hosts`);
+
+      if (!fs.existsSync(keyPath)) {
+        shellExec(
+          `ssh-keygen -t ed25519 -f ${shellArgumentFactory(keyPath)} -N ${shellArgumentFactory(password)} -q -C ${shellArgumentFactory(`${user}@${host}`)}`,
+          { disableLog: true },
+        );
       }
+      if (!fs.existsSync(pubKeyPath))
+        shellExec(
+          `ssh-keygen -y -f ${shellArgumentFactory(keyPath)} -P ${shellArgumentFactory(password)} > ${shellArgumentFactory(pubKeyPath)}`,
+          { disableLog: true },
+        );
+
+      const authorizedKeyPath = fs.existsSync(controllerPubKeyPath) ? controllerPubKeyPath : pubKeyPath;
+      Underpost.ssh.configureAuthorizedKeys(sshDir, authorizedKeyPath, disablePassword);
+      Underpost.ssh.configureKnownHosts(sshDir, port, host);
+      Underpost.ssh.configureSudoAccess(user, password, disablePassword);
+      Underpost.ssh.setSSHFilePermissions(sshDir, user, keyPath, pubKeyPath);
     },
 
     /**
@@ -489,7 +571,44 @@ EOF`);
 
       // Handle start server
       if (options.start) {
-        Underpost.ssh.chmod({ user: options.user });
+        if (!options.deployId) {
+          Underpost.ssh.initializeDefaultSshConfig({
+            userHome,
+            user: options.user,
+            password: options.password,
+            host: options.host,
+            port: options.port,
+            disablePassword: options.disablePassword,
+          });
+        } else {
+          // Hardening sshd on a host where the account does not exist produces a
+          // daemon that starts cleanly and refuses the only user it was meant to
+          // admit. Nothing downstream reports that, so the run has to.
+          if (!Underpost.ssh.checkUserExists(options.user))
+            throw new Error(
+              `[ssh] user '${options.user}' does not exist on this host; ` +
+                `run: node bin ssh --deploy-id ${options.deployId} --user ${options.user} --user-add`,
+            );
+          Underpost.ssh.chmod({ user: options.user });
+          // The registry records the key pair this deploy authenticates with, so
+          // a box whose authorized_keys was lost converges here rather than
+          // needing the key re-issued — which would invalidate every other host
+          // holding it.
+          const recordedPubKey = confNode?.users?.[options.user]?.publicKeyCopyPath;
+          if (recordedPubKey && fs.existsSync(recordedPubKey)) {
+            const sshDir = `${userHome}/.ssh`;
+            Underpost.ssh.ensureSSHDirectory(sshDir);
+            fs.ensureFileSync(`${sshDir}/authorized_keys`);
+            Underpost.ssh.configureAuthorizedKeys(sshDir, recordedPubKey, options.disablePassword);
+            Underpost.ssh.chmod({ user: options.user });
+            logger.info(`Authorized key present for ${options.user}`, { source: recordedPubKey });
+          } else if (recordedPubKey) {
+            logger.warn('Recorded public key is missing; authorized_keys left untouched', {
+              user: options.user,
+              expected: recordedPubKey,
+            });
+          }
+        }
         Underpost.ssh.initService({ port: options.port });
       }
 
@@ -848,12 +967,26 @@ EOF
      * Sets ownership to specified user for ~/.ssh/ and contents.
      */
     chmod: ({ user }) => {
-      shellExec(`sudo chmod 700 ~/.ssh/`);
-      shellExec(`sudo chmod 600 ~/.ssh/authorized_keys`);
-      shellExec(`sudo chmod 644 ~/.ssh/known_hosts`);
-      shellExec(`sudo chmod 600 ~/.ssh/id_rsa`);
+      const sshDirectory = `${Underpost.ssh.getUserHome(user)}/.ssh`;
+      shellExec(`sudo chmod 700 ${shellArgumentFactory(sshDirectory)}`);
+      shellExec(
+        `if [ -f ${shellArgumentFactory(`${sshDirectory}/authorized_keys`)} ]; then sudo chmod 600 ${shellArgumentFactory(`${sshDirectory}/authorized_keys`)}; fi`,
+      );
+      shellExec(
+        `if [ -f ${shellArgumentFactory(`${sshDirectory}/known_hosts`)} ]; then sudo chmod 644 ${shellArgumentFactory(`${sshDirectory}/known_hosts`)}; fi`,
+      );
+      shellExec(
+        `if [ -f ${shellArgumentFactory(`${sshDirectory}/id_rsa`)} ]; then sudo chmod 600 ${shellArgumentFactory(`${sshDirectory}/id_rsa`)}; fi`,
+      );
       shellExec(`sudo chmod 600 /etc/ssh/ssh_host_ed25519_key`);
-      shellExec(`chown -R ${user}:${user} ~/.ssh`);
+      shellExec(`sudo chown -R ${shellArgumentFactory(`${user}:${user}`)} ${shellArgumentFactory(sshDirectory)}`);
+      runSELinuxCommands(
+        [
+          ...selinuxSshContextCommandsFactory({ sshDirectory }),
+          selinuxRestoreconCommandFactory('/etc/ssh/ssh_host_ed25519_key', { recursive: false }),
+        ],
+        { execute: shellExec },
+      );
     },
 
     /**
@@ -866,7 +999,7 @@ EOF
      * @description
      * Configures SSH daemon with hardened security settings:
      * - Disables password authentication (key-only)
-     * - Disables root login
+     * - Allows key-only root login
      * - Enables ED25519 host key
      * - Disables X11 forwarding and TCP forwarding
      * - Sets client alive intervals to prevent ghost connections
@@ -878,69 +1011,57 @@ EOF
      * - Displays service status with colored output
      */
     initService: ({ port }) => {
-      shellExec(
-        `sudo tee /etc/ssh/sshd_config <<EOF
-# ==============================================================
-# RHEL Hardened SSHD Configuration
-# ==============================================================
-
-# --- Network Settings ---
-Port ${port ? port : '22'}
-# Explicitly listen on all interfaces (IPv4 and IPv6)
-
-# --- Host Keys ---
-# ED25519 is the modern standard (Fast & Secure)
+      const sshPort = Number(port || 22);
+      const portCommands = selinuxSshPortCommandsFactory({ port: sshPort });
+      const temporaryPath = `/tmp/underpost-sshd-config-${process.pid}`;
+      const configuration = `Port ${sshPort}
 HostKey /etc/ssh/ssh_host_ed25519_key
-# RSA is kept for compatibility with older clients (Optional)
-# HostKey /etc/ssh/ssh_host_rsa_key
-
-# --- Logging ---
 SyslogFacility AUTHPRIV
-# VERBOSE logs the key fingerprint used for login (Audit trail)
 LogLevel VERBOSE
-
-# --- Authentication & Security ---
-# STRICTLY KEY-BASED AUTHENTICATION
 PubkeyAuthentication yes
 PasswordAuthentication no
-ChallengeResponseAuthentication no
+KbdInteractiveAuthentication no
 PermitEmptyPasswords no
-
-# PREVENT ROOT LOGIN
-# Administrators should log in as a standard user and use 'sudo'
-PermitRootLogin no
-
-# Security checks on ownership of ~/.ssh/ files
+PermitRootLogin prohibit-password
 StrictModes yes
 MaxAuthTries 3
 LoginGraceTime 60
-
-# --- PAM (Pluggable Authentication Modules) ---
-# REQUIRED: Must be 'yes' on RHEL for proper session/SELinux handling.
-# Since PasswordAuthentication is 'no', PAM will not ask for passwords.
 UsePAM yes
-
-# --- Session & Network Health ---
-# Disconnect idle sessions after 5 minutes (300s * 0) to prevent ghost connections
 ClientAliveInterval 300
 ClientAliveCountMax 0
-
-# --- Feature Restrictions ---
-# Disable GUI forwarding unless explicitly needed
 X11Forwarding no
-# Disable DNS checks for faster logins (unless you use Host based auth)
 UseDNS no
-# Disable tunneling unless needed
 PermitTunnel no
 AllowTcpForwarding no
-
-# --- Subsystem ---
+Include /etc/ssh/sshd_config.d/*.conf
 Subsystem sftp /usr/libexec/openssh/sftp-server
-EOF`,
-        { disableLog: true },
-      );
-      shellExec(`sudo systemctl enable sshd`);
-      shellExec(`sudo systemctl restart sshd`);
+`;
+
+      fs.writeFileSync(temporaryPath, configuration, { mode: 0o600 });
+      try {
+        if (sshPort !== 22) {
+          shellExec(
+            `if command -v dnf >/dev/null 2>&1 && ! command -v semanage >/dev/null 2>&1; then ${selinuxPackagesCommandFactory()}; fi`,
+          );
+        }
+        runSELinuxCommands(portCommands, { execute: shellExec });
+        shellExec(`sudo ssh-keygen -A`);
+        shellExec(`sudo /usr/sbin/sshd -t -f ${shellArgumentFactory(temporaryPath)}`);
+        shellExec(`sudo install -m 0600 -o root -g root ${shellArgumentFactory(temporaryPath)} /etc/ssh/sshd_config`);
+        runSELinuxCommands(
+          [selinuxRestoreconCommandFactory(['/etc/ssh/sshd_config', '/etc/ssh/ssh_host_ed25519_key'])],
+          { execute: shellExec },
+        );
+        if (sshPort !== 22) {
+          shellExec(
+            `if command -v firewall-cmd >/dev/null 2>&1 && sudo firewall-cmd --state >/dev/null 2>&1; then sudo firewall-cmd --permanent --add-port=${sshPort}/tcp && sudo firewall-cmd --reload; fi`,
+          );
+        }
+        shellExec(`sudo systemctl enable sshd`);
+        shellExec(`sudo systemctl restart sshd`);
+      } finally {
+        fs.removeSync(temporaryPath);
+      }
 
       const status = shellExec(`sudo systemctl status sshd`, { silent: true, stdout: true });
       if (status.match('running')) console.log(status.replaceAll(`running`, `running`.green));

package/src/cli/system.js

@@ -8,6 +8,12 @@
  */
 
 import fs from 'fs-extra';
+import {
+  selinuxEnforcingCommandsFactory,
+  selinuxPackagesCommandFactory,
+  selinuxSshContextCommandsFactory,
+  shellArgumentFactory,
+} from '../server/selinux.js';
 
 /**
  * @class UnderpostSystemProvisionig
@@ -196,6 +202,8 @@ logdir /var/log/chrony
 
           // Install essential system tools (avoiding duplicates from container packages)
           `dnf -y install --allowerasing bzip2 openssh-server nano vim-enhanced less openssl-devel git gnupg2 libnsl perl`,
+          selinuxPackagesCommandFactory({ sudo: false }),
+          ...selinuxEnforcingCommandsFactory({ sudo: false }),
           `dnf clean all`,
 
           // Install Node.js
@@ -218,19 +226,24 @@ logdir /var/log/chrony
          * @memberof UnderpostSystemProvisionig
          * @returns {string[]} An array of shell commands.
          */
-        user: () => [
-          `useradd -m -s /bin/bash -G wheel root`, // Create a root user with bash shell and wheel group (sudo on RHEL)
-          `echo 'root:root' | chpasswd`, // Set a default password for the root user
-          `mkdir -p /home/root/.ssh`, // Create .ssh directory for authorized keys
-          // Add the public SSH key to authorized_keys for passwordless login
-          `echo '${fs.readFileSync(
-            `/home/dd/engine/engine-private/deploy/id_rsa.pub`,
-            'utf8',
-          )}' > /home/root/.ssh/authorized_keys`,
-          `chown -R root:root /home/root/.ssh`, // Set ownership for security
-          `chmod 700 /home/root/.ssh`, // Set permissions for the .ssh directory
-          `chmod 600 /home/root/.ssh/authorized_keys`, // Set permissions for authorized_keys
-        ],
+        user: ({ username = 'root', publicKeyPath = '/home/dd/engine/engine-private/deploy/id_rsa.pub' } = {}) => {
+          if (!/^[a-z_][a-z0-9_-]*[$]?$/i.test(username)) throw new TypeError('Invalid Rocky Linux username');
+          const home = username === 'root' ? '/root' : `/home/${username}`;
+          const sshDirectory = `${home}/.ssh`;
+          const publicKey = fs.readFileSync(publicKeyPath, 'utf8').trim();
+          const userCommand =
+            username === 'root'
+              ? `usermod -s /bin/bash root`
+              : `id -u ${shellArgumentFactory(username)} >/dev/null 2>&1 || useradd -m -s /bin/bash -G wheel ${shellArgumentFactory(username)}`;
+          return [
+            userCommand,
+            `install -d -m 0700 -o ${shellArgumentFactory(username)} -g ${shellArgumentFactory(username)} ${shellArgumentFactory(sshDirectory)}`,
+            `printf '%s\n' ${shellArgumentFactory(publicKey)} > ${shellArgumentFactory(`${sshDirectory}/authorized_keys`)}`,
+            `chown ${shellArgumentFactory(`${username}:${username}`)} ${shellArgumentFactory(`${sshDirectory}/authorized_keys`)}`,
+            `chmod 0600 ${shellArgumentFactory(`${sshDirectory}/authorized_keys`)}`,
+            ...selinuxSshContextCommandsFactory({ sshDirectory, sudo: false }),
+          ];
+        },
         /**
          * @method timezone
          * @description Generates shell commands for configuring the system timezone on Rocky Linux.

package/src/cli/test.js

@@ -7,7 +7,7 @@
 import fs from 'fs-extra';
 import { timer } from '../client/components/core/CommonJs.js';
 import { MariaDB } from '../db/mariadb/MariaDB.js';
-import { getNpmRootPath } from '../server/conf.js';
+import { getNpmRootPath } from '../server/environment.js';
 import { actionInitLog, loggerFactory, setUpInfo } from '../server/logger.js';
 import { pbcopy, shellExec } from '../server/process.js';
 import Underpost from '../index.js';