Compare commits

...

3 commits

4 changed files with 16 additions and 3 deletions

View file

@ -5,7 +5,9 @@ Host *
StrictHostKeyChecking yes StrictHostKeyChecking yes
GlobalKnownHostsFile /etc/ssh/ssh_known_hosts GlobalKnownHostsFile /etc/ssh/ssh_known_hosts
% if multiplex_incoming:
Host ${' '.join(sorted(multiplex_hosts))} Host ${' '.join(sorted(multiplex_hosts))}
ControlMaster auto ControlMaster auto
ControlPath ~/.ssh/multiplex-%C ControlPath ~/.ssh/multiplex-%C
ControlPersist 5m ControlPersist 5m
% endif

View file

@ -27,6 +27,7 @@ files = {
'/etc/ssh/ssh_config': { '/etc/ssh/ssh_config': {
'content_type': 'mako', 'content_type': 'mako',
'context': { 'context': {
'multiplex_incoming': node.metadata.get('ssh/multiplex_incoming'),
'multiplex_hosts': set( 'multiplex_hosts': set(
str(ip_interface(other_node.metadata.get('network/internal/ipv4')).ip) str(ip_interface(other_node.metadata.get('network/internal/ipv4')).ip)
for other_node in repo.nodes for other_node in repo.nodes

View file

@ -34,12 +34,21 @@ do
fi fi
done done
# CHECK FOR ACTIVE LOGINS # CHECK FOR INCOMING SSH CONNECTIONS
LOGINS=$(netstat -tnpa | grep 'ESTABLISHED.*sshd' | tr -s ' ' | cut -d' ' -f5,7-8 | paste -d',' -s | sed 's/,/, /') LOGINS=$(netstat -np | grep 'ESTABLISHED.*sshd' | tr -s ' ' | cut -d' ' -f5,7,8)
if ! [[ -z "$LOGINS" ]] if ! [[ -z "$LOGINS" ]]
then then
echo "ABORT: users logged in: $LOGINS" echo "ABORT: incoming ssh connections: $LOGINS"
exit 75
fi
# CHECK FOR OUTGOING SSH CONNECTIONS
LOGINS=$(netstat -np | grep 'ESTABLISHED.*ssh[^d]' | tr -s ' ' | cut -d' ' -f5,7,8)
if ! [[ -z "$LOGINS" ]]
then
echo "ABORT: outgoing ssh connections: $LOGINS"
exit 75 exit 75
fi fi

View file

@ -99,6 +99,7 @@ def backup(metadata):
options['mountpoint'] options['mountpoint']
for options in metadata.get('zfs/datasets').values() for options in metadata.get('zfs/datasets').values()
if options.get('backup', True) if options.get('backup', True)
and not options.get('mountpoint', None) in [None, 'none']
}, },
}, },
} }