add remote access switch

This is backport of #3485,
which adds remote access switch to eve, blocking ssh and edge-view if
remote access is disabled.

Signed-off-by: Shahriyar Jalayeri <shahriyar@zededa.com>

api/proto/info/info.proto

@@ -620,6 +620,9 @@ message ZInfoDevice {
 
   // Capability indicating which new EdgeDevConfig fields which are supported
   APICapability api_capability = 51;
+
+  // Reports the remote access status
+  bool remote_access_disabled = 52;
 }
 
 // Capabilities indicates features in the EdgeDevConfig where there is

docs/CONFIG.md

@@ -13,6 +13,7 @@ In general, EVE is trying to make sure that its controller always has the last w
 * `wpa_supplicant.conf` - a legacy way of configuring EVE's WiFi
 * `authorized_keys` - initial authorized SSH keys for accessing EVE's debug console
 * `bootstrap-config.pb`- initial device configuration used only until device is onboarded (see below for details)
+* `remote_access_disabled`- a file indicating remote access status, if it exist remote access (edge-view and ssh) is disabled. Please check [config document](SECURITY.md#disabling-remote-access) for more information.
 
 The initial content of these configuration files is stored in the EVE's source tree under [config](../config) folder. From there, these configuration files are baked into the EVE installer images. For the read-write bootable disk installer image these files can further be tweaked by mounting the "EVE" partition and editing those files directly on the installer image. This gives you an ability to take the default installer image and tweak it for your needs without re-building EVE from scratch (obviously this is not an option for a read-only ISO installer image). A typical workflow is to take an installer image from the official EVE build, flash it onto a USB flash drive, insert that USB flash drive into your desktop and edit file on the partition called EVE.
 

docs/SECURITY.md

@@ -152,6 +152,10 @@ Two ECOs communicating using the overlay will get an secure channel since LISP w
 
 In addition, the LISP map server can provide ability to limit access to the mappings for certain EIDs based on the EID which is trying to look them up.
 
+## Disabling Remote Access
+
+EVE provides a mechanism to build an image with remote access disabled (edge-view and ssh), this can be done by configuring EVE when building an installer. Enabling remote access back requires access to the cloud controller to enable console keyboard access on the edge node, plus physical access to the edge node to issue `eve remote-access` command on the edge node. In addition changing remote access status from its initial value to anything else will result in change of PCR-14 value and subsequent failure in unsealing the vault key that needs to be handled using the cloud controller. Check [config document](CONFIG.md#eve-configuration) for more information.
+
 ## Details on keys and certificates
 
 These details are specified in [KEYS-AND-CERTS](KEYS-AND-CERTS.md).

pkg/debug/ssh.sh

@@ -7,4 +7,15 @@ echo -1 > /proc/sys/kernel/perf_event_paranoid
 KEYS=$(find /etc/ssh -name 'ssh_host_*_key')
 [ -z "$KEYS" ] && ssh-keygen -A >/dev/null 2>/dev/null
 
-exec /usr/sbin/sshd -D -e
+
+if [ -f "/config/remote_access_disabled" ]; then
+    # this is picked up by newlogd
+    echo "Remote access disabled, ssh server not started" > /dev/kmsg
+    while true; do
+        # sleep for INT_MAX, keep the container running
+        sleep inf
+    done
+else
+    exec /usr/sbin/sshd -D -e
+fi
+

pkg/dom0-ztools/rootfs/bin/eve

@@ -19,6 +19,7 @@ Welcome to EVE!
             persist attach <disk>
             config mount <mountpoint>
             config unmount
+            remote-access on|off
             firewall drop
             verbose on|off
             version
@@ -151,6 +152,27 @@ __EOT__
                  ;;
           esac
           ;;
+ remote-access)
+          CONFIGDIR_RW="/tmp/config_rw"
+          mkdir $CONFIGDIR_RW
+          if eval "$(mount_partlabel "CONFIG" $CONFIGDIR_RW)"; then
+              case "$2" in
+                on) rm -f $CONFIGDIR_RW/remote_access_disabled
+                    eval "$(unmount_partlabel "CONFIG")" && rm -rf $CONFIGDIR_RW
+                    echo "Remote access enabled. Please reboot to apply changes."
+                    ;;
+                off) touch $CONFIGDIR_RW/remote_access_disabled
+                     eval "$(unmount_partlabel "CONFIG")" && rm -rf $CONFIGDIR_RW
+                     echo "Remote access disabled. Please reboot to apply changes."
+                     ;;
+                *) eval "$(unmount_partlabel "CONFIG")" && rm -rf $CONFIGDIR_RW
+                   help
+                   ;;
+              esac
+          else
+              echo "Failed to set the remote access configuration!"
+          fi
+          ;;
  version)
           v=$(cat /run/eve-release)
           echo "$v"

pkg/pillar/cmd/zedagent/parseedgeview.go

@@ -18,11 +18,17 @@ import (
 	"github.com/google/go-cmp/cmp"
 	zconfig "github.com/lf-edge/eve/api/go/config"
 	"github.com/lf-edge/eve/pkg/pillar/types"
+	"github.com/lf-edge/eve/pkg/pillar/utils"
 )
 
 // edge-view specific parser/utility routines
 
 func parseEvConfig(ctx *getconfigContext, config *zconfig.EdgeDevConfig) {
+	if utils.RemoteAccessDisabled() {
+		log.Noticef("Remote access to edgeview is disabled")
+		removeEvFiles()
+		return
+	}
 
 	log.Tracef("Started parsing edge-view config")
 	zcfgEv := config.GetEdgeview()

pkg/pillar/cmd/zedagent/reportinfo.go

@@ -242,6 +242,9 @@ func PublishDeviceInfoToZedCloud(ctx *zedagentContext) {
 
 	ReportDeviceInfo := new(info.ZInfoDevice)
 
+	// Get the remote access status
+	ReportDeviceInfo.RemoteAccessDisabled = utils.RemoteAccessDisabled()
+
 	var uname unix.Utsname
 	err := unix.Uname(&uname)
 	if err != nil {

pkg/pillar/types/locationconsts.go

@@ -54,6 +54,8 @@ const (
 	APIV1FileName = IdentityDirname + "/Force-API-V1"
 	// BootstrapConfFileName - file to store initial device configuration for bootstrapping
 	BootstrapConfFileName = IdentityDirname + "/bootstrap-config.pb"
+	// RemoteAccessFlagFileName -- file to check for remote access configuration
+	RemoteAccessFlagFileName = IdentityDirname + "/remote_access_disabled"
 	// BootstrapShaFileName - file to store SHA hash of an already ingested bootstrap config
 	BootstrapShaFileName = IngestedDirname + "/bootstrap-config.sha"
 

pkg/pillar/utils/access.go

@@ -0,0 +1,21 @@
+// Copyright (c) 2017-2023 Zededa, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+package utils
+
+import (
+	"os"
+
+	"github.com/lf-edge/eve/pkg/pillar/types"
+)
+
+// RemoteAccessDisabled checks if remote access is enabled/disabled
+// by checking if the file /config/remote_access_disabled exists or not.
+func RemoteAccessDisabled() bool {
+	if _, err := os.Stat(types.RemoteAccessFlagFileName); err == nil {
+		// file exists, remote access is disabled
+		return true
+	} else {
+		return false
+	}
+}