From 981e107b58e2737d3c69246ddaf128127b92a19a Mon Sep 17 00:00:00 2001 From: Shahriyar Jalayeri Date: Tue, 10 Oct 2023 11:07:39 +0000 Subject: [PATCH] add remote access switch for edgeview add an option to eve command and edgeview to set the remote access config switch to On/Off. When On, edgeview and ssh are inaccsiable. Signed-off-by: Shahriyar Jalayeri --- docs/CONFIG.md | 1 + docs/SECURITY.md | 4 ++++ pkg/debug/ssh.sh | 13 ++++++++++++- pkg/dom0-ztools/rootfs/bin/eve | 22 ++++++++++++++++++++++ pkg/pillar/cmd/zedagent/hardwareinfo.go | 3 +++ pkg/pillar/cmd/zedagent/parseedgeview.go | 6 ++++++ pkg/pillar/types/locationconsts.go | 2 ++ pkg/pillar/utils/access.go | 21 +++++++++++++++++++++ 8 files changed, 71 insertions(+), 1 deletion(-) create mode 100644 pkg/pillar/utils/access.go diff --git a/docs/CONFIG.md b/docs/CONFIG.md index cb1a92d35fb..a57fd534fd0 100644 --- a/docs/CONFIG.md +++ b/docs/CONFIG.md @@ -13,6 +13,7 @@ In general, EVE is trying to make sure that its controller always has the last w * `wpa_supplicant.conf` - a legacy way of configuring EVE's WiFi * `authorized_keys` - initial authorized SSH keys for accessing EVE's debug console; DO NOT use options, we only accept 'keytype, base64-encoded key, comment' format * `bootstrap-config.pb`- initial device configuration used only until device is onboarded (see below for details) +* `remote_access_disabled`- a file indicating remote access status, if it exist remote access (edge-view and ssh) is disabled. Please check [config document](SECURITY.md#disabling-remote-access) for more information. The initial content of these configuration files is stored in the EVE's source tree under [config](../config) folder. From there, these configuration files are baked into the EVE installer images. For the read-write bootable disk installer image these files can further be tweaked by mounting the "EVE" partition and editing those files directly on the installer image. This gives you an ability to take the default installer image and tweak it for your needs without re-building EVE from scratch (obviously this is not an option for a read-only ISO installer image). A typical workflow is to take an installer image from the official EVE build, flash it onto a USB flash drive, insert that USB flash drive into your desktop and edit file on the partition called EVE. diff --git a/docs/SECURITY.md b/docs/SECURITY.md index 2db33697529..460fbff25c3 100644 --- a/docs/SECURITY.md +++ b/docs/SECURITY.md @@ -158,6 +158,10 @@ Two ECOs communicating using the overlay will get an secure channel since LISP w In addition, the LISP map server can provide ability to limit access to the mappings for certain EIDs based on the EID which is trying to look them up. +## Disabling Remote Access + +EVE provides a mechanism to build an image with remote access disabled (edge-view and ssh), this can be done by configuring EVE when building an installer. Enabling remote access back, requires access to the cloud controller to enable debugging access on the edge node, plus physical access to the edge node to issue `eve remote-access` command on the edge node. In addition changing remote access status from its initial value to anything else will result in change of PCR-14 value and subsequent failure in unsealing the vault key that needs to be handled using the cloud controller. Check [config document](CONFIG.md#eve-configuration) for more information. + ## Details on keys and certificates These details are specified in [KEYS-AND-CERTS](KEYS-AND-CERTS.md). diff --git a/pkg/debug/ssh.sh b/pkg/debug/ssh.sh index c2dfda31395..093427203f2 100755 --- a/pkg/debug/ssh.sh +++ b/pkg/debug/ssh.sh @@ -7,4 +7,15 @@ echo -1 > /proc/sys/kernel/perf_event_paranoid KEYS=$(find /etc/ssh -name 'ssh_host_*_key') [ -z "$KEYS" ] && ssh-keygen -A >/dev/null 2>/dev/null -exec /usr/sbin/sshd -D -e + +if [ -f "/config/remote_access_disabled" ]; then + # this is picked up by newlogd + echo "Remote access disabled, ssh server not started" > /dev/kmsg + while true; do + # sleep for a day, keep the container running + sleep 86400 + done +else + exec /usr/sbin/sshd -D -e +fi + diff --git a/pkg/dom0-ztools/rootfs/bin/eve b/pkg/dom0-ztools/rootfs/bin/eve index ff64c25b10d..ef1d256bd1f 100755 --- a/pkg/dom0-ztools/rootfs/bin/eve +++ b/pkg/dom0-ztools/rootfs/bin/eve @@ -19,6 +19,7 @@ Welcome to EVE! persist attach config mount config unmount + remote-access on|off http-debug dump-stacks dump-memory @@ -199,6 +200,27 @@ __EOT__ ;; esac ;; + remote-access) + CONFIGDIR_RW="/tmp/config_rw_$RANDOM" + mkdir $CONFIGDIR_RW + if $(mount_partlabel "CONFIG" $CONFIGDIR_RW); then + case "$2" in + on) rm -f $CONFIGDIR_RW/remote_access_disabled + $(unmount_partlabel "CONFIG") && rm -rf $CONFIGDIR_RW + echo "Remote access enabled. Please reboot to apply changes." + ;; + off) touch $CONFIGDIR_RW/remote_access_disabled + $(unmount_partlabel "CONFIG") && rm -rf $CONFIGDIR_RW + echo "Remote access disabled. Please reboot to apply changes." + ;; + *) $(unmount_partlabel "CONFIG") && rm -rf $CONFIGDIR_RW + help + ;; + esac + else + echo "Failed to set the remote access configuration!" + fi + ;; version) v=$(cat /run/eve-release) echo "$v" diff --git a/pkg/pillar/cmd/zedagent/hardwareinfo.go b/pkg/pillar/cmd/zedagent/hardwareinfo.go index 696cddcf4fc..e5ef565e80b 100644 --- a/pkg/pillar/cmd/zedagent/hardwareinfo.go +++ b/pkg/pillar/cmd/zedagent/hardwareinfo.go @@ -53,6 +53,9 @@ func PublishHardwareInfoToZedCloud(ctx *zedagentContext, dest destinationBitset) hwInfo := new(info.ZInfoHardware) + // Get the remote access status + //hwInfo.RemoteAccessDisabled = !utils.RemoteAccessEnable() + // Get information about disks disksInfo, err := hardware.ReadSMARTinfoForDisks() if err != nil { diff --git a/pkg/pillar/cmd/zedagent/parseedgeview.go b/pkg/pillar/cmd/zedagent/parseedgeview.go index fdf47889b87..6fed7980500 100644 --- a/pkg/pillar/cmd/zedagent/parseedgeview.go +++ b/pkg/pillar/cmd/zedagent/parseedgeview.go @@ -17,11 +17,17 @@ import ( "github.com/google/go-cmp/cmp" zconfig "github.com/lf-edge/eve-api/go/config" "github.com/lf-edge/eve/pkg/pillar/types" + "github.com/lf-edge/eve/pkg/pillar/utils" ) // edge-view specific parser/utility routines func parseEvConfig(ctx *getconfigContext, config *zconfig.EdgeDevConfig) { + if !utils.RemoteAccessEnable() { + log.Noticef("Remote access to edgeview is disabled") + removeEvFiles() + return + } log.Tracef("Started parsing edge-view config") zcfgEv := config.GetEdgeview() diff --git a/pkg/pillar/types/locationconsts.go b/pkg/pillar/types/locationconsts.go index 957f58be077..839353cb65c 100644 --- a/pkg/pillar/types/locationconsts.go +++ b/pkg/pillar/types/locationconsts.go @@ -64,6 +64,8 @@ const ( APIV1FileName = IdentityDirname + "/Force-API-V1" // BootstrapConfFileName - file to store initial device configuration for bootstrapping BootstrapConfFileName = IdentityDirname + "/bootstrap-config.pb" + // RemoteAccessFlagFileName -- file to check for remote access configuration + RemoteAccessFlagFileName = IdentityDirname + "/remote_access_disabled" // BootstrapShaFileName - file to store SHA hash of an already ingested bootstrap config BootstrapShaFileName = IngestedDirname + "/bootstrap-config.sha" diff --git a/pkg/pillar/utils/access.go b/pkg/pillar/utils/access.go new file mode 100644 index 00000000000..1b4c24ee807 --- /dev/null +++ b/pkg/pillar/utils/access.go @@ -0,0 +1,21 @@ +// Copyright (c) 2017-2023 Zededa, Inc. +// SPDX-License-Identifier: Apache-2.0 + +package utils + +import ( + "os" + + "github.com/lf-edge/eve/pkg/pillar/types" +) + +// RemoteAccessEnable checks if remote access is enabled/disabled +// by checking if the file /config/remote_access_disabled exists or not. +func RemoteAccessEnable() bool { + if _, err := os.Stat(types.RemoteAccessFlagFileName); err == nil { + // file exists, remote access is disabled + return false + } else { + return true + } +}