add remote access switch for edgeview

add an option to eve command and edgeview to set the remote
access config switch to On/Off. When On, edgeview and ssh are inaccsiable.

Signed-off-by: Shahriyar Jalayeri <shahriyar@zededa.com>

docs/CONFIG.md

@@ -13,6 +13,7 @@ In general, EVE is trying to make sure that its controller always has the last w
 * `wpa_supplicant.conf` - a legacy way of configuring EVE's WiFi
 * `authorized_keys` - initial authorized SSH keys for accessing EVE's debug console; DO NOT use options, we only accept 'keytype, base64-encoded key, comment' format
 * `bootstrap-config.pb`- initial device configuration used only until device is onboarded (see below for details)
+* `remote_access_disabled`- a file indicating remote access status, if it exist remote access (edge-view and ssh) is disabled. Please check [config document](SECURITY.md#disabling-remote-access) for more information.
 
 The initial content of these configuration files is stored in the EVE's source tree under [config](../config) folder. From there, these configuration files are baked into the EVE installer images. For the read-write bootable disk installer image these files can further be tweaked by mounting the "EVE" partition and editing those files directly on the installer image. This gives you an ability to take the default installer image and tweak it for your needs without re-building EVE from scratch (obviously this is not an option for a read-only ISO installer image). A typical workflow is to take an installer image from the official EVE build, flash it onto a USB flash drive, insert that USB flash drive into your desktop and edit file on the partition called EVE.
 

docs/SECURITY.md

@@ -158,6 +158,10 @@ Two ECOs communicating using the overlay will get an secure channel since LISP w
 
 In addition, the LISP map server can provide ability to limit access to the mappings for certain EIDs based on the EID which is trying to look them up.
 
+## Disabling Remote Access
+
+EVE provides a mechanism to build an image with remote access disabled (edge-view and ssh), this can be done by configuring EVE when building an installer. Enabling remote access back, requires access to the cloud controller to enable debugging access on the edge node, plus physical access to the edge node to issue `eve remote-access` command on the edge node. In addition changing remote access status from its initial value to anything else will result in change of PCR-14 value and subsequent failure in unsealing the vault key that needs to be handled using the cloud controller. Check [config document](CONFIG.md#eve-configuration) for more information.
+
 ## Details on keys and certificates
 
 These details are specified in [KEYS-AND-CERTS](KEYS-AND-CERTS.md).

pkg/debug/ssh.sh

@@ -7,4 +7,15 @@ echo -1 > /proc/sys/kernel/perf_event_paranoid
 KEYS=$(find /etc/ssh -name 'ssh_host_*_key')
 [ -z "$KEYS" ] && ssh-keygen -A >/dev/null 2>/dev/null
 
-exec /usr/sbin/sshd -D -e
+
+if [ -f "/config/remote_access_disabled" ]; then
+    # this is picked up by newlogd
+    echo "Remote access disabled, ssh server not started" > /dev/kmsg
+    while true; do
+        # sleep for a day, keep the container running
+        sleep 86400
+    done
+else
+    exec /usr/sbin/sshd -D -e
+fi
+

pkg/dom0-ztools/rootfs/bin/eve

@@ -19,6 +19,7 @@ Welcome to EVE!
             persist attach <disk>
             config mount <mountpoint>
             config unmount
+            remote-access on|off
             http-debug
             dump-stacks
             dump-memory
@@ -199,6 +200,27 @@ __EOT__
                  ;;
           esac
           ;;
+ remote-access)
+          CONFIGDIR_RW="/tmp/config_rw_$RANDOM"
+          mkdir $CONFIGDIR_RW
+          if $(mount_partlabel "CONFIG" $CONFIGDIR_RW); then
+              case "$2" in
+                on) rm -f $CONFIGDIR_RW/remote_access_disabled
+                    $(unmount_partlabel "CONFIG") && rm -rf $CONFIGDIR_RW
+                    echo "Remote access enabled. Please reboot to apply changes."
+                    ;;
+                off) touch $CONFIGDIR_RW/remote_access_disabled
+                     $(unmount_partlabel "CONFIG") && rm -rf $CONFIGDIR_RW
+                     echo "Remote access disabled. Please reboot to apply changes."
+                     ;;
+                *) $(unmount_partlabel "CONFIG") && rm -rf $CONFIGDIR_RW
+                   help
+                   ;;
+              esac
+          else
+              echo "Failed to set the remote access configuration!"
+          fi
+          ;;
  version)
           v=$(cat /run/eve-release)
           echo "$v"

pkg/pillar/cmd/zedagent/hardwareinfo.go

@@ -53,6 +53,9 @@ func PublishHardwareInfoToZedCloud(ctx *zedagentContext, dest destinationBitset)
 
 	hwInfo := new(info.ZInfoHardware)
 
+	// Get the remote access status
+	//hwInfo.RemoteAccessDisabled = utils.RemoteAccessDisabled()
+
 	// Get information about disks
 	disksInfo, err := hardware.ReadSMARTinfoForDisks()
 	if err != nil {

pkg/pillar/cmd/zedagent/parseedgeview.go

@@ -17,11 +17,17 @@ import (
 	"github.com/google/go-cmp/cmp"
 	zconfig "github.com/lf-edge/eve-api/go/config"
 	"github.com/lf-edge/eve/pkg/pillar/types"
+	"github.com/lf-edge/eve/pkg/pillar/utils"
 )
 
 // edge-view specific parser/utility routines
 
 func parseEvConfig(ctx *getconfigContext, config *zconfig.EdgeDevConfig) {
+	if utils.RemoteAccessDisabled() {
+		log.Noticef("Remote access to edgeview is disabled")
+		removeEvFiles()
+		return
+	}
 
 	log.Tracef("Started parsing edge-view config")
 	zcfgEv := config.GetEdgeview()

pkg/pillar/types/locationconsts.go

@@ -64,6 +64,8 @@ const (
 	APIV1FileName = IdentityDirname + "/Force-API-V1"
 	// BootstrapConfFileName - file to store initial device configuration for bootstrapping
 	BootstrapConfFileName = IdentityDirname + "/bootstrap-config.pb"
+	// RemoteAccessFlagFileName -- file to check for remote access configuration
+	RemoteAccessFlagFileName = IdentityDirname + "/remote_access_disabled"
 	// BootstrapShaFileName - file to store SHA hash of an already ingested bootstrap config
 	BootstrapShaFileName = IngestedDirname + "/bootstrap-config.sha"
 

pkg/pillar/utils/access.go

@@ -0,0 +1,21 @@
+// Copyright (c) 2017-2023 Zededa, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+package utils
+
+import (
+	"os"
+
+	"github.com/lf-edge/eve/pkg/pillar/types"
+)
+
+// RemoteAccessDisabled checks if remote access is enabled/disabled
+// by checking if the file /config/remote_access_disabled exists or not.
+func RemoteAccessDisabled() bool {
+	if _, err := os.Stat(types.RemoteAccessFlagFileName); err == nil {
+		// file exists, remote access is disabled
+		return true
+	} else {
+		return false
+	}
+}