amadan
status: ssh ledger — why-entry for the kepler root-SSH lockdown + operator setup (#1313)
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+10
−0
web/status/ssh/2026-07-23-kepler-noroot-and-operator-setup.json+10 −0
diff --git a/web/status/ssh/2026-07-23-kepler-noroot-and-operator-setup.json b/web/status/ssh/2026-07-23-kepler-noroot-and-operator-setup.json| new file mode 100644 |
| index 0000000..8708bb3 |
| --- /dev/null |
| +++ b/web/status/ssh/2026-07-23-kepler-noroot-and-operator-setup.json |
| @@ -0,0 +1,10 @@ |
| +{ |
| + "date": "2026-07-23", |
| + "operator": "Paul Campbell", |
| + "window": "2026-07-23 evening", |
| + "why": "Kepler root-SSH lockdown, end to end. Expedited kepler's control binary to stable 8b793d83 (update run --ignore-bake, the sanctioned local bake bypass) to pick up the new bootstrap --ssh-noroot verb (#1300). The verb's operator gate then surfaced that kepler had never had operator setup: Paul's SSH alias was logging in as root. The retiring root session created the paul operator account, installed the committed sudoers allowlist and the lchat-svc/lchat-env-install helpers, and ran the lockdown as the operator. First run exposed a silent-success bug — kepler's pre-existing 00-hardening.conf beat the 10- drop-in on sshd's first-match — fixed on-box by renaming it to 20-hardening.conf (keeping its PasswordAuthentication no) and in code by #1312 (the verb now verifies the effective config). Verified from outside: root login refused, operator login intact. Owed: a kepler operator account for James (via his Fasthosts console; useradd is deliberately not allowlisted).", |
| + "refs": [ |
| + "https://github.com/elevenmessenger/messenger/pull/1300", |
| + "https://github.com/elevenmessenger/messenger/pull/1312" |
| + ] |
| +} |