mirror of
https://github.com/ultravioletrs/cocos.git
synced 2026-06-23 04:10:25 +00:00
COCOS-393 - Disable SSH service and update user shell in cloud config (#396)
* Disable SSH service and update user shell in cloud config Signed-off-by: Sammy Oina <sammyoina@gmail.com> * Remove SSH server and clean up dependencies in cloud config Signed-off-by: Sammy Oina <sammyoina@gmail.com> * Add firewall configuration and ensure iptables rules persist after reboot Signed-off-by: Sammy Oina <sammyoina@gmail.com> * Add algo_user configuration and setup script for container execution Signed-off-by: Sammy Oina <sammyoina@gmail.com> --------- Signed-off-by: Sammy Oina <sammyoina@gmail.com>
This commit is contained in:
Sammy Kerata Oina
committed by
GitHub
GitHub
parent
cab2799741
commit
d17eba35eb
+143
-8
@@ -11,14 +11,16 @@ users:
|
||||
- docker # Add cocos user to the docker group
|
||||
sudo:
|
||||
- ALL=(ALL:ALL) ALL
|
||||
shell: /sbin/nologin
|
||||
- name: algo_user
|
||||
gecos: Algorithm User
|
||||
groups:
|
||||
- docker # Add to docker group for container execution
|
||||
shell: /bin/bash
|
||||
|
||||
chpasswd:
|
||||
list: |
|
||||
cocos_user:password
|
||||
expire: False
|
||||
|
||||
ssh_pwauth: True
|
||||
sudo:
|
||||
- /usr/bin/python3 # Allow running Python
|
||||
- /home/algo_user/.wasmtime/bin/wasmtime # Allow running Wasmtime
|
||||
- /usr/bin/docker # Allow running Docker commands
|
||||
|
||||
packages:
|
||||
- curl
|
||||
@@ -27,6 +29,8 @@ packages:
|
||||
- python3
|
||||
- python3-dev
|
||||
- net-tools # Add net-tools to install the 'route' command
|
||||
- iptables-persistent # Add iptables-persistent to save firewall rules
|
||||
- sudo # Ensure sudo is installed
|
||||
|
||||
write_files:
|
||||
- path: /etc/cocos/certs/cert.pem
|
||||
@@ -134,6 +138,102 @@ write_files:
|
||||
exec /bin/cocos-agent
|
||||
permissions: "0755"
|
||||
|
||||
# Firewall configuration script
|
||||
- path: /cocos_init/setup_firewall.sh
|
||||
content: |
|
||||
#!/bin/bash
|
||||
|
||||
# Flush existing rules
|
||||
iptables -F
|
||||
iptables -X
|
||||
iptables -t nat -F
|
||||
iptables -t nat -X
|
||||
iptables -t mangle -F
|
||||
iptables -t mangle -X
|
||||
|
||||
# Set default policies to DROP
|
||||
iptables -P INPUT DROP
|
||||
iptables -P FORWARD DROP
|
||||
iptables -P OUTPUT ACCEPT
|
||||
|
||||
# Allow loopback interface
|
||||
iptables -A INPUT -i lo -j ACCEPT
|
||||
iptables -A OUTPUT -o lo -j ACCEPT
|
||||
|
||||
# Allow established and related connections
|
||||
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
|
||||
# Allow port 7002 (TCP) for incoming connections
|
||||
iptables -A INPUT -p tcp --dport 7002 -j ACCEPT
|
||||
|
||||
# Save rules to persist after reboot
|
||||
mkdir -p /etc/iptables
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
|
||||
echo "Firewall configured to allow only port 7002"
|
||||
permissions: "0755"
|
||||
|
||||
# Setup script for algo_user
|
||||
- path: /cocos_init/setup_algo_user.sh
|
||||
content: |
|
||||
#!/bin/bash
|
||||
|
||||
# Create datasets directory with the right permissions
|
||||
mkdir -p /datasets
|
||||
chown root:root /datasets
|
||||
chmod 755 /datasets
|
||||
|
||||
# Create a home directory for algo_user
|
||||
mkdir -p /home/algo_user
|
||||
chown algo_user:algo_user /home/algo_user
|
||||
chmod 750 /home/algo_user
|
||||
|
||||
# Set up Wasmtime for algo_user
|
||||
mkdir -p /home/algo_user/.wasmtime/bin
|
||||
|
||||
# Link system Wasmtime to user's directory
|
||||
ln -s /root/.wasmtime/bin/wasmtime /home/algo_user/.wasmtime/bin/wasmtime
|
||||
chown -R algo_user:algo_user /home/algo_user/.wasmtime
|
||||
|
||||
# Configure sudoers for algo_user
|
||||
cat > /etc/sudoers.d/algo_user << EOF
|
||||
algo_user ALL=(ALL) NOPASSWD: /usr/bin/python3
|
||||
algo_user ALL=(ALL) NOPASSWD: /home/algo_user/.wasmtime/bin/wasmtime
|
||||
algo_user ALL=(ALL) NOPASSWD: /usr/bin/docker
|
||||
Defaults:algo_user !requiretty
|
||||
EOF
|
||||
|
||||
chmod 440 /etc/sudoers.d/algo_user
|
||||
|
||||
# Create a .bashrc file that restricts navigation to /datasets
|
||||
cat > /home/algo_user/.bashrc << EOF
|
||||
# .bashrc for algo_user
|
||||
|
||||
# Restrict navigation outside /datasets
|
||||
function cd() {
|
||||
if [[ "\$1" == /* && "\$1" != "/datasets"* && "\$1" != "/home/algo_user"* ]]; then
|
||||
echo "Access denied: You can only access files in /datasets or your home directory"
|
||||
return 1
|
||||
else
|
||||
builtin cd "\$1"
|
||||
fi
|
||||
}
|
||||
|
||||
# Set PATH to include necessary binaries
|
||||
export PATH=/usr/bin:/bin:/usr/local/bin:/home/algo_user/.wasmtime/bin
|
||||
|
||||
# Set default directory
|
||||
if [[ \$PWD != "/datasets"* && \$PWD != "/home/algo_user"* ]]; then
|
||||
cd /datasets
|
||||
fi
|
||||
EOF
|
||||
|
||||
chown algo_user:algo_user /home/algo_user/.bashrc
|
||||
chmod 644 /home/algo_user/.bashrc
|
||||
|
||||
echo "algo_user setup completed successfully"
|
||||
permissions: "0755"
|
||||
|
||||
runcmd:
|
||||
# Create necessary directories
|
||||
- mkdir -p /cocos
|
||||
@@ -163,6 +263,41 @@ runcmd:
|
||||
- sh ./get-docker.sh && echo "Docker installed successfully" || echo "Failed to install Docker"
|
||||
- usermod -aG docker cocos_user && echo "Added cocos_user to the docker group" || echo "Failed to add cocos_user to the docker group"
|
||||
|
||||
# Disable SSH service
|
||||
- echo "Disabling SSH service..."
|
||||
- systemctl disable ssh.service && echo "SSH service disabled successfully" || echo "Failed to disable SSH service"
|
||||
- systemctl disable sshd.service && echo "SSHD service disabled successfully" || echo "Failed to disable SSHD service"
|
||||
- systemctl stop ssh.service && echo "SSH service stopped successfully" || echo "Failed to stop SSH service"
|
||||
- systemctl stop sshd.service && echo "SSHD service stopped successfully" || echo "Failed to stop SSHD service"
|
||||
|
||||
# Completely remove SSH server
|
||||
- echo "Removing SSH server..."
|
||||
- apt-get purge -y openssh-server && echo "SSH server removed successfully" || echo "Failed to remove SSH server"
|
||||
- apt-get autoremove -y && echo "Removed dependencies successfully" || echo "Failed to remove dependencies"
|
||||
|
||||
# Set up firewall to only allow port 7002
|
||||
- echo "Setting up firewall..."
|
||||
- bash /cocos_init/setup_firewall.sh && echo "Firewall configured successfully" || echo "Failed to configure firewall"
|
||||
|
||||
# Ensure iptables rules persist after reboot
|
||||
- echo "Ensuring iptables rules persist after reboot..."
|
||||
- systemctl enable netfilter-persistent && echo "netfilter-persistent service enabled successfully" || echo "Failed to enable netfilter-persistent service"
|
||||
- systemctl start netfilter-persistent && echo "netfilter-persistent service started successfully" || echo "Failed to start netfilter-persistent service"
|
||||
|
||||
# Set up algo_user environment
|
||||
- echo "Setting up algo_user environment..."
|
||||
- bash /cocos_init/setup_algo_user.sh && echo "algo_user environment setup successfully" || echo "Failed to set up algo_user environment"
|
||||
|
||||
# Create datasets directory and set permissions
|
||||
- echo "Creating datasets directory..."
|
||||
- mkdir -p /datasets && echo "datasets directory created successfully" || echo "Failed to create datasets directory"
|
||||
- chown root:root /datasets && echo "datasets ownership set successfully" || echo "Failed to set datasets ownership"
|
||||
- chmod 755 /datasets && echo "datasets permissions set successfully" || echo "Failed to set datasets permissions"
|
||||
|
||||
# Add algo_user to the docker group
|
||||
- echo "Adding algo_user to the docker group..."
|
||||
- usermod -aG docker algo_user && echo "Added algo_user to the docker group" || echo "Failed to add algo_user to the docker group"
|
||||
|
||||
# Reload systemd and enable the service
|
||||
- echo "[ COCOS AGENT SETUP ] Reloading systemd daemon..."
|
||||
- systemctl daemon-reload && echo "[ COCOS AGENT SETUP ] Systemd daemon reloaded successfully" || echo "[ COCOS AGENT SETUP ] Failed to reload systemd daemon"
|
||||
@@ -171,4 +306,4 @@ runcmd:
|
||||
- echo "[ COCOS AGENT SETUP ] Starting cocos-agent.service..."
|
||||
- systemctl start cocos-agent.service && echo "[ COCOS AGENT SETUP ] cocos-agent.service started successfully" || echo "[ COCOS AGENT SETUP ] Failed to start cocos-agent.service"
|
||||
|
||||
final_message: "Cocos agent setup complete. Verify logs to confirm successful service startup."
|
||||
final_message: "Cocos agent and algo_user setup complete. Verify logs to confirm successful service startup."
|
||||
|
||||
Reference in New Issue
Block a user