okooooooo/linux-ssh-init-sh
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
53 Commits 1 Branch 0 Tags
main
Commit Graph
53 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
247like 99c0fde79b ci: harden workflow regression coverage 2026-06-01 15:11:23 +08:00
247like 326fa57b64 merge: release v4.7.8 2026-06-01 15:02:59 +08:00
247like a74f700546 fix: harden v4.7.8 audit fixes 2026-06-01 15:02:53 +08:00
c-ujungandClaude Opus 4.7 4982f727cf feat: v4.7.8 Enterprise Hardening (18 audit rounds, 11 fix iterations) 
Aggregates v4.7.0 through v4.7.8. Roughly 1850 lines added to init.sh
(2206 -> 4059); 10 CI jobs (was 1); README +113/+115 lines (zh/en).

CRIT/HIGH fixes across iterations:
  - existing-user passwd-d regression (v4.7.1)
  - rollback artifact tracking with provenance (v4.7.0/4/5)
  - restart_sshd direct-spawn fallback for no-init envs (v4.7.1)
  - chroot pkill defense (v4.7.6/8: both direct-spawn and systemctl paths)
  - PATH inheritance hardening (v4.7.8): /usr/local/sbin:/usr/local/bin:
    /usr/sbin:/usr/bin:/sbin:/bin set at script top
  - audit_log newline-injection defense (v4.7.6)
  - script-level mutex with stale-PID + kill -0 liveness (v4.7.6/7)
  - ARTIFACT_FILE mirror to RUNTIME_DIR for post-SIGKILL recovery (v4.7.6)
  - SELinux NOOP-vs-ADD provenance (v4.7.5) + cross-run cleanup (v4.7.4)
  - leading-zero port bypass of is_hard_reserved (v4.7.6, e.g. --port=03306
    silently shadowing MySQL)
  - setup_rollback ENOSPC verification (v4.7.7): empty snapshot would
    blank live sshd_config on rollback
  - record_last_applied atomic write via tmp+mv (v4.7.7)
  - audit_log stderr fallback when /var/log is unwritable (v4.7.7)
  - duplicate-argv hard-fail (v4.7.6): --user/--port/--key-* duplicates
    now refused instead of silent last-wins
  - validate_username + --key-gh per-line grep bypass (v4.7.6): newline-
    containing values now rejected via case-match before grep
  - leading-zero port (v4.7.6): rejected to prevent sshd parsing 03306
    as decimal 3306, shadowing MySQL

41 audit_log actions for SIEM ingestion. README documents all of them
with bold-marked high-priority alerts (ROLLBACK_RM_FAILED /
STRANDED_MUTATIONS_DETECTED / SUDO_FAIL / etc).

10 CI jobs cover: shellcheck (POSIX -s sh), 9-distro matrix with 18
assertions + idempotency re-run, live restart with banner check,
existing-user safety (passwd -S = P), cross-user sudoers glob safety,
legacy v4.6.x sudoers cleanup, CLI flag smoke (--version/-V/-h/
--no-ip-probe/--strict), --no-ip-probe verification, ACCOUNT_KEPT_LOCKED
path, restore.sh checksum gate + FORCE=1 bypass.

Branch convention: dev/v4.7.8 — not yet promoted to main. Awaiting
real-machine deployment validation before tag + release.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-23 15:03:22 +08:00
247LIKE a231e51b3b Improve comments and update SSH init script 
Refactor comments for clarity and update dynamic script generation.
 2026-03-26 16:40:12 +08:00
247LIKE 612f7903cc Add author and license information to init.sh 2026-01-26 14:14:34 +08:00
247LIKE b2ccb58dc9 Refactor update_motd to enhance MOTD management 
Refactor update_motd function to clean old MOTD and create dynamic SSH banner script.
 2025-12-26 17:52:38 +08:00
247LIKE bdc0aef19f Change init script user from 'root' to '_247like' 2025-12-18 20:23:48 +08:00
247LIKE 8699a5c535 Add strict flag to command example in README 2025-12-18 20:21:46 +08:00
247LIKE 56abb59c2f Add strict flag to command example in README 2025-12-18 20:21:20 +08:00
247LIKE c0799ad5ee Fix user account locking and update SSH settings 
Unlock user account by clearing password for SSH key usage.
 2025-12-18 20:17:10 +08:00
247LIKE 10fe173397 Enhance warning message for SSH connection failure 
Updated warning message for failed SSH connection to provide more context.
 2025-12-16 17:03:33 +08:00
247LIKE 0b52a77d46 Add installation checks for netcat and sudo 
Added checks to install missing dependencies: netcat and sudo.
 2025-12-16 16:49:41 +08:00
247LIKE dee80b0be7 Enhance SSH connection attempts for IPv6 
Add support for IPv6 loopback connection attempts in init.sh.
 2025-12-16 16:34:47 +08:00
247LIKE 00231364b9 Enhance ssh service management and security checks 
Added compatibility optimizations for stopping and disabling ssh.socket, and updated nc command to use 127.0.0.1 instead of localhost for security.
 2025-12-16 16:27:25 +08:00
247LIKE 89d8ae6339 Disable explicit ListenAddress for socket activation 
Comment out ListenAddress lines for IPv6 and IPv4.
 2025-12-16 16:02:57 +08:00
247LIKE 14bf14d724 Update README_EN.md 2025-12-16 10:55:13 +08:00
247LIKE e79d032fc5 Update README.md with badge and link changes 2025-12-16 10:54:55 +08:00
247LIKE 3058cc09dc Update version from 4.6.1 to 4.6.2 in init.sh 2025-12-16 10:42:16 +08:00
247LIKE 9e9be91981 Add GitHub Actions test badge to README 
Added a badge for the GitHub Actions test workflow.
 2025-12-16 10:36:47 +08:00
247LIKE 12b2cc7587 Add GitHub Actions test badge to README 
Added a GitHub Actions badge to README for test status.
 2025-12-16 10:18:43 +08:00
247LIKE 01c3781ec3 Refine Docker test workflow for CentOS 7 
Updated comments and commands for CentOS 7 compatibility in the Docker test workflow.
 2025-12-16 10:14:53 +08:00
247LIKE 43601ba94f Fix CentOS 7 EOL repos and update init script steps 
Updated test workflow to fix CentOS 7 EOL repository issues and install necessary dependencies.
 2025-12-16 10:10:46 +08:00
247LIKE eab93f3e08 Fix CentOS 7 EOL and improve workflow steps 
Updated the GitHub Actions workflow to fix CentOS 7 EOL repository issues and improve container initialization steps.
 2025-12-16 10:08:18 +08:00
247LIKE 51fb3bd675 Enhance test workflow for better OS compatibility 
Updated the test workflow to improve compatibility with CentOS and other distributions. Added comments for clarity and fixed the initialization process for various environments.
 2025-12-16 10:03:58 +08:00
247LIKE 9da662f8d6 Add GitHub Actions workflow for testing multiple containers 2025-12-16 09:59:25 +08:00
247LIKE ba55116491 Update warning messages and enhance user validation 2025-12-16 09:47:19 +08:00
247LIKE e5d587595d Update release version and changelog to v4.6.2 2025-12-15 19:50:59 +08:00
247LIKE 3368584ccd Bump version to v4.6.1 and enhance security features 
Updated the script version to v4.6.1 and made various security fixes, including symlink protection and improved validation for SSH keys and configurations.
 2025-12-15 19:18:12 +08:00
247LIKE 03c43cd2a8 Update init.sh 2025-12-15 18:39:12 +08:00
247LIKE 2696a28765 Update README_EN.md 2025-12-15 17:57:24 +08:00
247LIKE 5c1cd73017 Update README.md 2025-12-15 17:52:50 +08:00
247LIKE de60b8c050 Revise README with updated badge links and features 
Updated badge links and improved security architecture details in README.
 2025-12-15 17:51:47 +08:00
247LIKE cde36a6b80 update 2025-12-15 17:24:36 +08:00
247LIKE 4b014f21c8 Release v4.0.0 
Release v4.0.0: Platinum Edition - Health Reports, Metadata Backups & POSIX Compliance

Major release v4.0.0 brings enterprise-grade reliability and strict POSIX compliance.

New Features:
- Feat: Added comprehensive `preflight_checks` to verify core tools, disk space, and memory before execution.
- Feat: Implemented triple-redundancy IPv6 detection (checking `/proc`, `ip`, and `ifconfig`) to ensure accuracy on minimal/container systems.
- Feat: Added persistent, versioned backups in `/var/backups/ssh-config/` with accompanying `.meta` files for audit trails.
- Feat: Automatically generates a detailed `Health Report` upon successful completion.

Fixes & Improvements:
- Refactor: Replaced all Bash-isms (e.g., arrays) with strict POSIX string handling for full Alpine/Dash compatibility.
- Fix: Clarified random port generation logic to strictly avoid Kubernetes NodePort range (30000-32767).
- Security: Enhanced temporary directory handling using `mktemp` and traps for secure cleanup.
 2025-12-15 13:08:44 +08:00
247LIKE ee4161e30b Release v1.0.5: Critical hardening, improved compatibility, and logic fixes 
This major update upgrades the script from v1.0.0 to v1.0.5 (Production Gold).

**Key Improvements & Fixes:**

* **Critical Fixes:**
    * Fixed `ss` command parsing logic to prevent port detection false positives (e.g., port 22 matching port 2).
    * Fixed log file initialization order to prevent crashes before dependency checks.
    * Added `export LC_ALL=C` to ensure consistent POSIX command behavior across different locales.

* **Safety Hardening:**
    * Added passive detection for `AllowUsers` configuration trap to prevent lockout.
    * Improved `sshd_config` cleanup regex to handle indented lines correctly.
    * Added fail-safe protection for log writing (prevents script crash if log is unwritable).

* **Compatibility:**
    * Added `wget` fallback for key fetching if `curl` is missing.
    * Updated `chown` syntax to `user:` for better group compatibility on Alpine/minimal systems.
    * Added pre-flight check for core dependencies (`grep`, `awk`, `sed`, `id`).
    * Forced `procps` installation check before enabling BBR.

* **Refactor:**
    * Optimized i18n handling (optional based on implementation).
 2025-12-15 11:14:42 +08:00
247LIKE d4e94f0b33 Change default language from English to Chinese 2025-12-12 21:00:47 +08:00
247LIKE 2a3cb4bbd9 Update README_EN.md 2025-12-12 20:28:20 +08:00
247LIKE f1349ac4e4 Fix link to English README file 2025-12-12 20:26:04 +08:00
247LIKE c1cf0be5ec Update README.md 2025-12-12 20:25:29 +08:00
247LIKE 9f9400c81f Update README.md 2025-12-12 20:22:32 +08:00
247LIKE b228af83d9 Update README.md 2025-12-12 20:22:03 +08:00
247LIKE 0142134e9c Update README.md 2025-12-12 20:21:43 +08:00
247LIKE 1468dc21c0 Update README.md 2025-12-12 20:21:18 +08:00
247LIKE 3bcfbad992 Fix links and enhance README content 
Updated links and descriptions for clarity and consistency.
 2025-12-12 20:16:10 +08:00
247LIKE c2c0253804 Update init.sh 2025-12-12 20:11:09 +08:00
247LIKE ff4654d94f Update README for Chinese localization and instructions 2025-12-12 20:06:41 +08:00
247LIKE a74bd2a07a Create README_EN.md for project documentation 
Added README for Linux Server Init & SSH Hardening Script.
 2025-12-12 19:52:57 +08:00
247LIKE a214efc6ae Revise README for language and formatting updates 
Updated language options and improved formatting in README.
 2025-12-12 19:51:43 +08:00
247LIKE b0d908ba2d init 2025-12-12 19:42:33 +08:00