okooooooo/linux-ssh-init-sh
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
53 Commits 1 Branch 0 Tags
main
Commit Graph
18 Commits
Author SHA1 Message Date
c-ujungandClaude Opus 4.7 4982f727cf feat: v4.7.8 Enterprise Hardening (18 audit rounds, 11 fix iterations) 
Aggregates v4.7.0 through v4.7.8. Roughly 1850 lines added to init.sh
(2206 -> 4059); 10 CI jobs (was 1); README +113/+115 lines (zh/en).

CRIT/HIGH fixes across iterations:
  - existing-user passwd-d regression (v4.7.1)
  - rollback artifact tracking with provenance (v4.7.0/4/5)
  - restart_sshd direct-spawn fallback for no-init envs (v4.7.1)
  - chroot pkill defense (v4.7.6/8: both direct-spawn and systemctl paths)
  - PATH inheritance hardening (v4.7.8): /usr/local/sbin:/usr/local/bin:
    /usr/sbin:/usr/bin:/sbin:/bin set at script top
  - audit_log newline-injection defense (v4.7.6)
  - script-level mutex with stale-PID + kill -0 liveness (v4.7.6/7)
  - ARTIFACT_FILE mirror to RUNTIME_DIR for post-SIGKILL recovery (v4.7.6)
  - SELinux NOOP-vs-ADD provenance (v4.7.5) + cross-run cleanup (v4.7.4)
  - leading-zero port bypass of is_hard_reserved (v4.7.6, e.g. --port=03306
    silently shadowing MySQL)
  - setup_rollback ENOSPC verification (v4.7.7): empty snapshot would
    blank live sshd_config on rollback
  - record_last_applied atomic write via tmp+mv (v4.7.7)
  - audit_log stderr fallback when /var/log is unwritable (v4.7.7)
  - duplicate-argv hard-fail (v4.7.6): --user/--port/--key-* duplicates
    now refused instead of silent last-wins
  - validate_username + --key-gh per-line grep bypass (v4.7.6): newline-
    containing values now rejected via case-match before grep
  - leading-zero port (v4.7.6): rejected to prevent sshd parsing 03306
    as decimal 3306, shadowing MySQL

41 audit_log actions for SIEM ingestion. README documents all of them
with bold-marked high-priority alerts (ROLLBACK_RM_FAILED /
STRANDED_MUTATIONS_DETECTED / SUDO_FAIL / etc).

10 CI jobs cover: shellcheck (POSIX -s sh), 9-distro matrix with 18
assertions + idempotency re-run, live restart with banner check,
existing-user safety (passwd -S = P), cross-user sudoers glob safety,
legacy v4.6.x sudoers cleanup, CLI flag smoke (--version/-V/-h/
--no-ip-probe/--strict), --no-ip-probe verification, ACCOUNT_KEPT_LOCKED
path, restore.sh checksum gate + FORCE=1 bypass.

Branch convention: dev/v4.7.8 — not yet promoted to main. Awaiting
real-machine deployment validation before tag + release.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-23 15:03:22 +08:00
247LIKE 56abb59c2f Add strict flag to command example in README 2025-12-18 20:21:20 +08:00
247LIKE e79d032fc5 Update README.md with badge and link changes 2025-12-16 10:54:55 +08:00
247LIKE 12b2cc7587 Add GitHub Actions test badge to README 
Added a GitHub Actions badge to README for test status.
 2025-12-16 10:18:43 +08:00
247LIKE 5c1cd73017 Update README.md 2025-12-15 17:52:50 +08:00
247LIKE de60b8c050 Revise README with updated badge links and features 
Updated badge links and improved security architecture details in README.
 2025-12-15 17:51:47 +08:00
247LIKE f1349ac4e4 Fix link to English README file 2025-12-12 20:26:04 +08:00
247LIKE c1cf0be5ec Update README.md 2025-12-12 20:25:29 +08:00
247LIKE 9f9400c81f Update README.md 2025-12-12 20:22:32 +08:00
247LIKE b228af83d9 Update README.md 2025-12-12 20:22:03 +08:00
247LIKE 0142134e9c Update README.md 2025-12-12 20:21:43 +08:00
247LIKE 1468dc21c0 Update README.md 2025-12-12 20:21:18 +08:00
247LIKE 3bcfbad992 Fix links and enhance README content 
Updated links and descriptions for clarity and consistency.
 2025-12-12 20:16:10 +08:00
247LIKE ff4654d94f Update README for Chinese localization and instructions 2025-12-12 20:06:41 +08:00
247LIKE a214efc6ae Revise README for language and formatting updates 
Updated language options and improved formatting in README.
 2025-12-12 19:51:43 +08:00
247LIKE b0d908ba2d init 2025-12-12 19:42:33 +08:00
247LIKE c888e95680 Revise README for Linux SSH Init Script 
Updated README to enhance clarity and provide detailed features.
 2025-12-12 19:36:38 +08:00
247LIKE 2c6f1d3364 Initial commit 2025-12-12 19:35:08 +08:00