diff --git a/Dockerfile b/Dockerfile index 11e651f4..22c12da4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -35,13 +35,11 @@ ENV HOSTNAME= RUN echo 'deb http://deb.debian.org/debian bookworm-backports main' >> /etc/apt/sources.list RUN apt-get update && apt-get install -y \ - supervisor curl jq jc borgbackup/bookworm-backports openssh-server rsyslog && \ + supervisor curl jq jc borgbackup/bookworm-backports dropbear rsyslog && \ apt-get clean && rm -rf /var/lib/apt/lists/* RUN groupadd -g ${GID} borgwarehouse && useradd -m -u ${UID} -g ${GID} borgwarehouse -RUN cp /etc/ssh/moduli /home/borgwarehouse/ - WORKDIR /home/borgwarehouse/app COPY --from=builder --chown=borgwarehouse:borgwarehouse /app/docker/docker-bw-init.sh /app/LICENSE ./ @@ -51,7 +49,9 @@ COPY --from=builder --chown=borgwarehouse:borgwarehouse /app/public ./public COPY --from=builder --chown=borgwarehouse:borgwarehouse /app/.next/static ./.next/static COPY --from=builder --chown=borgwarehouse:borgwarehouse /app/docker/supervisord.conf ./ COPY --from=builder --chown=borgwarehouse:borgwarehouse /app/docker/rsyslog.conf /etc/rsyslog.conf -COPY --from=builder --chown=borgwarehouse:borgwarehouse /app/docker/sshd_config ./ +COPY --from=builder --chown=borgwarehouse:borgwarehouse /app/docker/start_dropbear.sh ./ + +RUN chmod +x ./start_dropbear.sh USER borgwarehouse diff --git a/docker/docker-bw-init.sh b/docker/docker-bw-init.sh index 441e2961..7d7977fb 100755 --- a/docker/docker-bw-init.sh +++ b/docker/docker-bw-init.sh @@ -14,14 +14,11 @@ print_red() { } init_ssh_server() { - if [ -z "$(ls -A /etc/ssh)" ]; then - print_green "/etc/ssh is empty, generating SSH host keys..." - ssh-keygen -A - cp /home/borgwarehouse/moduli /etc/ssh/ - fi - if [ ! -f "/etc/ssh/sshd_config" ]; then - print_green "sshd_config not found in your volume, copying the default one..." - cp /home/borgwarehouse/app/sshd_config /etc/ssh/ + if [ -z "$(ls -A $SSH_DIR)" ]; then + print_green "$SSH_DIR is empty, generating SSH host keys..." + dropbearkey -t rsa -f $SSH_DIR/ssh_host_rsa_key + dropbearkey -t ed25519 -f $SSH_DIR/ssh_host_ed25519_key + dropbearkey -t ecdsa -f $SSH_DIR/ssh_host_ecdsa_key fi } @@ -53,9 +50,9 @@ check_repos_directory() { get_SSH_fingerprints() { print_green "Getting SSH fingerprints..." - RSA_FINGERPRINT=$(ssh-keygen -lf /etc/ssh/ssh_host_rsa_key | awk '{print $2}') - ED25519_FINGERPRINT=$(ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key | awk '{print $2}') - ECDSA_FINGERPRINT=$(ssh-keygen -lf /etc/ssh/ssh_host_ecdsa_key | awk '{print $2}') + RSA_FINGERPRINT=$(dropbearkey -y -f $SSH_DIR/ssh_host_rsa_key | awk 'END{print $2}') + ED25519_FINGERPRINT=$(dropbearkey -y -f $SSH_DIR/ssh_host_ed25519_key | awk 'END{print $2}') + ECDSA_FINGERPRINT=$(dropbearkey -y -f $SSH_DIR/ssh_host_ecdsa_key | awk 'END{print $2}') export SSH_SERVER_FINGERPRINT_RSA="$RSA_FINGERPRINT" export SSH_SERVER_FINGERPRINT_ED25519="$ED25519_FINGERPRINT" export SSH_SERVER_FINGERPRINT_ECDSA="$ECDSA_FINGERPRINT" @@ -76,7 +73,6 @@ check_env() { } check_env -init_ssh_server check_ssh_directory create_authorized_keys_file check_repos_directory diff --git a/docker/rsyslog.conf b/docker/rsyslog.conf index 7ece884b..8e174590 100644 --- a/docker/rsyslog.conf +++ b/docker/rsyslog.conf @@ -19,11 +19,11 @@ input(type="imfile" ruleset="bwLogs") input(type="imfile" - File="/home/borgwarehouse/tmp/sshd.log" - Tag="sshd" + File="/home/borgwarehouse/tmp/dropbear.log" + Tag="dropbear" Severity="info" Facility="local7" - ruleset="sshdLogs") + ruleset="dropbearLogs") $template myFormat,"%timegenerated:::date-rfc3339% %syslogtag% %msg%\n" @@ -33,8 +33,8 @@ ruleset(name="bwLogs") { Template="myFormat") } -ruleset(name="sshdLogs") { +ruleset(name="dropbearLogs") { action(type="omfile" - File="/home/borgwarehouse/logs/sshd.log" + File="/home/borgwarehouse/logs/dropbear.log" Template="myFormat") } diff --git a/docker/sshd_config b/docker/sshd_config deleted file mode 100644 index 748e9911..00000000 --- a/docker/sshd_config +++ /dev/null @@ -1,32 +0,0 @@ -Port 22 -PidFile /home/borgwarehouse/tmp/sshd.pid -AllowUsers borgwarehouse -LogLevel INFO -SyslogFacility AUTH - -# Security -Protocol 2 -PermitRootLogin no -PasswordAuthentication no -ChallengeResponseAuthentication no -AuthenticationMethods publickey -MaxAuthTries 2 -MaxStartups 2:30:10 -LoginGraceTime 30 -UsePAM no - -# Useless options for BorgWarehouse -PrintMotd no -UseDNS no -AllowTcpForwarding no -X11Forwarding no -PermitTTY no - -# Ciphers -Ciphers aes256-ctr,aes192-ctr,aes128-ctr -MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com - -# With low bandwidth or huge backup, uncomment the following lines to avoid SSH timeout (Broken pipe). -#ClientAliveInterval 600 -#ClientAliveCountMax 0 - diff --git a/docker/start_dropbear.sh b/docker/start_dropbear.sh new file mode 100644 index 00000000..f884eec1 --- /dev/null +++ b/docker/start_dropbear.sh @@ -0,0 +1,10 @@ +#!/bin/bash + +dropbear -p 0.0.0.0:22 \ + -P /home/borgwarehouse/tmp/sshd.pid \ + -r /home/borgwarehouse/.ssh/ssh_host_ecdsa_key \ + -r /home/borgwarehouse/.ssh/ssh_host_ed25519_key \ + -r /home/borgwarehouse/.ssh/ssh_host_rsa_key \ + -s \ + -w \ + -m diff --git a/docker/supervisord.conf b/docker/supervisord.conf index 0930b956..b24e12ba 100644 --- a/docker/supervisord.conf +++ b/docker/supervisord.conf @@ -6,9 +6,9 @@ pidfile=/home/borgwarehouse/tmp/supervisord.pid logfile_maxbytes=10MB logfile_backups=5 -[program:sshd] -command=/usr/sbin/sshd -D -e -f /etc/ssh/sshd_config -stdout_logfile=/home/borgwarehouse/tmp/sshd.log +[program:dropbear] +command=sh /home/borgwarehouse/app/start_dropbear.sh +stdout_logfile=/home/borgwarehouse/tmp/dropbear.log stdout_logfile_maxbytes=10MB stdout_logfile_backups=5 redirect_stderr=true