Some hardening

6 files changed, 41 insertions, 9 deletions

diff --git a/cgit/ssh/git-shell-commands/fork b/cgit/ssh/git-shell-commands/fork
index 52803d3..c2bc799 100755
--- a/cgit/ssh/git-shell-commands/fork
+++ b/cgit/ssh/git-shell-commands/fork
@@ -12,6 +12,7 @@ fi
 
 repo_name="$1"; shift 1;
 [ -z "$repo_name" ] && echo "Error: empty repo name" 1>&2 && exit 1
+(echo "$repo_name" | grep -q "^[A-Za-z0-9_-]\+$" 2>/dev/null) || (echo "Error: invalid repo name" 1>&2 && exit 1)
 
 remote_repo_url="$1"; shift 1;
 [ -z "$remote_repo_url" ] && echo "Error: empty repo url" 1>&2 && exit 1
diff --git a/cgit/ssh/git-shell-commands/new b/cgit/ssh/git-shell-commands/new
index ec2d8ca..6b5a03d 100755
--- a/cgit/ssh/git-shell-commands/new
+++ b/cgit/ssh/git-shell-commands/new
@@ -12,6 +12,7 @@ fi
 
 repo_name="$1"; shift 1;
 [ -z "$repo_name" ] && echo "Error: empty repo name" 1>&2 && exit 1
+(echo "$repo_name" | grep -q "^[A-Za-z0-9_-]\+$" 2>/dev/null) || (echo "Error: invalid repo name" 1>&2 && exit 1)
 
 # Stupid cmdline parsing means I can't do $1 here for space separated stuff
 description="$*"
diff --git a/cgit/ssh/git-shell-commands/set-description b/cgit/ssh/git-shell-commands/set-description
index a120fa0..ea0e52e 100755
--- a/cgit/ssh/git-shell-commands/set-description
+++ b/cgit/ssh/git-shell-commands/set-description
@@ -9,6 +9,7 @@ fi
 
 repo_name="$1"; shift 1;
 [ -z "$repo_name" ] && echo "Error: empty repo name" 1>&2 && exit 1
+(echo "$repo_name" | grep -q "^[A-Za-z0-9_-]\+$" 2>/dev/null) || (echo "Error: invalid repo name" 1>&2 && exit 1)
 
 description="$*";
 [ -z "$description" ] && echo "Error: empty description" 1>&2 && exit 1
diff --git a/setup.sh b/setup.sh
index 16240cd..644397e 100755
--- a/setup.sh
+++ b/setup.sh
@@ -5,7 +5,7 @@ set -eu
 ROOT_DIR=${ROOT_DIR:-"/opt/project"}
 
 configure() {
-  configure_user && configure_fs && configure_packages && configure_git && configure_firewall
+  configure_user && configure_fs && configure_packages && configure_git && configure_ssh && configure_firewall
 }
 
 services() { cd "$ROOT_DIR"; docker compose --profile services "$@"; }
@@ -14,43 +14,62 @@ core() { cd "$ROOT_DIR"; docker compose --profile core "$@"; }
 
 # TODO: use --wait and add health checks
 start() {
-  stop || true; services up -d "$@"
+  services build --pull
+  stop || true
+  services up -d "$@"
   core down nginx
   core up nginx -d
 }
 
-startfg() { stop || true; services up "$@"; }
+startfg() {
+  services build --pull
+  stop || true
+  services up "$@"
+}
 
 stop() { services down; }
 
 configure_packages() {
+  echo "== Packages =="
   apt install \
     docker.io docker-buildx docker-compose-v2 \
     git ufw
 }
 
 configure_git() {
+  echo "== Git =="
   sudo -u git git config --global init.defaultBranch main
-  # kept explicit shell setup
-  chsh -s "$(which git-shell)" git
-  ln -sf "$ROOT_DIR/cgit/ssh/git-shell-commands" /home/git/
+  sudo -u git git config --global receive.fsckObjects true
+  sudo -u git git config --global core.sharedRepository group
+  chsh -s "$(which git-shell)" git # kept explicit shell setup
+  ln -sf "$ROOT_DIR/cgit/ssh/git-shell-commands" /git/
+}
+
+configure_ssh() {
+  echo "== Git =="
+  ln -sf "$ROOT_DIR/ssh/sshd-config/host.conf" /etc/ssh/sshd_config.d/100-host.conf
+  ln -sf "$ROOT_DIR/ssh/sshd-config/git.conf" /etc/ssh/sshd_config.d/110-git.conf
+  # Set up authorized keys for git?
 }
 
 configure_firewall() {
+  echo "== Firewall =="
   ufw allow 443/tcp
   ufw allow 80/tcp
-  ufw allow 22
-  ufw enable
+  ufw limit 22/tcp
 }
 
 configure_user() {
+  echo "== User =="
+  mkdir -p /home/git
   groupadd -f -g 1001 git
-  useradd --shell /usr/sbin/nologin git --uid 1001 --gid 1001 || true
+  useradd --shell /usr/sbin/nologin --home-dir /home/git git --uid 1001 --gid 1001 || true
   groupadd -f -g 1002 send
   useradd --shell /usr/sbin/nologin --no-create-home send --uid 1002 --gid 1002 || true
 }
 
 configure_fs() {
+  echo "== File system =="
   mkdir -p /git
   chown -R git:git /git
   mkdir -p /uploads
diff --git a/ssh/sshd-config/git.conf b/ssh/sshd-config/git.conf
new file mode 100644
index 0000000..102725a
--- /dev/null
+++ b/ssh/sshd-config/git.conf
@@ -0,0 +1,6 @@
+Match Group git
+    X11Forwarding no
+    AllowTcpForwarding no
+    PermitTunnel no
+    AllowAgentForwarding no
+    GatewayPorts no
diff --git a/ssh/sshd-config/host.conf b/ssh/sshd-config/host.conf
new file mode 100644
index 0000000..851b876
--- /dev/null
+++ b/ssh/sshd-config/host.conf
@@ -0,0 +1,4 @@
+MaxAuthTries 3
+LoginGraceTime 20
+PasswordAuthentication no
+KbdInteractiveAuthentication no