30 lines
1.6 KiB
Bash
30 lines
1.6 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# Run Phase 2 security (SSH key-only, firewall 8006) on all Proxmox hosts via SSH.
|
||
|
|
# Usage: bash scripts/security/run-security-on-proxmox-hosts.sh [--dry-run|--apply]
|
||
|
|
# Requires: SSH as root to 192.168.11.10, .11, .12 (or PROXMOX_ML110, PROXMOX_R630_01, PROXMOX_R630_02).
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
|
|
PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
|
||
|
|
source "$PROJECT_ROOT/config/ip-addresses.conf" 2>/dev/null || true
|
||
|
|
[ -f "$PROJECT_ROOT/.env" ] && set +u && source "$PROJECT_ROOT/.env" 2>/dev/null || true && set -u
|
||
|
|
|
||
|
|
DRY_RUN=true
|
||
|
|
[[ "${1:-}" == "--apply" ]] && DRY_RUN=false
|
||
|
|
|
||
|
|
HOSTS="${PROXMOX_ML110:-192.168.11.10} ${PROXMOX_R630_01:-192.168.11.11} ${PROXMOX_R630_02:-192.168.11.12}"
|
||
|
|
ADMIN_CIDR="${ADMIN_CIDR:-${NETWORK_192_168_11_0:-192.168.11.0}/24}"
|
||
|
|
SSH_OPTS="-o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new"
|
||
|
|
|
||
|
|
echo "[Security] Proxmox hosts: $HOSTS (DRY_RUN=$DRY_RUN)"
|
||
|
|
for h in $HOSTS; do
|
||
|
|
echo "--- $h ---"
|
||
|
|
if $DRY_RUN; then
|
||
|
|
echo " Would run: SSH key-only (disable password) + UFW allow $ADMIN_CIDR to 8006"
|
||
|
|
continue
|
||
|
|
fi
|
||
|
|
ssh $SSH_OPTS root@"$h" "sudo sed -i.bak 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config && sudo systemctl reload sshd 2>/dev/null || true" && echo " SSH: password auth disabled" || echo " SSH: skip or failed"
|
||
|
|
ssh $SSH_OPTS root@"$h" "command -v ufw >/dev/null && (sudo ufw allow from $ADMIN_CIDR to any port 8006; sudo ufw --force reload) || echo ' UFW not found'" && echo " UFW: 8006 restricted to $ADMIN_CIDR" || echo " UFW: skip or failed"
|
||
|
|
done
|
||
|
|
echo "Done."
|