Repository : http://git.fedorahosted.org/cgit/docs/fedora-cookbook.git
On branch : master
>---------------------------------------------------------------
commit a4cd831fbd924b766eb58b020a649f2f05b36807
Author: Pete Travis <immanetize(a)fedoraproject.org>
Date: Tue Apr 22 23:08:33 2014 -0600
Starting a recipe on using a locked down account for automated git pulls
>---------------------------------------------------------------
en-US/git/secure-git-pull.xml | 142 +++++++++++++++++++++++++++++++++++++++++
1 files changed, 142 insertions(+), 0 deletions(-)
diff --git a/en-US/git/secure-git-pull.xml b/en-US/git/secure-git-pull.xml
new file mode 100644
index 0000000..c2d21f3
--- /dev/null
+++ b/en-US/git/secure-git-pull.xml
@@ -0,0 +1,142 @@
+
+<?xml version='1.0' encoding='utf-8' ?>
+ <!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+ "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+ <!ENTITY % BOOK_ENTITIES SYSTEM "Fedora_Cookbook.ent">
+ %BOOK_ENTITIES;
+]>
+<!-- Do not edit above this line -->
+<!--
+ Please provide some information so we can give you credit:
+ name: Pete Travis
+ fas_id: immanetize
+ email: immanetize(a)fedoraproject.org
+-->
+
+<section id="secure_git_pull">
+ <title>Secure deployment with Git and SSH</title>
+ <para>
+ Git, a distributed version control system, can be used to transfer software and other files to remote systems. By configuring the remote system to pull content from a git repository on a schedule, deployment can be accomplished with a simple local merge. Configuring the system that hosts the repository to restrict access from the remote system enhances security without affecting the method's usefulness.
+ </para>
+ <section id="secure_git_pull-ingredients">
+ <title>Required Ingredients</title>
+ <!-- list packages, services, other recipes etc that are required -->
+ <itemizedlist>
+ <listitem><para>
+ Two computers running Fedora with a working network connection.
+ </para></listitem>
+ <listitem><para>
+ Git installed on both systems, and a git repository on one.
+ <!-- TODO: need git recipe! -->
+ </para></listitem>
+ <listitem><para>
+ A dedicated user account.
+ </listitem></para>
+ <listitem><para>
+ A dedicated <xref linkend="section-id">SSH authentication key</section>
+ </para></listitem>
+ </itemizedlist>
+ </section>
+ <section id="secure_git_pull-directions">
+ <title>Directions</title>
+ <procedure>
+ <title>Configuring the host</title>
+ <step><para>
+ Create and configure a new user account to use for the transfer. For security reasons, this account will only be allowed to interact with git.
+ <substeps>
+ <step>
+ <para>First, identify the path to your git repository. Store it in a shell variable, for convenience.</para>
+ <screen>
+ <command>
+ <replaceable>repo_directory=/srv/repos/my-project.git</replaceable>
+ </command>
+ </screen>
+ </step>
+ <step>
+ <para>Create the user account.</para>
+ <screen>
+ <command>
+ useradd --home $repo_directory --shell /usr/bin/git-shell <replaceable>puller</replaceable>
+ </command>
+ </screen>
+ <para>
+ The options given to <command>useradd</command> restrict the user's account. Refer to the explanation below, and <command>man useradd</command> for further insight.
+ </para>
+ <simplelist>
+ <member>
+ <parameter>--home $repo_directory</parameter> - sets the account's home directory as the repository, using the shell variable from the previous step.
+ </member>
+ <member>
+ <parameter>--shell /usr/bin/git-shell</parameter> - Sets the login shell to <application>git shell</application>, a special utility provided with git that will only allow the user to execute git commands.
+ </member>
+ <member>
+ <parameter><replaceable>puller</replaceable></parameter> - The name of the user to create. Name the account something that will remind you of its purpose.
+ </member>
+ </simplelist>
+ </step>
+ <step>
+ <para>
+ Copy the <literal>public</literal> half of your ssh key into the user's home directory.
+ <screen>
+ <command>mkdir $repo_directory/.ssh/</command>
+ <command>
+ cp <replaceable>puller_id_rsa</replaceable>.pub $repo_direcory/.ssh/
+ </command>
+ </screen>
+ </para>
+ </step>
+ <step>
+ <para>Give the user read only access to the repository</para>
+ <screen>
+ <command>
+ <!-- appropriate setfacl invocations here -->
+ </command>
+ </screen>
+ </step>
+ <step>
+ <formalpara>
+ <title><emphasis>Optional:</emphasis> tell git to ignore the ssh key</title>
+ <para>
+ You can add the ssh public key to your git repository to share it, or tell git to ignore they key with the instructions below.
+ <screen>
+ <command>pushd $repo_directory</command>
+ <command>echo ".ssh/" >> .gitignore</command>
+ <command>git add .gitignore</command>
+ <command>git commit -m "Ignore $repo_directory/.ssh"</command>
+ <command>popd</command>
+ </screen>
+ </para>
+ </formalpara>
+ </step>
+ </substeps>
+ <step>
+ <para>
+ Configure the remote host to use your repository
+ </para></step>
+ <step>
+ <para />
+ </step>
+ <step>
+ <para />
+ </step>
+ <step>
+ <para />
+ </step>
+ </procedure>
+ </section>
+
+ <section>
+ <title>References</title>
+ <itemizedlist>
+ <listitem>
+ <para><ulink url="http://example.com">Upstream Documentation</ulink></para>
+ </listitem>
+ <listitem>
+ <para><ulink url="http://example.com/myblog/posts/todays_date" /></para>
+ </listitem>
+ </itemizedlist>
+ </section>
+
+</section>
+
+
Repository : http://git.fedorahosted.org/cgit/docs/fedora-cookbook.git
On branch : master
>---------------------------------------------------------------
commit f369d8892b3af2727935c72b9b096d00fa311224
Author: Eric Christensen <echriste(a)redhat.com>
Date: Tue Apr 15 21:42:07 2014 -0400
Started working on GPG stuff
>---------------------------------------------------------------
en-US/Creating_GPG_Keys.xml | 92 +++++++++++++++++++++++++++++++++++++++++++
en-US/GPG.xml | 25 ++++++++++++
2 files changed, 117 insertions(+), 0 deletions(-)
diff --git a/en-US/Creating_GPG_Keys.xml b/en-US/Creating_GPG_Keys.xml
new file mode 100644
index 0000000..bef0507
--- /dev/null
+++ b/en-US/Creating_GPG_Keys.xml
@@ -0,0 +1,92 @@
+
+<?xml version='1.0' encoding='utf-8' ?>
+ <!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+ "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+ <!ENTITY % BOOK_ENTITIES SYSTEM "Fedora_Cookbook.ent">
+ %BOOK_ENTITIES;
+]>
+<!-- Do not edit above this line -->
+<!--
+ Please provide some information so we can give you credit:
+ name: Eric "Sparks" Christensen
+ fas_id: Sparks
+ email: sparks(a)fedoraproject.org
+-->
+
+<section id="Creating_GPG_Keys">
+ <title>Creating GPG keys.</title>
+ <para>
+ Creating GPG keys is easy. <code>gpg --gen-key</code>
+
+<screen>
+$ gpg --gen-key
+gpg (GnuPG) 1.4.16; Copyright (C) 2013 Free Software Foundation, Inc.
+This is free software: you are free to change and redistribute it.
+There is NO WARRANTY, to the extent permitted by law.
+
+Please select what kind of key you want:
+ (1) RSA and RSA (default)
+ (2) DSA and Elgamal
+ (3) DSA (sign only)
+ (4) RSA (sign only)
+Your selection? 1
+RSA keys may be between 1024 and 4096 bits long.
+What keysize do you want? (2048) 3072
+Requested keysize is 3072 bits
+Please specify how long the key should be valid.
+ 0 = key does not expire
+ <n> = key expires in n days
+ <n>w = key expires in n weeks
+ <n>m = key expires in n months
+ <n>y = key expires in n years
+Key is valid for? (0) 1y
+Key expires at Wed 15 Apr 2015 09:40:08 PM EDT
+Is this correct? (y/N) y
+
+You need a user ID to identify your key; the software constructs the user ID
+from the Real Name, Comment and Email Address in this form:
+ "Heinrich Heine (Der Dichter) <heinrichh(a)duesseldorf.de>"
+
+Real name: Beefy
+Email address: beefy(a)fedoraproject.org
+Comment: FAKE
+You selected this USER-ID:
+ "Beefy (FAKE) <beefy(a)fedoraproject.org>"
+
+Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
+You need a Passphrase to protect your secret key.
+
+You don't want a passphrase - this is probably a *bad* idea!
+I will do it anyway. You can change your passphrase at any time,
+using this program with the option "--edit-key".
+
+We need to generate a lot of random bytes. It is a good idea to perform
+some other action (type on the keyboard, move the mouse, utilize the
+disks) during the prime generation; this gives the random number
+generator a better chance to gain enough entropy.
+..+++++
+...+++++
+We need to generate a lot of random bytes. It is a good idea to perform
+some other action (type on the keyboard, move the mouse, utilize the
+disks) during the prime generation; this gives the random number
+generator a better chance to gain enough entropy.
+......+++++
+.........................+++++
+gpg: key 20EE698C marked as ultimately trusted
+public and secret key created and signed.
+
+gpg: checking the trustdb
+gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
+gpg: depth: 0 valid: 2 signed: 48 trust: 0-, 0q, 0n, 0m, 0f, 2u
+gpg: depth: 1 valid: 48 signed: 50 trust: 47-, 0q, 0n, 0m, 1f, 0u
+gpg: depth: 2 valid: 8 signed: 16 trust: 8-, 0q, 0n, 0m, 0f, 0u
+gpg: next trustdb check due at 2014-09-09
+pub 3072R/20EE698C 2014-04-16 [expires: 2015-04-16]
+ Key fingerprint = E6FE 3BF4 F307 00BD 6517 050F C159 309E 20EE 698C
+uid Beefy (FAKE) <beefy(a)fedoraproject.org>
+sub 3072R/C68ACE5D 2014-04-16 [expires: 2015-04-16]
+</screen>
+ </para>
+</section>
+
+
diff --git a/en-US/GPG.xml b/en-US/GPG.xml
new file mode 100644
index 0000000..7670e32
--- /dev/null
+++ b/en-US/GPG.xml
@@ -0,0 +1,25 @@
+
+<?xml version='1.0' encoding='utf-8' ?>
+ <!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+ "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+ <!ENTITY % BOOK_ENTITIES SYSTEM "Fedora_Cookbook.ent">
+ %BOOK_ENTITIES;
+]>
+<!-- Do not edit above this line -->
+<!--
+ Please provide some information so we can give you credit:
+ name: Eric "Sparks" Christensen
+ fas_id: Sparks
+ email: sparks(a)fedoraproject.org
+-->
+
+<section id="GnuPG">
+ <title>GnuPG</title>
+ <para>
+ <firstterm>GNU Privacy Guard</firstterm> or <firstterm>GnuPG</firstterm> or just plain <firstterm>GPG</firstterm> is an open source iteration of <firstterm>Pretty Good Privacy</firstterm> (PGP) and provides authentication and encryption for email and files based on asymmetric cryptography. Using GPG allows an individual or organization to help protect their coorespondances as they cross the Internet or other medium.
+ </para>
+ <xi:include href="Creating_GPG_Keys.xml" xmlns:xi="http://www.w3.org/2001/XInclude" />
+
+</section>
+
+
Repository : http://git.fedorahosted.org/cgit/docs/fedora-cookbook.git
On branch : master
>---------------------------------------------------------------
commit 170f999daea17e8b4cfe17b73df6c1d4fa23ce41
Author: Pete Travis <immanetize(a)fedoraproject.org>
Date: Mon Apr 14 12:58:00 2014 -0600
added a recipe for ssh proxying
>---------------------------------------------------------------
en-US/Security/ssh-proxy.xml | 118 ++++++++++++++++++++++++++++++++++++++++++
1 files changed, 118 insertions(+), 0 deletions(-)
diff --git a/en-US/Security/ssh-proxy.xml b/en-US/Security/ssh-proxy.xml
new file mode 100644
index 0000000..550cb82
--- /dev/null
+++ b/en-US/Security/ssh-proxy.xml
@@ -0,0 +1,118 @@
+
+<?xml version='1.0' encoding='utf-8' ?>
+ <!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+ "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+ <!ENTITY % BOOK_ENTITIES SYSTEM "../Fedora_Cookbook.ent">
+ %BOOK_ENTITIES;
+]>
+<!-- Do not edit above this line -->
+<!--
+ Please provide some information so we can give you credit:
+ name: Pete Travis
+ fas_id: immanetize
+ email: immanetize(a)fedoraproject.org
+-->
+
+<section id="ssh-proxy">
+ <title>SSH access to hosts on an internal network</title>
+ <para>
+ On a private network, such as the NAT network used by most homes, a machine can be accessed using ssh by forwarding the incoming port 22 on the router to a single machine inside the network. To access more than one machine from outside the network, proxy requests through that host.
+ </para>
+ <para>
+ This approach is more straightforward than forwarding multiple ports, because it only requires one forwarding rule to be configured, one change in the ssh client configuration for the outside machine, and no additional configuration on the other hosts.
+ </para>
+ <section id="ssh-proxy-ingredients">
+ <title>Required Ingredients</title>
+ <!-- list packages, services, other recipes etc that are required -->
+ <itemizedlist>
+ <listitem><para>
+ A port forwarding rule for one host on the internal network. Log in to your router to setup the rule. Because router interfaces vary, consult your router's manual for help.
+ </para></listitem>
+ <listitem><para>
+ A target for the above port forwarding rule configured to accept ssh connections (default on most systems).
+ </para></listitem>
+ <listitem><para>
+ An internal network with other ssh accessible hosts.
+ </para></listitem>
+ <listitem><para>
+ The outside address for your internal network. Home users with dynamically assigned IP addresses should read <xref linkend="no-ip" />
+ </para></listitem>
+ <listitem><para>
+ The address space for your internal network. On many home routers, this will be <systemitem class="ipaddress">192.168.1.*</systemitem> or <systemitem class="ipaddress">192.168.0.1>
+ </para>
+ <warning>
+ <title>Address Space Reuse</title>
+ <para>
+ Adddresses like <systemitem class="ipaddress">192.168.1.0/24</systemitem> are reserved for use in private networks. Because the proxy rule is applied based on the address space of the target, you should configure your router to use a less common set of addresses.
+ </para>
+ <para>
+ If your router can give addresses in the <systemitem class="ipaddress">192.168.42.0/24</systemitem> network, for example, your proxy rule won't get in the way when connecting to machines on a different network that uses <systemitem class="ipaddress">192.168.1.0/24</systemitem> addresses.
+ </para>
+ </warning>
+ </itemizedlist>
+ </section>
+ <section id="ssh-proxy-directions">
+ <title>Directions</title>
+ <procedure>
+ <title>Configuring an ssh proxy</title>
+ <step><para>
+ Configure your router to forward incoming traffic on port 22 to one machine that will act as the proxy. If you choose, configure the router to use a less common subnet then reboot it.
+ </para></step>
+ <step><para>
+ Open the firewall on all machines to ssh traffic. This is the default on most systems. Use the graphical firewall application <application>firewall-config</application>, or issue the commands below as root.
+ <screen>
+ <command>firewall-cmd --permanent --add-service=ssh</command>
+ <command>firewall-cmd --reload
+ </screen>
+ </para></step>
+ <step><para>
+ Ensure <systemitem class="daemon">sshd</systemitem> is enabled and running on all target systems by running the commands below as root.
+ <screen>
+ <command>systemctl enable sshd</command>
+ <command>systemctl start sshd</command>
+ </screen>
+ </para></step>
+ <step><para>
+ Edit ~/.ssh/config on the initiating system as below:
+ <screen>
+ Host 192.168.42.*
+ ProxyCommand ssh -W %h:%p <replaceable>external_address</replaceable>
+ #suggested optional ssh key declaratons:
+ IdentityFile ~/.ssh/internal_id_rsa
+ Host <replaceable>external_address</replaceable>
+ IdentityFile ~/.ssh/proxy_id_rsa
+
+ </screen>
+ </para></step>
+ <step>
+ <para>
+ Test the configuration from inside and outside the network. Using ssh verbosely will show how the ProxyCommand statement relays your connection.
+ <screen>
+ <command>ssh -vvv 192.168.42.7</command>
+ </screen>
+ </para>
+ </step>
+ </procedure>
+ </section>
+
+ <section>
+ <title>References</title>
+ <itemizedlist>
+ <listitem>
+ <para><citetitle>ssh-config(5)</citetitle> - ssh client configuration manual.</para>
+ </listitem>
+ <listitem>
+ <para><citetitle>firewall-cmd(1)</citetitle> - manual for firewalld command line utility.</para>
+ </listitem>
+ <listitem>
+ <para><xref linkend="ssh-keys" /> - recommended reading on ssh authentication.</para>
+ </listitem>
+ <listitem>
+ <para><ulink url="https://tools.ietf.org/html/rfc1918">RFC1918</ulink> - defines private address spaces.</para>
+ </listitem>
+ </itemizedlist>
+ </section>
+
+</section>
+
+
Repository : http://git.fedorahosted.org/cgit/docs/fedora-cookbook.git
On branch : master
>---------------------------------------------------------------
commit da7fb397c27fb18cfac6ccc396503335630e6f2b
Author: Pete Travis <immanetize(a)fedoraproject.org>
Date: Mon Apr 14 12:57:44 2014 -0600
added a recipe for ssh keys
>---------------------------------------------------------------
en-US/Security/ssh-keygen.xml | 133 +++++++++++++++++++++++++++++++++++++++++
1 files changed, 133 insertions(+), 0 deletions(-)
diff --git a/en-US/Security/ssh-keygen.xml b/en-US/Security/ssh-keygen.xml
new file mode 100644
index 0000000..4435c0a
--- /dev/null
+++ b/en-US/Security/ssh-keygen.xml
@@ -0,0 +1,133 @@
+<?xml version='1.0' encoding='utf-8' ?>
+ <!DOCTYPE section PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+ "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+ <!ENTITY % BOOK_ENTITIES SYSTEM "../Fedora_Cookbook.ent">
+ %BOOK_ENTITIES;
+]>
+<!-- Do not edit above this line -->
+<!--
+ Please provide some information so we can give you credit:
+ name: Pete Travis
+ fas_id: immanetize
+ email: immanetize(a)fedoraproject.org
+-->
+
+<section id="ssh-keygen">
+ <title>Creating SSH Keys</title>
+ <para>
+ Secure Shell, or SSH, is a powerful and popular tool for connecting to Fedora systems over local or global networks. SSH is more secure when used with <literal>keys</literal>. Like a physical key and lock, an ssh public and private key are paired to work only with each other. Using keys can make connecting easier, and systems that use keys can be made more secure by turning off ssh password access.
+ </para>
+ <section id="ssh-keygen-ingredients">
+ <title>Required Ingredients</title>
+ <!-- list packages, services, other recipes etc that are required -->
+ <itemizedlist>
+ <listitem><para>
+ <package>openssh-clients</package> - Package, comes by default on most systems.
+ </para></listitem>
+ <listitem><para>
+ <package>openssh</package> - Package, comes by default on most systems.
+ </para></listitem>
+ <listitem><para>
+ <emphasis>Working Network Connection</emphasis> - Network services need a network!
+ </para></listitem>
+ <listitem><para>
+ <emphasis>Target host</emphasis> - Another computer that you have network and password access to. You will need either an IP address or a domain name for this machine.
+ </para></listitem>
+ </itemizedlist>
+ <note>
+ <title>Local testing</title>
+ <para>
+ To test ssh access against the local machine instead of another on the network, use <systemitem class="domainname">localhost</systemitem> as the target hostname.
+ </para>
+ </note>
+
+ </section>
+ <section id="ssh-keygen-directions">
+ <title>Directions</title>
+ <procedure>
+ <title>Setting up SSH Keys</title>
+ <step><para>
+ Create the key.
+ <screen>
+ <command>ssh-keygen -b 4096 -N "<replaceable>secret</replaceable>" -f <filename class="directory">~/.ssh/<replaceable>target_id_isa</replaceable></filename></command>
+ </screen>
+ </para>
+ <para>
+ If you don't declare any options, <application>ssh-keygen</application> will ask for the required minimum interactively. Read about the example's options below, or find more options in <command>man ssh-keygen</command>.
+ <simplelist>
+ <member>
+ <parameter>-b 4096</parameter> : Generates a 4096-bit key, stronger than the default.
+ </member>
+ <member>
+ <parameter>-n <replaceable>secret</replaceable></parameter> : A passphrase for the key. Optional, but strongly recommended.
+ </member>
+ <member>
+ <parameter>-f <filename class="directory">~/.ssh/<replaceable>target_id_rsa</replaceable></filename></parameter> : The file to create. Call the file anything, but store it in <filename class="directory">~/.ssh/</filename>
+ </member>
+ </simplelist>
+ </para></step>
+ <step>
+ <para>
+ Copy the public key to your target.
+ <screen>
+ <command>
+ ssh-copy-id -i ~/.ssh/<replaceable>target_id_rsa</replaceable>.pub <replaceable>target_ip</replaceable>
+ </command>
+ </screen>
+ </para>
+ <para>
+ The <application>ssh-copy-id</application> utility opens an ssh connection to the target using password authentication and adds the contents of the public key to <filename>~/.ssh/authorized_keys</filename>`. The file can also be shared by other means and appended to <filename>authorized_keys</filename> manually, a method used for systems where password authentication cannot be turned on.
+ <screen>
+ <command>cat target_id_rsa.pub >> ~/.ssh/authorized_keys</command>
+ </screen>
+ </para>
+ </step>
+ <step>
+ <para>
+ Test the key:
+ <screen>
+ <command>
+ ssh -i ~/.ssh/target_id_rsa -o PasswordAuthentication=no <replaceable>target_ip</replaceable>
+ </command>
+ </screen>
+ </para>
+ </step>
+ <step><para>
+ Add an entry in your client ssh configuration for the key. <application>ssh</application> will try all keys in <filename>~/.ssh/</filename> when connecting to any host unless configured otherwise, so configuring it to only use keys that are explicitly paired to a host will reduce rejected authentication attempts and speed connections.
+ </para>
+ <formalpara>
+ <title>Editing <filename>~/.ssh/config</filename></title>
+ <para>
+ <screen>
+ Host *
+ IdentitiesOnly yes
+
+ Host <replaceable>target_ip</replaceable>
+ PasswordAuthentication No
+ IdentityFile ~/.ssh/<replaceable>target_id_rsa</replaceable>
+ </screen>
+ </para>
+ </formalpara></step>
+ </procedure>
+ </section>
+
+ <section>
+ <title>References</title>
+ <itemizedlist>
+ <listitem>
+ <para><citetitle>ssh-keygen(1)</citetitle> - manual for ssh-keygen</para>
+ </listitem>
+ <listitem>
+ <para>
+ <citetitle>ssh-copy-id(1)</citetitle> - manual for ssh-copy-id
+ </para>
+ </listitem>
+ <listitem>
+ <para><citetitle>ssh-config(5)</citetitle> - manual for ssh client configuration files</para>
+ </listitem>
+ </itemizedlist>
+ </section>
+
+</section>
+
+