m1ngsama/TNT
1
0
Fork 0
mirror of https://github.com/m1ngsama/TNT.git synced 2026-02-08 08:54:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix(security): implement SSH hardening improvements

Browse source 
- Upgrade RSA key size from 2048 to 4096 bits for stronger encryption
- Fix key file permission time window with atomic generation:
  * Use umask(0077) before file creation
  * Generate key to temporary file first
  * Atomically rename to final location
- Add configurable bind address via TNT_BIND_ADDR environment variable
- Add configurable SSH log level via TNT_SSH_LOG_LEVEL (0-4)

These changes address:
- Weak 2048-bit RSA keys
- Permission race condition during key generation
- Hardcoded bind address limiting deployment flexibility
- Inflexible logging configuration

Environment variables:
- TNT_BIND_ADDR: Bind address (default: 0.0.0.0)
- TNT_SSH_LOG_LEVEL: SSH logging verbosity 0-4 (default: 1)
This commit is contained in:
m1ngsama 2026-01-22 13:57:32 +08:00
parent abe477f713
commit 325e524cee
1 changed files with 39 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

47
src/ssh_server.c
View file

@ -32,24 +32,42 @@ static int setup_host_key(ssh_bind sshbind) {
} }
/* Generate new key */ /* Generate new key */
printf("Generating new RSA host key...\n"); printf("Generating new RSA 4096-bit host key...\n");
ssh_key key; ssh_key key;
if (ssh_pki_generate(SSH_KEYTYPE_RSA, 2048, &key) < 0) { if (ssh_pki_generate(SSH_KEYTYPE_RSA, 4096, &key) < 0) {
fprintf(stderr, "Failed to generate RSA key\n"); fprintf(stderr, "Failed to generate RSA key\n");
return -1; return -1;
} }
/* Export key to file */ /* Create temporary file with secure permissions (atomic operation) */
if (ssh_pki_export_privkey_file(key, NULL, NULL, NULL, HOST_KEY_FILE) < 0) { char temp_key_file[256];
snprintf(temp_key_file, sizeof(temp_key_file), "%s.tmp.%d", HOST_KEY_FILE, getpid());
/* Set umask to ensure restrictive permissions before file creation */
mode_t old_umask = umask(0077);
/* Export key to temporary file */
if (ssh_pki_export_privkey_file(key, NULL, NULL, NULL, temp_key_file) < 0) {
fprintf(stderr, "Failed to export host key\n"); fprintf(stderr, "Failed to export host key\n");
ssh_key_free(key); ssh_key_free(key);
umask(old_umask);
return -1; return -1;
} }
ssh_key_free(key); ssh_key_free(key);
/* Set restrictive permissions */ /* Restore original umask */
chmod(HOST_KEY_FILE, 0600); umask(old_umask);
/* Ensure restrictive permissions */
chmod(temp_key_file, 0600);
/* Atomically replace the old key file (if any) */
if (rename(temp_key_file, HOST_KEY_FILE) < 0) {
fprintf(stderr, "Failed to rename temporary key file\n");
unlink(temp_key_file);
return -1;
}
/* Load the newly created key */ /* Load the newly created key */
if (ssh_bind_options_set(sshbind, SSH_BIND_OPTIONS_RSAKEY, HOST_KEY_FILE) < 0) { if (ssh_bind_options_set(sshbind, SSH_BIND_OPTIONS_RSAKEY, HOST_KEY_FILE) < 0) {
@ -647,10 +665,23 @@ int ssh_server_init(int port) {
/* Bind to port */ /* Bind to port */
ssh_bind_options_set(g_sshbind, SSH_BIND_OPTIONS_BINDPORT, &port); ssh_bind_options_set(g_sshbind, SSH_BIND_OPTIONS_BINDPORT, &port);
ssh_bind_options_set(g_sshbind, SSH_BIND_OPTIONS_BINDADDR, "0.0.0.0");
/* Set verbose level for debugging */ /* Configurable bind address (default: 0.0.0.0) */
const char *bind_addr = getenv("TNT_BIND_ADDR");
if (!bind_addr) {
bind_addr = "0.0.0.0";
}
ssh_bind_options_set(g_sshbind, SSH_BIND_OPTIONS_BINDADDR, bind_addr);
/* Configurable SSH log level (default: SSH_LOG_WARNING=1) */
int verbosity = SSH_LOG_WARNING; int verbosity = SSH_LOG_WARNING;
const char *log_level_env = getenv("TNT_SSH_LOG_LEVEL");
if (log_level_env) {
int level = atoi(log_level_env);
if (level >= 0 && level <= 4) {
verbosity = level;
}
}
ssh_bind_options_set(g_sshbind, SSH_BIND_OPTIONS_LOG_VERBOSITY, &verbosity); ssh_bind_options_set(g_sshbind, SSH_BIND_OPTIONS_LOG_VERBOSITY, &verbosity);
if (ssh_bind_listen(g_sshbind) < 0) { if (ssh_bind_listen(g_sshbind) < 0) {