Stage 6: server image with a console installer (0.4.0)
- server/ profile and build-iso.sh [desktop|server]; make iso-server, make qemu-server, run-qemu.sh --serial; login on tty and ttyS0 - das-server: SSH, chrony, NetworkManager/dhcpcd, Docker with Compose, nftables (closed except SSH, own table), fail2ban reading socklog, sshd without root passwords, Docker log rotation, tools - das-server-install: dialog installer in Ukrainian and English, or unattended with --config; GPT + Btrfs subvolumes, GRUB for UEFI and BIOS, serial console, SSH key with optional keys-only logins - das-install-common: mount-source and postinstall shared with Calamares - dsv: runit service manager (list, enable, disable, start, stop, restart, status, logs) with bash completion, also on the desktop - das-update split into a subpackage without GTK; the window and tray icon move to /usr/libexec/das/das-update-gui - das-snapper-setup enables dbus, which snapper needs - TODO: ISO size review with measured numbers and options Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
@@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2026 Das
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
@@ -0,0 +1,3 @@
|
||||
{
|
||||
"log-driver": "local"
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
# Das OS: ban addresses that keep failing SSH logins, through nftables.
|
||||
[DEFAULT]
|
||||
banaction = nftables-multiport
|
||||
banaction_allports = nftables-allports
|
||||
|
||||
[sshd]
|
||||
enabled = true
|
||||
backend = polling
|
||||
# socklog-void collects auth messages here. svlogd starts each line with a
|
||||
# UTC time stamp; the pattern also consumes the facility and the syslog date
|
||||
# that follow it, so the sshd filter sees "sshd-session[pid]: ...":
|
||||
# 2026-10-19T17:25:46.09500 auth.info: Oct 19 20:25:46 sshd-session[1154]: Invalid user ...
|
||||
logpath = /var/log/socklog/secure/current
|
||||
datepattern = ^%%Y-%%m-%%dT%%H:%%M:%%S\.%%f(?: \S+: \S+ +\d+ \S+)?
|
||||
logtimezone = UTC
|
||||
@@ -0,0 +1,31 @@
|
||||
#!/usr/sbin/nft -f
|
||||
# Das OS server firewall: incoming connections are closed except SSH.
|
||||
#
|
||||
# Only the "das" table is replaced, so loading this file again
|
||||
# (dsv restart nftables) keeps the rules of Docker and fail2ban.
|
||||
# Ports that Docker containers publish (-p 8080:80) pass through Docker's
|
||||
# own forwarding rules, not the input chain below.
|
||||
|
||||
table inet das
|
||||
delete table inet das
|
||||
|
||||
table inet das {
|
||||
chain input {
|
||||
type filter hook input priority filter; policy drop;
|
||||
|
||||
ct state established,related accept
|
||||
ct state invalid drop
|
||||
iif lo accept
|
||||
meta l4proto { icmp, ipv6-icmp } accept
|
||||
# DHCPv6 answers come from the router's link-local address
|
||||
ip6 saddr fe80::/10 udp dport dhcpv6-client accept
|
||||
# Containers may reach services on the host (DNS, a database...)
|
||||
iifname "docker0" accept
|
||||
iifname "br-*" accept
|
||||
|
||||
tcp dport ssh accept
|
||||
|
||||
# Open more ports here, then: dsv restart nftables
|
||||
# tcp dport { http, https } accept
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,4 @@
|
||||
# Das OS server defaults, see sshd_config(5). sshd keeps the first value it
|
||||
# reads, so a file sorted before this one (40-local.conf) overrides it.
|
||||
PermitRootLogin prohibit-password
|
||||
X11Forwarding no
|
||||
@@ -0,0 +1,24 @@
|
||||
# Template file for 'das-server'
|
||||
pkgname=das-server
|
||||
version=0.1.0
|
||||
revision=1
|
||||
depends="openssh chrony dhcpcd NetworkManager docker docker-compose nftables
|
||||
fail2ban socklog-void python3 curl lazydocker lazygit mc tmux htop
|
||||
das-snapshots das-update dsv"
|
||||
short_desc="Das OS server: packages and secure defaults for SSH, firewall and Docker"
|
||||
maintainer="Das <anry.das@gmail.com>"
|
||||
license="MIT"
|
||||
homepage="https://git.das.org.ua/das/Das-OS"
|
||||
conf_files="
|
||||
/etc/nftables.conf
|
||||
/etc/fail2ban/jail.d/das.conf
|
||||
/etc/ssh/sshd_config.d/50-das.conf
|
||||
/etc/docker/daemon.json"
|
||||
|
||||
do_install() {
|
||||
vinstall ${FILESDIR}/nftables.conf 644 etc
|
||||
vinstall ${FILESDIR}/fail2ban-das.conf 644 etc/fail2ban/jail.d das.conf
|
||||
vinstall ${FILESDIR}/sshd-das.conf 644 etc/ssh/sshd_config.d 50-das.conf
|
||||
vinstall ${FILESDIR}/docker-daemon.json 644 etc/docker daemon.json
|
||||
vlicense ${FILESDIR}/LICENSE
|
||||
}
|
||||
Reference in New Issue
Block a user