Unverified Commit f5802f49 authored by Sandro Jäckel's avatar Sandro Jäckel Committed by GitHub
Browse files

Merge pull request #187026 from azahi/endlessh-go

parents ead59cfc 99dc9b9c

nixos/doc/manual/from_md/release-notes/rl-2211.section.xml

+7 −0
Original line number Diff line number Diff line
@@ -268,6 +268,13 @@ 
          <link linkend="opt-services.alps.enable">services.alps</link>.

        </para>

      </listitem>

      <listitem>

        <para>

          <link xlink:href="https://github.com/shizunge/endlessh-go">endlessh-go</link>,

          an SSH tarpit that exposes Prometheus metrics. Available as

          <link linkend="opt-services.endlessh-go.enable">services.endlessh-go</link>.

        </para>

      </listitem>

      <listitem>

        <para>

          <link xlink:href="https://netbird.io">netbird</link>, a zero

nixos/doc/manual/release-notes/rl-2211.section.md

+2 −0
Original line number Diff line number Diff line
@@ -95,6 +95,8 @@ In addition to numerous new and upgraded packages, this release has the followin 


- [alps](https://git.sr.ht/~migadu/alps), a simple and extensible webmail. Available as [services.alps](#opt-services.alps.enable).



- [endlessh-go](https://github.com/shizunge/endlessh-go), an SSH tarpit that exposes Prometheus metrics. Available as [services.endlessh-go](#opt-services.endlessh-go.enable).



- [netbird](https://netbird.io), a zero configuration VPN.

  Available as [services.netbird](options.html#opt-services.netbird.enable).

nixos/modules/module-list.nix

+1 −0
Original line number Diff line number Diff line
@@ -1004,6 +1004,7 @@ 
  ./services/security/certmgr.nix

  ./services/security/cfssl.nix

  ./services/security/clamav.nix

  ./services/security/endlessh-go.nix

  ./services/security/fail2ban.nix

  ./services/security/fprintd.nix

  ./services/security/haka.nix

nixos/modules/services/security/endlessh-go.nix

0 → 100644
+138 −0
Original line number Diff line number Diff line 
{ config, lib, pkgs, ... }:



with lib;



let

  cfg = config.services.endlessh-go;

in

{

  options.services.endlessh-go = {

    enable = mkEnableOption (mdDoc "endlessh-go service");



    listenAddress = mkOption {

      type = types.str;

      default = "0.0.0.0";

      example = "[::]";

      description = mdDoc ''

        Interface address to bind the endlessh-go daemon to SSH connections.

      '';

    };



    port = mkOption {

      type = types.port;

      default = 2222;

      example = 22;

      description = mdDoc ''

        Specifies on which port the endlessh-go daemon listens for SSH

        connections.



        Setting this to `22` may conflict with {option}`services.openssh`.

      '';

    };



    prometheus = {

      enable = mkEnableOption (mdDoc "Prometheus integration");



      listenAddress = mkOption {

        type = types.str;

        default = "0.0.0.0";

        example = "[::]";

        description = mdDoc ''

          Interface address to bind the endlessh-go daemon to answer Prometheus

          queries.

        '';

      };



      port = mkOption {

        type = types.port;

        default = 2112;

        example = 9119;

        description = mdDoc ''

          Specifies on which port the endlessh-go daemon listens for Prometheus

          queries.

        '';

      };

    };



    extraOptions = mkOption {

      type = with types; listOf str;

      default = [ ];

      example = [ "-conn_type=tcp4" "-max_clients=8192" ];

      description = mdDoc ''

        Additional command line options to pass to the endlessh-go daemon.

      '';

    };



    openFirewall = mkOption {

      type = types.bool;

      default = false;

      description = lib.mdDoc ''

        Whether to open a firewall port for the SSH listener.

      '';

    };

  };



  config = mkIf cfg.enable {

    systemd.services.endlessh-go = {

      description = "SSH tarpit";

      requires = [ "network.target" ];

      wantedBy = [ "multi-user.target" ];

      serviceConfig =

        let

          needsPrivileges = cfg.port < 1024 || cfg.prometheus.port < 1024;

          capabilities = [ "" ] ++ optionals needsPrivileges [ "CAP_NET_BIND_SERVICE" ];

          rootDirectory = "/run/endlessh-go";

        in

        {

          Restart = "always";

          ExecStart = with cfg; concatStringsSep " " ([

            "${pkgs.endlessh-go}/bin/endlessh-go"

            "-logtostderr"

            "-host=${listenAddress}"

            "-port=${toString port}"

          ] ++ optionals prometheus.enable [

            "-enable_prometheus"

            "-prometheus_host=${prometheus.listenAddress}"

            "-prometheus_port=${toString prometheus.port}"

          ] ++ extraOptions);

          DynamicUser = true;

          RootDirectory = rootDirectory;

          BindReadOnlyPaths = [ builtins.storeDir ];

          InaccessiblePaths = [ "-+${rootDirectory}" ];

          RuntimeDirectory = baseNameOf rootDirectory;

          RuntimeDirectoryMode = "700";

          AmbientCapabilities = capabilities;

          CapabilityBoundingSet = capabilities;

          UMask = "0077";

          LockPersonality = true;

          MemoryDenyWriteExecute = true;

          NoNewPrivileges = true;

          PrivateDevices = true;

          PrivateTmp = true;

          PrivateUsers = !needsPrivileges;

          ProtectClock = true;

          ProtectControlGroups = true;

          ProtectHome = true;

          ProtectHostname = true;

          ProtectKernelLogs = true;

          ProtectKernelModules = true;

          ProtectKernelTunables = true;

          ProtectSystem = "strict";

          ProtectProc = "noaccess";

          ProcSubset = "pid";

          RemoveIPC = true;

          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];

          RestrictNamespaces = true;

          RestrictRealtime = true;

          RestrictSUIDSGID = true;

          SystemCallArchitectures = "native";

          SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];

        };

    };



    networking.firewall.allowedTCPPorts = with cfg;

      optionals openFirewall [ port prometheus.port ];

  };



  meta.maintainers = with maintainers; [ azahi ];

}

nixos/tests/all-tests.nix

+1 −0
Original line number Diff line number Diff line
@@ -180,6 +180,7 @@ in { 
  ejabberd = handleTest ./xmpp/ejabberd.nix {};

  elk = handleTestOn ["x86_64-linux"] ./elk.nix {};

  emacs-daemon = handleTest ./emacs-daemon.nix {};

  endlessh-go = handleTest ./endlessh-go.nix {};

  engelsystem = handleTest ./engelsystem.nix {};

  enlightenment = handleTest ./enlightenment.nix {};

  env = handleTest ./env.nix {};