From patchwork Tue Jan 14 21:21:29 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Nicol=C3=B2_Balzarotti?= X-Patchwork-Id: 19822 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id AAA1017AA1; Tue, 14 Jan 2020 21:31:23 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM, T_DKIM_INVALID autolearn=unavailable autolearn_force=no version=3.4.0 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTP id 8B00C17A9F for ; Tue, 14 Jan 2020 21:31:19 +0000 (GMT) Received: from localhost ([::1]:46248 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1irTmR-000870-2P for patchwork@mira.cbaines.net; Tue, 14 Jan 2020 16:31:19 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:49195) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1irTdV-0004SV-7B for guix-patches@gnu.org; Tue, 14 Jan 2020 16:22:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1irTdT-0007q4-Ec for guix-patches@gnu.org; Tue, 14 Jan 2020 16:22:05 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:55922) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1irTdS-0007oK-6y for guix-patches@gnu.org; Tue, 14 Jan 2020 16:22:02 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1irTdS-0006xx-2G for guix-patches@gnu.org; Tue, 14 Jan 2020 16:22:02 -0500 X-Loop: help-debbugs@gnu.org Subject: [bug#39136] [PATCH] gnu: services: Add endlessh. Resent-From: anothersms@gmail.com (=?utf-8?q?Nicol=C3=B2?= Balzarotti) Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Tue, 14 Jan 2020 21:22:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 39136 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 39136@debbugs.gnu.org X-Debbugs-Original-To: guix-patches@gnu.org Received: via spool by submit@debbugs.gnu.org id=B.157903690026737 (code B ref -1); Tue, 14 Jan 2020 21:22:01 +0000 Received: (at submit) by debbugs.gnu.org; 14 Jan 2020 21:21:40 +0000 Received: from localhost ([127.0.0.1]:33654 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1irTd5-0006x8-GQ for submit@debbugs.gnu.org; Tue, 14 Jan 2020 16:21:40 -0500 Received: from lists.gnu.org ([209.51.188.17]:48207) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1irTd3-0006x1-GU for submit@debbugs.gnu.org; Tue, 14 Jan 2020 16:21:38 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:49091) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1irTd1-00044c-VB for guix-patches@gnu.org; Tue, 14 Jan 2020 16:21:37 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1irTd0-0007ZX-7Z for guix-patches@gnu.org; Tue, 14 Jan 2020 16:21:35 -0500 Received: from mail-wm1-x335.google.com ([2a00:1450:4864:20::335]:53302) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1irTcz-0007Yj-VI for guix-patches@gnu.org; Tue, 14 Jan 2020 16:21:34 -0500 Received: by mail-wm1-x335.google.com with SMTP id m24so15504159wmc.3 for ; Tue, 14 Jan 2020 13:21:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:mime-version; bh=YAe21svaacBEdVgUt5LGPvtbT+z75Cr4foKr7hHvhzg=; b=Eri6ghqtxz1c3IJDokMM5HQz8eIvytLfYgMLoO1l0Xxuche1EvSQ6km/tXgjdn68+n dieK0MjdUQgpXlP0+SUkzU1bmFbnS1rdR2vMuq3frQ/wKVDplVs68KBn+ZJOp9z98+1s yK9lUef94Prg4eJei4DHwFxQeeB3GdSo0SRL9nMgmOxq5eQoxO8LYvUqggYPYOeKtK4J sB18daB2O8xHzi1LU55bmR045YxILtP2TNtZaZRKJ/9Bdij9/XJQkLQGWFiCSfwN3CIl 1humQLGu5oxnIFbPI1MbSM6IlHO6ybAFZxoQBYG2HmVLldrYGnM5dlnvTgfBwqCEsCgB p/JQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:mime-version; bh=YAe21svaacBEdVgUt5LGPvtbT+z75Cr4foKr7hHvhzg=; b=I1FZTc/9mkK9eG0+U5qW2QakZRbnb352ksaupZD0rx5cRPxHmnDvx3vK8KeoAzItyx Ix8gKaJHD0SjLlwAs73TYfuX5s3JCjqge3z4bqykxuP8p3Zoy2SwBQ1Zo0+MbNFuf/+i LHZ6WfrBbew5U4b2H72nX3GJkEk5ZVvHYaASay4EG6jOquq6kTx060QLlj+Sy/VQ6PbD rFF93lDEv0cQJYI51yzlLw6Z8Mr0t7ZAClDBAydZSdBnk/5ahE+ecSAlC6tOXcx8N9US G55Y8LSFdHlSoXnQwRpiNSYnieCavRERR3/dnzGryB16xVB95l3/JTmTgYR3ZkaUk85K HqkQ== X-Gm-Message-State: APjAAAVPIE4AxYWmtONB9Vedm8IZtWtqoaLGLBydJ7U8lsj1IxJduTbc PFe1u14XLBGFiaAAecKfInaeRcc4 X-Google-Smtp-Source: APXvYqywVcVDmddYzLVeEd+Ceux2ffMJB+Z0L43Jx7MYr1CoTcaKEmIdP7wc1snXzxB5P2WeWmgxAw== X-Received: by 2002:a1c:740b:: with SMTP id p11mr31139307wmc.78.1579036891695; Tue, 14 Jan 2020 13:21:31 -0800 (PST) Received: from guixSD (host146-19-dynamic.50-79-r.retail.telecomitalia.it. [79.50.19.146]) by smtp.gmail.com with ESMTPSA id n10sm21160533wrt.14.2020.01.14.13.21.30 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jan 2020 13:21:30 -0800 (PST) From: anothersms@gmail.com (=?utf-8?q?Nicol=C3=B2?= Balzarotti) Date: Tue, 14 Jan 2020 22:21:29 +0100 Message-ID: <874kwx91k6.fsf@guixSD.i-did-not-set--mail-host-address--so-tickle-me> MIME-Version: 1.0 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.51.188.43 X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: "Guix-patches" X-getmail-retrieved-from-mailbox: Patches Hello guix! This is my first service :) I know I still miss documentation and tests, but before diving into it I wanted a general feedback on it (so that if we decide to change something I don't have to adjust the docs and the tests twice). Endlessh is already in the repo, but for those who don't know: it's a fake ssh server; it should be used to prevent bruteforce attacks and the like by "freezing" the connection on the standard port (while the real ssh server is on another non-standard port). So, I don't know if as default port should be 22 or, as it is now, 2222 (program's default). My second doubt is regarding the place; it's an ssh server, but its main purpose is for security? Maybe should go under admin.scm? I'm not sure Last thing: bind-family as a list of allowed values is a suggetion from IRC @leoprikler. Thanks for your help there! Waiting for your feedback, Nicolò From 63f975ec47de8ab951beaac6781327faf06d0cac Mon Sep 17 00:00:00 2001 From: nixo Date: Tue, 14 Jan 2020 22:08:15 +0100 Subject: [PATCH] gnu: services: Add endlessh. * gnu/services/ssh.scm (endlessh): New variable. --- gnu/services/ssh.scm | 74 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 73 insertions(+), 1 deletion(-) diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm index d2dbb8f80d..d2729fb059 100644 --- a/gnu/services/ssh.scm +++ b/gnu/services/ssh.scm @@ -45,7 +45,11 @@ dropbear-configuration dropbear-configuration? dropbear-service-type - dropbear-service)) + dropbear-service + + endlessh-configuration + endlessh-configuration? + endlessh-service-type)) ;;; Commentary: ;;; @@ -628,4 +632,72 @@ daemon} with the given @var{config}, a @code{} object." (service dropbear-service-type config)) + +;;; +;;; Endlessh. +;;; + +(define-record-type* + endlessh-configuration make-endlessh-configuration + endlessh-configuration? + ;; list of two symbols, allowed values are ipv4, ipv6 or both + (bind-family endlessh-configuration-bind-family (default '(ipv4 ipv6))) + ;; integer + (delay endlessh-configuration-delay (default 10000)) + ;; integer + ;; Must be in the range + (length endlessh-configuration-length (default 32)) + ;; integer + (max-clients endlessh-configuration-max-clients (default 4096)) + ;; integer + (port-number endlessh-configuration-port-number (default 2222)) + ;; integer + ;; Allowed values are 0, 1 and 2 + (log-level endlessh-configuration-log-level (default 0))) + +(define (endlessh-config->conf config) + "Convert the CONFIG of type to a config file." + (let* ((family (endlessh-configuration-bind-family config)) + (ipv4 (member 'ipv4 family)) + (ipv6 (member 'ipv6 family)) + (port (endlessh-configuration-port-number config)) + (delay (endlessh-configuration-delay config)) + (length (endlessh-configuration-length config)) + (log-level (endlessh-configuration-log-level config)) + (max-clients (endlessh-configuration-max-clients config)) + (bind + ;; check if both are true (0), or only one of them is present + (if (not (and (equal? ipv4 ipv6) ipv4)) + (if ipv4 4 + (if ipv6 6 + (throw 'endlessh-error + "bind-family must contain at least one value"))) + 0))) + (mixed-text-file "endlessh.conf" + "# Generated by 'endlessh-config'.\n\n" + "Port " (number->string port) "\n" + "Delay " (number->string delay) "\n" + "MaxLineLength " (number->string length) "\n" + "MaxClients " (number->string max-clients) "\n" + "LogLevel " (number->string log-level) "\n" + "BindFamily " (number->string bind) "\n"))) + +(define (endlessh-shepherd-service config) + (shepherd-service + (documentation "Run endlessh tarpit server.") + (provision '(endlessh)) + (start #~(make-forkexec-constructor + (list #$(file-append endlessh "/bin/endlessh") + "-f" #$(endlessh-config->conf config)))) + (stop #~(make-kill-destructor)))) + +(define endlessh-service-type + (service-type + (name 'endlessh) + (description "Run endlessh tarpit server.") + (extensions + (list (service-extension shepherd-root-service-type + (compose list endlessh-shepherd-service)))) + (default-value (endlessh-configuration)))) + ;;; ssh.scm ends here -- 2.24.1