Hardening of remote maintenance via SSH

[knuton]

This limits SSH connections for remote maintenance to come via the known ZeroTier network's interface, and disables unnecessary forwarding options.

Checklist

• Changelog updated
• Code documented
• User manual updated

[knuton]

The test for the pinned interface name is flaky, need to check.

[knuton]

I think I managed to fix the tests in a good way, waiting for the network device to show up, but succeeding as soon as it does.

Like this we can use a general enough wait without making the test unnecessarily slow.

You can see in test output that it just takes a while for ZeroTier to fully start up after the service is started:

defaultConnectionSetting # [  166.076615] systemd[1]: Starting ZeroTierOne...
defaultConnectionSetting # [  166.403892] systemd[1]: Started ZeroTierOne.
defaultConnectionSetting: waiting for unit zerotierone.service
(finished: waiting for unit zerotierone.service, in 0.95 seconds)
defaultConnectionSetting: waiting for success: ls /var/lib/zerotier-one/
(finished: waiting for success: ls /var/lib/zerotier-one/, in 0.55 seconds)
defaultConnectionSetting: waiting for success: ip link show ztmntnc
defaultConnectionSetting # Device "ztmntnc" does not exist.
defaultConnectionSetting # Device "ztmntnc" does not exist.
defaultConnectionSetting # [  171.176612] zerotier-one[1404]: Starting Control Plane...
defaultConnectionSetting # [  171.183320] zerotier-one[1404]: Starting V6 Control Plane...
defaultConnectionSetting # [  171.977349] (udev-worker)[1453]: Network interface NamePolicy= disabled on kernel command line.
(finished: waiting for success: ip link show ztmntnc, in 4.08 seconds)

On the Action runners this takes much longer than when I run the test locally on my machine. With wait_until_succeeds we should be fine.

[guyonvarch]

Looking good, just wondering if you’ve tested the functionality in a real scenario?

[knuton]

Tests on an actual installation:

• I can SSH into a machine through the local network IP when running the OS from 3405346
• I can not SSH into a machine through the local network IP when running the OS from this branch
• I can SSH into a machine through the ZeroTier IP when running the OS from this branch
• I can forward ports (Chromium DevTools) when running the OS from this branch