From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:470:142:3::10]:49195) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1irTdV-0004SV-7B for guix-patches@gnu.org; Tue, 14 Jan 2020 16:22:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1irTdT-0007q4-Ec for guix-patches@gnu.org; Tue, 14 Jan 2020 16:22:05 -0500 Received: from debbugs.gnu.org ([209.51.188.43]:55922) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1irTdS-0007oK-6y for guix-patches@gnu.org; Tue, 14 Jan 2020 16:22:02 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1irTdS-0006xx-2G for guix-patches@gnu.org; Tue, 14 Jan 2020 16:22:02 -0500 Subject: [bug#39136] [PATCH] gnu: services: Add endlessh. Resent-Message-ID: Received: from eggs.gnu.org ([2001:470:142:3::10]:49091) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1irTd1-00044c-VB for guix-patches@gnu.org; Tue, 14 Jan 2020 16:21:37 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1irTd0-0007ZX-7Z for guix-patches@gnu.org; Tue, 14 Jan 2020 16:21:35 -0500 Received: from mail-wm1-x335.google.com ([2a00:1450:4864:20::335]:53302) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1irTcz-0007Yj-VI for guix-patches@gnu.org; Tue, 14 Jan 2020 16:21:34 -0500 Received: by mail-wm1-x335.google.com with SMTP id m24so15504159wmc.3 for ; Tue, 14 Jan 2020 13:21:33 -0800 (PST) Received: from guixSD (host146-19-dynamic.50-79-r.retail.telecomitalia.it. [79.50.19.146]) by smtp.gmail.com with ESMTPSA id n10sm21160533wrt.14.2020.01.14.13.21.30 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jan 2020 13:21:30 -0800 (PST) From: anothersms@gmail.com (=?UTF-8?Q?Nicol=C3=B2?= Balzarotti) Date: Tue, 14 Jan 2020 22:21:29 +0100 Message-ID: <874kwx91k6.fsf@guixSD.i-did-not-set--mail-host-address--so-tickle-me> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+kyle=kyleam.com@gnu.org Sender: "Guix-patches" To: 39136@debbugs.gnu.org --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello guix! This is my first service :) I know I still miss documentation and tests, but before diving into it I wanted a general feedback on it (so that if we decide to change something I don't have to adjust the docs and the tests twice). Endlessh is already in the repo, but for those who don't know: it's a fake ssh server; it should be used to prevent bruteforce attacks and the like by "freezing" the connection on the standard port (while the real ssh server is on another non-standard port). So, I don't know if as default port should be 22 or, as it is now, 2222 (program's default). My second doubt is regarding the place; it's an ssh server, but its main purpose is for security? Maybe should go under admin.scm? I'm not sure Last thing: bind-family as a list of allowed values is a suggetion from IRC @leoprikler. Thanks for your help there! Waiting for your feedback, Nicol=C3=B2 --=-=-= Content-Type: text/x-patch Content-Disposition: attachment; filename=0001-gnu-services-Add-endlessh.patch >From 63f975ec47de8ab951beaac6781327faf06d0cac Mon Sep 17 00:00:00 2001 From: nixo Date: Tue, 14 Jan 2020 22:08:15 +0100 Subject: [PATCH] gnu: services: Add endlessh. * gnu/services/ssh.scm (endlessh): New variable. --- gnu/services/ssh.scm | 74 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 73 insertions(+), 1 deletion(-) diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm index d2dbb8f80d..d2729fb059 100644 --- a/gnu/services/ssh.scm +++ b/gnu/services/ssh.scm @@ -45,7 +45,11 @@ dropbear-configuration dropbear-configuration? dropbear-service-type - dropbear-service)) + dropbear-service + + endlessh-configuration + endlessh-configuration? + endlessh-service-type)) ;;; Commentary: ;;; @@ -628,4 +632,72 @@ daemon} with the given @var{config}, a @code{} object." (service dropbear-service-type config)) + +;;; +;;; Endlessh. +;;; + +(define-record-type* + endlessh-configuration make-endlessh-configuration + endlessh-configuration? + ;; list of two symbols, allowed values are ipv4, ipv6 or both + (bind-family endlessh-configuration-bind-family (default '(ipv4 ipv6))) + ;; integer + (delay endlessh-configuration-delay (default 10000)) + ;; integer + ;; Must be in the range + (length endlessh-configuration-length (default 32)) + ;; integer + (max-clients endlessh-configuration-max-clients (default 4096)) + ;; integer + (port-number endlessh-configuration-port-number (default 2222)) + ;; integer + ;; Allowed values are 0, 1 and 2 + (log-level endlessh-configuration-log-level (default 0))) + +(define (endlessh-config->conf config) + "Convert the CONFIG of type to a config file." + (let* ((family (endlessh-configuration-bind-family config)) + (ipv4 (member 'ipv4 family)) + (ipv6 (member 'ipv6 family)) + (port (endlessh-configuration-port-number config)) + (delay (endlessh-configuration-delay config)) + (length (endlessh-configuration-length config)) + (log-level (endlessh-configuration-log-level config)) + (max-clients (endlessh-configuration-max-clients config)) + (bind + ;; check if both are true (0), or only one of them is present + (if (not (and (equal? ipv4 ipv6) ipv4)) + (if ipv4 4 + (if ipv6 6 + (throw 'endlessh-error + "bind-family must contain at least one value"))) + 0))) + (mixed-text-file "endlessh.conf" + "# Generated by 'endlessh-config'.\n\n" + "Port " (number->string port) "\n" + "Delay " (number->string delay) "\n" + "MaxLineLength " (number->string length) "\n" + "MaxClients " (number->string max-clients) "\n" + "LogLevel " (number->string log-level) "\n" + "BindFamily " (number->string bind) "\n"))) + +(define (endlessh-shepherd-service config) + (shepherd-service + (documentation "Run endlessh tarpit server.") + (provision '(endlessh)) + (start #~(make-forkexec-constructor + (list #$(file-append endlessh "/bin/endlessh") + "-f" #$(endlessh-config->conf config)))) + (stop #~(make-kill-destructor)))) + +(define endlessh-service-type + (service-type + (name 'endlessh) + (description "Run endlessh tarpit server.") + (extensions + (list (service-extension shepherd-root-service-type + (compose list endlessh-shepherd-service)))) + (default-value (endlessh-configuration)))) + ;;; ssh.scm ends here -- 2.24.1 --=-=-=--