diff options
| -rw-r--r-- | assets/wireguard-config/README.org | 26 | ||||
| -rw-r--r-- | todo.org | 14 |
2 files changed, 23 insertions, 17 deletions
diff --git a/assets/wireguard-config/README.org b/assets/wireguard-config/README.org index 3bcf327..4329ec7 100644 --- a/assets/wireguard-config/README.org +++ b/assets/wireguard-config/README.org @@ -1,19 +1,17 @@ -#+TITLE: WireGuard configs — encrypted only +#+TITLE: WireGuard configs — not tracked #+AUTHOR: Craig Jennings -This directory holds WireGuard VPN configs for the installer's -=import-wireguard-configs.sh=. +This directory backs the installer's =import-wireguard-configs.sh=. -*This repo is public* (cgit at git.cjennings.net serves it over -unauthenticated HTTPS). Plaintext =*.conf= files carry live Proton -=PrivateKey= material and MUST NOT be committed — they are gitignored here. +*This repo is public* (cgit at git.cjennings.net serves it over unauthenticated +https). Plaintext =*.conf= files carry live Proton =PrivateKey= material and are +gitignored here — never commit them. -Workflow: -- Store configs gpg-encrypted only: =gpg -e --default-recipient-self wg-XX.conf= - produces =wg-XX.conf.gpg=, safe to track in a public repo. -- The installer decrypts =*.conf.gpg= to a private temp dir at import time, - imports, then wipes the plaintext. (Re-architecture tracked in todo.org.) +Configs are supplied out-of-band: drop the plaintext =*.conf= into this +directory locally at install time (they stay gitignored), or fetch them from a +private store. Nothing here is tracked except this note and the .gitignore. -History note: three plaintext configs were committed 2026-07-05 (c7b7d16) and -were publicly exposed until 2026-07-20, when the keys were rotated at Proton -and the files were purged from history. +History: ten plaintext configs were committed and publicly exposed from +2026-07-05 to 2026-07-20. The keys were expired at Proton and every config was +purged from git history (filter-repo + server gc). See the closed WireGuard +security task in todo.org. @@ -48,9 +48,17 @@ below): ** TODO [#B] Installer GRUB_CMDLINE overwrite drops boot params :bug:solo: Grading: Critical severity (unbootable) x some-users-sometimes (machines whose base install set a cryptdevice=/resume=/zfs= cmdline param) = P2 = [#B]. archsetup:3054 rewrites the whole GRUB_CMDLINE_LINUX_DEFAULT line with a fixed string; nothing re-adds a pre-existing cryptdevice/resume/zfs token, so grub-mkconfig (3059) can bake an unbootable config. Fix: read the current value and append only the missing tokens; assert any pre-existing boot-critical token survives before grub-mkconfig. See [[file:docs/design/2026-07-19-sentry-code-findings.org][sentry code findings]] (S3). -** TODO [#B] Tracked WireGuard private keys in repo :bug:security:network: -Grading: security carve-out (graded on severity alone) — live Proton VPN private keys committed to git. Private remote (git@cjennings.net) mitigates immediate exposure, but archsetup is a code project and a server-side mirror hook could republish; keys are live = P2 = [#B]. Bump to [#A]+date to act now. -assets/wireguard-config/wg-NL-781.conf, wg-US-CA-144.conf, wg-US-TX-714.conf each hold an [Interface] PrivateKey (added c7b7d16, 2026-07-05), not gitignored. Decision: if not meant to be tracked, rotate the three Proton keys, git rm + gitignore assets/wireguard-config/, scrub history (filter-repo/BFG), force-push. If intentional, confirm no mirror hook and record the decision in notes.org so audits stop flagging it. Not :solo: — needs Craig's call. +** DONE [#A] Tracked WireGuard private keys in repo — public leak, resolved :bug:security:network: +CLOSED: [2026-07-20 Mon] +Confirmed a live public leak, not just at-risk: git.cjennings.net runs cgit (scan-path=/var/git), so archsetup.git was anonymously cloneable over https. An unauthenticated clone pulled the configs with intact PrivateKeys. Exposed 2026-07-05 (c7b7d16) to 2026-07-20. Regraded to P1/[#A] (public credential exposure, severity-alone carve-out) from the initial [#B]. +Scope was wider than first found: the current 3 configs (assets/wireguard-config/wg-*.conf) plus 7 older ones at the pre-reorg path assets/wireguard/ (switzerland x2, USCALA/USCASF/USDC/USGAAT/USNY) — 10 config files, all with real keys. +Resolution: Craig expired all the Proton WireGuard configs (keys dead). Purged all 10 from every commit with git filter-repo, force-pushed main + v0.5, and ran git gc --prune=now on the server bare repo. Verified via anonymous clone: zero real-key blobs reachable, all old exposed commits gone. Stopped tracking plaintext (gitignore + README, out-of-band configs only). +Follow-ups filed below: harden cgit exposure; installer no longer ships configs. +** TODO [#B] Audit cgit-published repos for secrets and privacy :bug:security: +Grading: security carve-out — cgit at git.cjennings.net serves every repo under scan-path=/var/git over unauthenticated https (any repo is anonymously cloneable). archsetup being public is by design (curl-install), but this means ANY secret in ANY /var/git repo is world-readable, and any repo meant to be private is not. Severity depends on what else lives there = P2 = [#B], raise if a private repo with secrets is found. +Not :solo: — needs Craig's decisions. Steps: list repos under /var/git; for each, decide intended public vs private; scan each for secrets (keys, tokens, credentials) the way this WireGuard leak was found; for any meant-to-be-private repo, actually restrict access (cgit repo.hide only hides from the index — a known repo name is still cloneable; use http auth or move it off the public scan-path); for public repos, confirm no secrets and add a pre-receive/CI secret scan. Check dotfiles (git.cjennings.net/dotfiles) specifically — it is also under /var/git. +** TODO [#C] WireGuard import is now config-less — decide feature fate :feature:network: +scripts/import-wireguard-configs.sh reads assets/wireguard-config/*.conf, but no configs ship in the repo anymore (removed as a public-leak fix; .gitignore blocks plaintext). Decide: remove the import feature entirely, or keep it and document dropping plaintext configs into the dir out-of-band at install time (they stay gitignored). If kept, confirm the script no-ops gracefully when the dir has no *.conf. ** TODO [#C] Installer chpasswd unguarded — unloggable primary user :bug:solo:quick: Grading: Major severity (fresh system's primary user can't log in) x rare edge case (chpasswd seldom fails) = P3 = [#C]. archsetup:1168 runs =echo "$user:$pass" | chpasswd= with no guard, then unsets the password next line; set -e is off (line 21), so a silent failure leaves no password and no log entry. Fix: guard with error_fatal (report + "set it by hand: passwd $user") before unsetting. See findings doc (S2). |