Sunil Mohan Adapa 21c8a8945f

ssh: Restrict logins to groups root, admin and freedombox-ssh ...

Tests:

- Remove restricted console logins. Try to login via SSH with non-admin and note
that it fails. sudo into the user succeeds.

- Add a user to freedombox-ssh group from Users & Groups app. Login with SSH
succeeds.

- Login with admin user succeeds with and without adding to freedombox-ssh
group.

- On a fresh install, non-admin users are not restricted.

- On an upgrade from a version with the patch, non-admin users are restricted.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>

2022-12-05 20:47:08 -05:00

..

apache

apache: Fix logs still going into /var/log files

2022-10-09 08:53:46 -04:00

api

*: Add setup method on all apps that don't have it

2022-08-15 10:36:19 -04:00

avahi

*: Use privileged decorator for service actions

2022-10-08 18:53:55 -04:00

backups

backups: Use privileged decorator for backup actions

2022-10-08 18:53:57 -04:00

bepasty

bepasty: Use privileged decorator for actions

2022-10-08 18:51:18 -04:00

bind

bind: Drop enabling DNSSEC (deprecated) as it is always enabled

2022-10-08 18:54:08 -04:00

calibre

calibre: Add protection to local service using firewall

2022-12-05 20:46:52 -05:00

cockpit

*: Drop module level app property

2022-08-15 10:36:29 -04:00

config

config: Drop legacy migration of Apache homepage settings

2022-10-08 18:54:10 -04:00

coturn

coturn: Use privileged decorator for actions

2022-10-08 18:51:42 -04:00

datetime

datetime: Use privileged decorator for actions

2022-10-08 18:51:45 -04:00

deluge

deluge: Add protection to local service using firewall

2022-12-05 20:46:54 -05:00

diagnostics

diagnostics: Use AppView for app page

2022-08-29 08:29:00 -04:00

dynamicdns

dynamicdns: Use privileged decorator for actions

2022-10-08 18:51:51 -04:00

ejabberd

ejabberd: Enable mod_http_upload

2022-12-04 10:56:30 -08:00

email

email: Add protection to local service using firewall

2022-12-05 20:47:06 -05:00

firewall

firewall: Introduce component for local service protection

2022-12-05 20:46:49 -05:00

first_boot

first_boot: tests: functional: Find form more specifically

2022-09-03 17:28:52 -04:00

gitweb

gitweb: Use privileged decorator for actions

2022-10-08 18:52:02 -04:00

help

help: Use privileged decorator for actions

2022-10-08 18:52:05 -04:00

i2p

i2p: Add protection to local service using firewall

2022-12-05 20:47:04 -05:00

ikiwiki

ikiwiki: Use privileged decorator for actions

2022-10-08 18:52:11 -04:00

infinoted

infinoted: Use privileged decorator for actions

2022-10-08 18:52:14 -04:00

janus

janus: Allow AF_UNIX and AF_NETLINK

2022-09-23 08:01:57 -04:00

jsxc

jsxc: Allow disabling the app

2022-08-29 21:06:54 -04:00

letsencrypt

letsencrypt: Fix regression with comparing certificate

2022-10-24 20:11:17 -04:00

matrixsynapse

matrix: Add fail2ban jail

2022-10-10 10:08:06 -07:00

mediawiki

mediawiki: Use privileged decorator for actions

2022-10-08 18:52:23 -04:00

minetest

minetest: Handle upgrade from 5.3.0 to 5.6.1

2022-11-04 16:38:01 -07:00

minidlna

minidlna: Add protection to local service using firewall

2022-12-05 20:47:01 -05:00

mumble

*: Drop module level app property

2022-08-15 10:36:29 -04:00

names

names: Use AppView for app page

2022-08-29 08:29:03 -04:00

networks

networks: Use privileged decorator for actions

2022-10-08 18:52:35 -04:00

openvpn

openvpn: Drop RSA to ECC migration code and two-step setup

2022-10-08 18:52:41 -04:00

pagekite

*: Use privileged decorator for service actions

2022-10-08 18:53:55 -04:00

performance

*: Drop module level app property

2022-08-15 10:36:29 -04:00

power

*: Use privileged decorator for package actions

2022-10-08 18:54:00 -04:00

privacy

privacy: Remove unused import, fix pipline

2022-10-10 22:55:30 -07:00

privoxy

*: Drop module level app property

2022-08-15 10:36:29 -04:00

quassel

quassel: Use privileged decorator for actions

2022-10-08 18:52:50 -04:00

radicale

radicale: Use privileged decorator for actions

2022-10-08 18:52:53 -04:00

roundcube

roundcube: Minor update to comment in privileged actions

2022-10-08 18:52:55 -04:00

rssbridge

rssbridge: add option to allow public access

2022-10-24 12:02:10 -07:00

samba

samba: Use privileged decorator for actions

2022-10-08 18:53:47 -04:00

searx

searx: Ensure that socket is only reachable by Apache and root

2022-12-05 20:46:43 -05:00

security

fail2ban: Make fail2ban log to journald

2022-10-09 08:54:02 -04:00

shaarli

shaarli: tests: functional: Specify setup form submission button

2022-09-03 17:28:33 -04:00

shadowsocks

shadowsocks: Use privileged decorator for actions

2022-10-08 18:53:07 -04:00

sharing

sharing: Use privileged decorator for actions

2022-10-08 18:53:10 -04:00

snapshot

snapshot: Use privileged decorator for actions

2022-10-08 18:53:13 -04:00

ssh

ssh: Restrict logins to groups root, admin and freedombox-ssh

2022-12-05 20:47:08 -05:00

sso

sso: Use privileged decorator for actions

2022-10-08 18:53:18 -04:00

storage

storage: Drop skip_recommends

2022-11-04 14:41:32 -07:00

syncthing

syncthing: Add protection to local service using firewall

2022-12-05 20:46:59 -05:00

tor

tor: Use privileged decorator for actions

2022-10-08 18:53:24 -04:00

transmission

transmission: Add protection to local service using firewall

2022-12-05 20:46:57 -05:00

ttrss

ttrss: Use privileged decorator for actions

2022-10-08 18:53:30 -04:00

upgrades

upgrades: Add documentation link upgrades service file

2022-11-05 07:20:13 -04:00

users

*: Use privileged decorator for service actions

2022-10-08 18:53:55 -04:00

wireguard

wireguard: Us privileged decorator for actions

2022-10-08 18:53:36 -04:00

wordpress

wordpress: Update fail2ban filter

2022-10-09 08:53:56 -04:00

zoph

zoph: Use privileged decorator for actions

2022-10-08 18:53:41 -04:00

__init__.py

…