From 1bf3861318f9cc362384722d4f312f3dd439c749 Mon Sep 17 00:00:00 2001 From: EuAndreh Date: Mon, 16 Nov 2020 22:10:25 -0300 Subject: Add base Guix configuration and start switching to it - remove NixOS stateVersion from .envrc; - add guix-reconfigure.sh; - add vps.scm with initial Guix system configuration; - update vps.tf to use the new "base-guix" snapshot. The "base-guix" image doesn't need a password. The "andreh" users has one, but it is configured for not requiring it when running commands as "sudo". The expected minimal steps one has to go through for privilege scalation is via the SSH private key, and accessing the VPS via SSH. Since password login is disabled and root can't login via SSH either, only the private SSH key allows access to the server. After that, the attacker will be able to run commands as root. --- .../plan-files/2020-11-16T20:02:03-03:00.tfplan | Bin 0 -> 2074 bytes .../plan-files/2020-11-16T20:11:50-03:00.tfplan | Bin 0 -> 2077 bytes .../plan-files/2020-11-16T22:16:40-03:00.tfplan | Bin 0 -> 2088 bytes secrets/terraform/terraform.tfstate | Bin 264 -> 3079 bytes secrets/terraform/terraform.tfstate.backup | Bin 181 -> 181 bytes 5 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 secrets/terraform/plan-files/2020-11-16T20:02:03-03:00.tfplan create mode 100644 secrets/terraform/plan-files/2020-11-16T20:11:50-03:00.tfplan create mode 100644 secrets/terraform/plan-files/2020-11-16T22:16:40-03:00.tfplan (limited to 'secrets') diff --git a/secrets/terraform/plan-files/2020-11-16T20:02:03-03:00.tfplan b/secrets/terraform/plan-files/2020-11-16T20:02:03-03:00.tfplan new file mode 100644 index 0000000..d05d691 Binary files /dev/null and b/secrets/terraform/plan-files/2020-11-16T20:02:03-03:00.tfplan differ diff --git a/secrets/terraform/plan-files/2020-11-16T20:11:50-03:00.tfplan b/secrets/terraform/plan-files/2020-11-16T20:11:50-03:00.tfplan new file mode 100644 index 0000000..08d5e79 Binary files /dev/null and b/secrets/terraform/plan-files/2020-11-16T20:11:50-03:00.tfplan differ diff --git a/secrets/terraform/plan-files/2020-11-16T22:16:40-03:00.tfplan b/secrets/terraform/plan-files/2020-11-16T22:16:40-03:00.tfplan new file mode 100644 index 0000000..2272d23 Binary files /dev/null and b/secrets/terraform/plan-files/2020-11-16T22:16:40-03:00.tfplan differ diff --git a/secrets/terraform/terraform.tfstate b/secrets/terraform/terraform.tfstate index df179b7..135ef81 100644 Binary files a/secrets/terraform/terraform.tfstate and b/secrets/terraform/terraform.tfstate differ diff --git a/secrets/terraform/terraform.tfstate.backup b/secrets/terraform/terraform.tfstate.backup index 21c7872..775ca09 100644 Binary files a/secrets/terraform/terraform.tfstate.backup and b/secrets/terraform/terraform.tfstate.backup differ -- cgit v1.2.3