blob: cb72630ba415b4045c47dbcae67d0a9ff7f5d732 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
|
<!-- HardeningLEDE, Version: 7, Modified: 2020/09/04, Author: feurig -->
#Hardening LEDE
BusyBox v1.30.1 () built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 19.07.3, r11063-85e04e9f46
----------------------------------------------------
### Add packages
In our build sudo, nano, and syslog-ng are included as well as the utilities to work with passwords and groups (shadow-useradd shadow-groupadd shadow-usermod) if your build does not you will need to install them.
root@OpenWrt:~# opkg update
root@OpenWrt:~# opkg install shadow-useradd shadow-groupadd shadow-usermod
root@OpenWrt:~# opkg install sudo nano syslog-ng
### Add Sudo Users
root@OpenWrt:~# useradd -c "Joseph Wayne Dumoulin" -m joe -s /bin/ash
root@OpenWrt:~# useradd -c "D Delmar Davis" -m feurig -s /bin/ash
root@OpenWrt:~# groupadd --system sudo
root@OpenWrt:~# usermod -a -G sudo joe
root@OpenWrt:~# usermod -a -G sudo feurig
root@OpenWrt:~# visudo
...
## Uncomment to allow members of group sudo to execute any command
%sudo ALL=(ALL) ALL
...
root@OpenWrt:~# passwd feurig
root@OpenWrt:~# passwd joe
For each user add their authorized ssh keys.
sudo -u feurig ash
cd
mkdir .ssh
nano .ssh/authorized_keys
... add keys ...
### Disable Root Login
Once you are able to log into the router using your ssh keys you should disable root access. The following is recommended but didnt work. _ALWAYS test that you are unable to login as root._
root@OpenWrt:~# uci set dropbear.@dropbear[0].PasswordAuth="off"
root@OpenWrt:~# uci set dropbear.@dropbear[0].RootPasswordAuth="off"
root@OpenWrt:~# uci commit dropbear
root@OpenWrt:~# reboot
don@annie:~$ ssh root@192.168.128.215
BusyBox v1.30.1 () built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 19.07.3, r11063-85e04e9f46
-----------------------------------------------------
root@OpenWrt:~#
Thats worse than ubuntu:ubuntu _Fuck that! Lock the root account and remove dropbears authorized keys._
root@OpenWrt:~# passwd -l root
root@OpenWrt:~# rm /etc/dropbear/authorized_keys
root@OpenWrt:~# ^D
don@annie:~$ ssh root@192.168.128.215
root@192.168.128.215: Permission denied (publickey).
Now the admin users need to log in using their personal ssh keys and escalate privileges using their password.
don@annie:~$ ssh feurig@192.168.128.215
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 19.07.3, r11063-85e04e9f46
-----------------------------------------------------
feurig@OpenWrt:~$ sudo bash
Password:
#### preserving users home directories
In order to maintain the sudo users during upgrades you need to add /home and /etc/sudoers to the /etc/sysupgrade.conf file. The passwd, shadow, group and other files should already be saved by sysupgrade but the home directory is needed for the users .ssh/authorized_keys.
### References
* https://openwrt.org/docs/guide-user/security/secure.access
|
