How to tweak Tallow SSH banning or close SSH

[aleksasiriski]

Since I just noticed like 2000 failed attempts to login to my servers via ssh, this could ban detect and ban these IPs.

If everyone approves I'll start the work on implementing this as well as optional zRam.

[mysticaltech]

@aleksasiriski MicroOS already bans abusive IPs. If you want to can set it to be more aggressive (settings to tweak that would be great). It uses Tallow. https://en.opensuse.org/Portal:MicroOS/Design

For zRam, please go ahead, as long as it's optional and off by default.

[aleksasiriski]

And also remember, you can change the firewall via terraform even after initial deploy. So close port 22 when you are done setting up the cluster. See how it's done here! #436 (comment)

Then, when you want to reopen it, you can just reverse the procedure (before doing anything else of course).

Actually it's safe to edit the firewall and after that run terraform apply, it will recreate all the rules and remove manually added ones. I tested it.

[mrclrchtr]

Unfortunately, this does not work for ir. I have done the following:

extra_firewall_rules = var.close_ports ? [
    # Allow all traffic to the ssh ports
    {
      description     = "Close SSH"
      direction       = "in"
      protocol        = "tcp"
      port            = "22"
      source_ips      = ["255.255.255.254/32"] # no source IPs allowed
      destination_ips = []                     # Won't be used for this rule
    },
    {
      description     = "Close Kubernetes API"
      direction       = "in"
      protocol        = "tcp"
      port            = "6443"
      source_ips      = ["255.255.255.254/32"] # no source IPs allowed
      destination_ips = []                     # Won't be used for this rule
    }
  ] : []

This works until I close it once. After that they can not be reopened because the refresh no longer works:

...
module.kube-hetzner.data.github_release.hetzner_csi[0]: Reading...
module.kube-hetzner.data.github_release.kured[0]: Read complete after 0s [id=118043585]
module.kube-hetzner.data.github_release.hetzner_csi[0]: Read complete after 0s [id=123071271]
module.kube-hetzner.data.github_release.hetzner_ccm[0]: Read complete after 0s [id=121522880]
module.kube-hetzner.data.remote_file.kubeconfig: Still reading... [10s elapsed]
module.kube-hetzner.data.remote_file.kubeconfig: Still reading... [20s elapsed]
module.kube-hetzner.data.remote_file.kubeconfig: Still reading... [30s elapsed]
module.kube-hetzner.data.remote_file.kubeconfig: Still reading... [40s elapsed]

Am I doing something wrong?

[mysticaltech]

@mrclrchtr The way our firewall works has evolved since this thread started, it's now cleaner and more secure, please see kube.tf.example, search for firewall and read the related section, that should help clarify it more. We also have additional switchs to do what you are trying to do above.

[mrclrchtr]

@mysticaltech Ok, you mean just enter "null" at the API and SSH port? If I set SSH to null, the cluster cannot be initialized and the terraform state cannot be refreshed. I currently do it by setting my private IP. But I would like to close the SSH port at the very end and open it at the beginning of the next terraform run.

[mysticaltech]

@mrclrchtr FYI see kube.tf.example

  # Allow access to the Kube API from the specified networks. The default is ["0.0.0.0/0", "::/0"].
  # Allowed values: null (disable Kube API rule entirely) or a list of allowed networks with CIDR notation.
  # For maximum security, it's best to disable it completely by setting it to null. However, in that case, to get access to the kube api,
  # you would have to connect to any control plane node via SSH, as you can run kubectl from within these.
  # firewall_kube_api_source = null

  # Allow SSH access from the specified networks. Default: ["0.0.0.0/0", "::/0"]
  # Allowed values: null (disable SSH rule entirely) or a list of allowed networks with CIDR notation.
  # Ideally you would set your IP there. And if it changes after cluster deploy, you can always update this variable and apply again.
  # firewall_ssh_source = ["1.2.3.4/32"]