ssh: don't open port 22 for the loopback-only sshd

sshd-localhost.nix turns sshd on for every role so that "ssh root@localhost"
works, and binds it to 127.0.0.1 only ("zero network exposure", as its
own comment says, and as sshd.nix expects: the sshd feature "extends this
to 0.0.0.0 and opens port 22 on the firewall when the user enables remote
SSH").

It never turned off services.openssh.openFirewall, which NixOS defaults
to true and applies whether or not sshd listens on the ports. So port 22
was open in the firewall on every role, Desktop Only included, with
nothing behind it. No listener means no live exposure today; it does mean
the firewall was not saying what the documentation says, and the day
something does bind 22 on a wider address (a listenAddresses change, a
second daemon) it would be reachable without anyone having opened it.

openFirewall is now mkDefault false there. Nothing that wants SSH
published loses it: sshd.nix (feature sshd) and remote-deploy.nix both
add 22 explicitly, and only when enabled. Found by evaluating the real
module set; grepping for allowedTCPPorts does not see a NixOS default.

Evaluated with nix eval, TCP firewall ports:

                            before     after
  Server + Desktop          22 80 443 3051 8937   80 443 3051 8937
  Bitcoin Node Only         22 3051 8937 60847    3051 8937 60847
  Desktop Only              22                    (none)
  Desktop + features.sshd   22                    22
  Desktop + deploy.enable   22 3389               22 3389

and sshd's listen addresses are unchanged: 127.0.0.1 by default,
127.0.0.1 and 0.0.0.0 with the sshd feature. Desktop Only now opens no
TCP port at all; UDP 5353 (mDNS) is the only port open there, and
SECURITY.md says so.

Add tests/test_ssh_exposure.py.

This commit is contained in:

Security Fix

2026-10-02 02:24:29 -05:00

committed by

naturallaw777

parent 3694ea6489

commit b79a6fd7f2

3 changed files with 73 additions and 1 deletions

SECURITY.md

+2 -1

View File

@@ -45,7 +45,8 @@ sites.
 On Desktop Only the Hub is not published at all. It is reachable only from the
 machine itself, through the desktop application window on localhost. Desktop
 Only is the role most likely to be used away from home, and a root-capable admin
 UI has no business listening on a coffee-shop network.
 UI has no business listening on a coffee-shop network. The firewall there opens
 no TCP port at all; the only port open is UDP 5353, for mDNS.
 `sovran_systemsOS.hub.directPort = true` in `custom.nix` opens port 8937 if you
 do want to reach a Desktop Only Hub from another device.