install.fairie/home/.chezmoiscripts/universal/run_onchange_after_30-endlessh.sh.tmpl

{{- if eq .host.distro.family "linux" -}}
#!/usr/bin/env bash
# @file Endlessh Configuration
# @brief Applies the Endlessh configuration and starts the service on Linux systems
# @description
#     Endlessh is a endless SSH tarpit that slowly shows an infinitely long SSH welcome banner on the default
#     SSH port. It is intended to break unsophisticated malware that targets SSH.
#
#     If the `endlessh` program is installed, this script applies the configuration stored in `home/private_dot_ssh/endlessh/config.tmpl`
#     (that unpacks with Chezmoi to `~/.ssh/endlessh/config`) to the system location and then starts the service.
#
#     **Note:** _This script runs under the assumption that the actual SSH port which is defined in `home/.chezmoidata.yaml`
#     is assigned to a non-standard port like 2214. This allows the default port to be used for `endlessh`._
#
#     ## Links
#
#     * [Endlessh GitHub repository](https://github.com/skeeto/endlessh)
#     * [Endlessh configuration](https://github.com/megabyte-labs/install.doctor/blob/master/home/private_dot_ssh/endlessh/config.tmpl)

# @file Endlessh Configuration
# @brief This script configures Endlessh by applying the configuration stored in `${XDG_DATA_HOME:-$HOME/.ssh}/endlessh/config` if the `endlessh` application is available
# @description
#     This script applies the Endlessh configuration stored in `${XDG_DATA_HOME:-$HOME/.ssh}/endlessh/config` if endlessh is installed.
#     Endlessh is and SSH Tarpit configured to listen for incoming connection on the given port and respond slowly with a random, endless SSH banner. To protect the real server,
#     configure Endlessh to listen on the default SSH port (22), while the real server listens to a different port.
#
#     ## Configuration Variables
#
#     The following chart details the input variable(s) that are used to determine the configuration of the endlessh:
#
#     | Variable        | Description                                                |
#     |-----------------|------------------------------------------------------------|
#     | `endlesshPort`  | The port that endlessh listens to for incoming connections |
#
#     ## Links
#
#     * [Default Endlessh configuration](https://github.com/megabyte-labs/install.doctor/tree/master/home/private_dot_ssh/endlessh/config.tmpl)
#     * [Secrets / Environment variables documentation](https://install.doctor/docs/customization/secrets)

# endlessh config hash: {{- include (joinPath .host.home ".ssh" "endlessh" "config") | sha256sum -}}

{{ includeTemplate "universal/profile" }}
{{ includeTemplate "universal/logg" }}

### Configures endlessh service
function configureEndlessh() {
    ### Update the service configuration file
    logg info 'Updating endlessh service configuration file'
    sudo sed -i 's/^.*#AmbientCapabilities=CAP_NET_BIND_SERVICE/AmbientCapabilities=CAP_NET_BIND_SERVICE/' /usr/lib/systemd/system/endlessh.service
    sudo sed -i 's/^.*PrivateUsers=true/#PrivateUsers=true/' /usr/lib/systemd/system/endlessh.service
    logg info 'Reloading systemd'
    sudo systemctl daemon-reload

    ### Update capabilities of `endlessh`
    logg info 'Updating capabilities of endlessh'
    sudo setcap 'cap_net_bind_service=+ep' /usr/bin/endlessh

    ### Restart / enable Endlessh
    logg info 'Enabling the endlessh service'
    sudo systemctl enable endlessh
    logg info 'Restarting the endlessh service'
    sudo systemctl restart endlessh
}

### Update /etc/endlessh/config if environment is not WSL
if [[ ! "$(test -d proc && grep Microsoft /proc/version > /dev/null)" ]]; then
    if command -v endlessh > /dev/null; then
        if [ -d /etc/endlessh ]; then
            logg info 'Copying ~/.ssh/endlessh/config to /etc/endlessh/config'
            sudo cp -f "$HOME/.ssh/endlessh/config" /etc/endlessh/config

            configureEndlessh || CONFIGURE_EXIT_CODE=$?
            if [ -n "$CONFIGURE_EXIT_CODE" ]; then
                logg error 'Configuring endlessh service failed' && exit 1
            else
                logg success 'Successfully configured endlessh service'
            fi
        elif [ -f /etc/endlessh.conf ]; then
            logg info 'Copying ~/.ssh/endlessh/config to /etc/endlessh.conf'
            sudo cp -f "$HOME/.ssh/endlessh/config" /etc/endlessh.conf

            configureEndlessh || CONFIGURE_EXIT_CODE=$?
            if [ -n "$CONFIGURE_EXIT_CODE" ]; then
                logg error 'Configuring endlessh service failed' && exit 1
            else
                logg success 'Successfully configured endlessh service'
            fi
        else
            logg warn 'Neither the /etc/endlessh folder nor the /etc/endlessh.conf file exist'
        fi
    else
        logg info 'Skipping Endlessh configuration because the endlessh executable is not available in the PATH'
    fi
else
    logg info 'Skipping Endlessh configuration since environment is WSL'
fi

{{ end -}}