<commit_before># openssh module

## Problem Description
OpenSSH public key based authenication requires a valid server-side configuration file, a minimum set of configuration options, and correctly configured permission modes and ownership of various files such as keys, configuration files, and their parent directories. If any one of these are improperly configured, the OpenSSH daemon may fail to start and/or be unable to authenticate users.

## Detecting with EC2 Rescue for Linux

### Overview
The "openssh" module for EC2 Rescue for Linux is a diagnostic module that checks for and corrects many problems that prevent the OpenSSH daemon from starting and/or authenticating a user. This module does not require any arguments to run, but it does requires sudo access since the remediation actions interact with files only readable and/or writable by the root user. The module performs the following checks:

1.  Utilize sshd's test mode to verify the following:
    1. Existence of the server configuration file.
    2. Validity of the keyword-argument pairs in the server configuration file.
    3. Existence of the privilege separation directory.
    4. Presence of host keys, if supported (see "Known Limitations").
    5. Existence of the privilege separation user.
2.  Presence of duplicate AuthorizedKeysFile keyword-argument pairs in sshd configuration file.
3.  Existence of, file mode, and owner of the relative AuthorizedKeysFile paths for each user.
4.  Existence of, file mode, and owner of the absolute AuthorizedKeysFile paths.
6.  File mode and owner of the privilege separation directory.
7.  File mode and owner of /etc/ssh and its contents.
8.  File mode and owner of any host keys defined in the server configuration that have not been previously checked during the prior steps.
9.  If remediation is enabled, remediation of problems discovered during these checks.

### Parameters

The OpenSSH module can utilize several parameters from EC2 Rescue For Linux.

1. --remediate

Enable remediation of detected problems.

2. --inject_key

Inject a new public key into the authorized_keys file for each user whose home directory is in /home. The new key is obtained from the metadata of the running instance. Alternatively, the key can be specified via the new_ssh_key parameter. This action is performed prior to The inject_key parameter is dependent upon the remediation parameter.

3. --new_ssh_key="new key value"

Specify the value of the new public key for use with the inject_key parameter. This is useful when using the module in a system that is not an instance or when a particular public key is required, but is not available from the instance metadata.

### Example
```
[ec2-user@localhost ~]$ sudo ./ec2rl run --only-modules=openssh --remediate --inject_key --new_key="ssh-rsa <KEY>"
```

Passing output

```
----------[Diagnostic Results]----------
module run/openssh        [SUCCESS] All configuration checks passed or all detected problems fixed.
```

Warning output

```
----------[Diagnostic Results]----------
module run/openssh        [WARN] Unable to fully validate one or more OpenSSH components.
```

Failing output when run without remediation:

```
----------[Diagnostic Results]----------
module run/openssh        [FAILURE] Improper configuration of one or more OpenSSH components.
```<commit_msg>Finish incomplete sentence.<commit_after># openssh module

## Problem Description
OpenSSH public key based authenication requires a valid server-side configuration file, a minimum set of configuration options, and correctly configured permission modes and ownership of various files such as keys, configuration files, and their parent directories. If any one of these are improperly configured, the OpenSSH daemon may fail to start and/or be unable to authenticate users.

## Detecting with EC2 Rescue for Linux

### Overview
The "openssh" module for EC2 Rescue for Linux is a diagnostic module that checks for and corrects many problems that prevent the OpenSSH daemon from starting and/or authenticating a user. This module does not require any arguments to run, but it does requires sudo access since the remediation actions interact with files only readable and/or writable by the root user. The module performs the following checks:

1.  Utilize sshd's test mode to verify the following:
    1. Existence of the server configuration file.
    2. Validity of the keyword-argument pairs in the server configuration file.
    3. Existence of the privilege separation directory.
    4. Presence of host keys, if supported (see "Known Limitations").
    5. Existence of the privilege separation user.
2.  Presence of duplicate AuthorizedKeysFile keyword-argument pairs in sshd configuration file.
3.  Existence of, file mode, and owner of the relative AuthorizedKeysFile paths for each user.
4.  Existence of, file mode, and owner of the absolute AuthorizedKeysFile paths.
6.  File mode and owner of the privilege separation directory.
7.  File mode and owner of /etc/ssh and its contents.
8.  File mode and owner of any host keys defined in the server configuration that have not been previously checked during the prior steps.
9.  If remediation is enabled, remediation of problems discovered during these checks.

### Parameters

The OpenSSH module can utilize several parameters from EC2 Rescue For Linux.

1. --remediate

Enable remediation of detected problems.

2. --inject_key

Inject a new public key into the authorized_keys file for each user whose home directory is in /home. The new key is obtained from the metadata of the running instance. Alternatively, the key can be specified via the new_ssh_key parameter. This action is performed prior to any problem checking and remediation steps. The inject_key parameter is dependent upon the remediation parameter.

3. --new_ssh_key="new key value"

Specify the value of the new public key for use with the inject_key parameter. This is useful when using the module in a system that is not an instance or when a particular public key is required, but is not available from the instance metadata.

### Example
```
[ec2-user@localhost ~]$ sudo ./ec2rl run --only-modules=openssh --remediate --inject_key --new_key="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDQwbc5itEVp5PqNyp/xkhdyYpXbzUEo0m2w1n49rkymJ7aSLUiaGIvvOqxRYkplfvGesxS90V5lo47O2bEw6y/iEvzy2wUHWCywlGw6klPwbdzfNrV8kk0uOI/rY6e+rJoOQBO2Asut3vDz3bj6hdJ/4NLsQYyFKv+vnEDzWzRAhO3KLa7JhlEvCg4O1WBgC4ko4b8OswI3cjrpRt3NgxC9W81qdSxE44YCUVb2JGm14VJvyiWDDMz4u7RRCvsefCAZxRt7W3UADVm9PiUJA80vrIXirx1ShQYGIu61hz0nLtR/NGPWdweJOKt4PERJ1Ht7b99BL8NsXyO3wS6lr7j documentation-example-key"
```

Passing output

```
----------[Diagnostic Results]----------
module run/openssh        [SUCCESS] All configuration checks passed or all detected problems fixed.
```

Warning output

```
----------[Diagnostic Results]----------
module run/openssh        [WARN] Unable to fully validate one or more OpenSSH components.
```

Failing output when run without remediation:

```
----------[Diagnostic Results]----------
module run/openssh        [FAILURE] Improper configuration of one or more OpenSSH components.
```
{'fraction_non_alphanumeric': 0.0642947191483401, 'fraction_numerical': 0.014988093570528086, 'mean_word_length': 4.162689804772234, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 4, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3674942', 'n_tokens_mistral': 1984, 'n_tokens_neox': 1865, 'n_words': 943}