diff --git a/Infra-Network/ACCESS-PFSENSE.md b/Infra-Network/ACCESS-PFSENSE.md new file mode 100644 index 0000000..0f7b5ad --- /dev/null +++ b/Infra-Network/ACCESS-PFSENSE.md @@ -0,0 +1,81 @@ +# ACCESS — pfSense (VM 100) privado + +**Status:** canónico · **Data:** 2026-09-11 (chave SSH) +**SPEC:** `SPEC-053-PFSENSE-PRIVATE-ADMIN.md` +**Operador:** Roger + +> **Não** usar `https://firewall.itecnologys.com` (despublicado). +> SSH **não** está na WAN — sempre via Tailscale → big1 (`ProxyJump`) ou LAN. + +## WebGUI + +| Canal | URL | +|-------|-----| +| Tailscale (PC) | **https://100.116.138.100:18443/** | +| LAN (VM) | https://10.10.10.1:10443/ | +| Consola | Proxmox → VM 100 | + +Serviço big1: `pfsense-admin-ts.service` (enabled). + +## SSH com chave (qualquer sítio com Tailscale) + +| Item | Valor | +|------|--------| +| User | `admin` | +| Host LAN | `10.10.10.1:22` | +| Chave (big1) | `/root/.ssh/pfsense_roger_ed25519` | +| Fingerprint | `SHA256:RRh+KGuEeIum2vOuofepTRxcarjx/UQA+/ODCODTK8U` | +| Comment | `roger@pfsense-anywhere-2026-09-11` | + +### Privada (guardar no laptop: `~/.ssh/pfsense_roger_ed25519`) + +``` +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW +QyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHgAAAKhnsP6cZ7D+ +nAAAAAtzc2gtZWQyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHg +AAAEB1I+d9Xc1/GCuPZPR1E6Qx32QbikfO7sARFMc2WLD9A9V7/3NGkFl0XLskt2sAbPLr +fRtaUi2WW5XHc6fjWo4eAAAAIXJvZ2VyQHBmc2Vuc2UtYW55d2hlcmUtMjAyNi0wOS0xMQ +ECAwQ= +-----END OPENSSH PRIVATE KEY----- +``` + +### Pública (já no pfSense → System → User Manager → admin) + +``` +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINV7/3NGkFl0XLskt2sAbPLrfRtaUi2WW5XHc6fjWo4e roger@pfsense-anywhere-2026-09-11 +``` + +### `~/.ssh/config` no PC + +```sshconfig +Host big1 + HostName 100.116.138.100 + User root + Port 4422 + IdentityFile ~/.ssh/id_ed25519 + +Host pfsense + HostName 10.10.10.1 + User admin + Port 22 + ProxyJump big1 + IdentityFile ~/.ssh/pfsense_roger_ed25519 + IdentitiesOnly yes + StrictHostKeyChecking accept-new +``` + +```bash +chmod 600 ~/.ssh/pfsense_roger_ed25519 +ssh pfsense +``` + +No big1 (já configurado): `ssh pfsense` (sem ProxyJump). + +## API (só privado / big1) + +```bash +curl -sk -u 'api_cursor:…' 'https://10.10.10.1:10443/api/v2/status/system' +``` + +Não reabrir Traefik público sem nova SPEC. diff --git a/Infra-Network/SPEC-053-PFSENSE-PRIVATE-ADMIN.md b/Infra-Network/SPEC-053-PFSENSE-PRIVATE-ADMIN.md new file mode 100644 index 0000000..cb16a29 --- /dev/null +++ b/Infra-Network/SPEC-053-PFSENSE-PRIVATE-ADMIN.md @@ -0,0 +1,198 @@ +# SPEC-053 — Acesso privado ao pfSense (sem exposição pública) + +**Criado:** 2026-09-11 +**Operador:** Roger +**Status:** ✅ Implementado no **big1** +**Sistemas:** Proxmox **big1** · VM **100** pfSense · Traefik CT114 · Cloudflare zona `itecnologys.com` · Tailscale +**Relacionado:** Spec 045 (hardening big1) · `ACCESS-BIG1.md` · `role_network_security.txt` + +--- + +## Objectivo + +Remover a **WebGUI/API do pfSense da internet** e definir um canal admin **privado** (Tailscale + LAN), reduzindo superfície de ataque (brute-force / scanners na login page do firewall). + +--- + +## Decisão + +| Antes | Depois | +|-------|--------| +| `https://firewall.itecnologys.com` → Traefik → `https://10.10.10.1:10443` (público) | **Sem** routers Traefik para esse Host | +| Cloudflare A `firewall.itecnologys.com` **proxied** | A aponta `95.216.14.146`, **DNS-only** (cinzento) | +| Público HTTP(S) | **404** / sem serviço | +| Admin | Tailscale → big1 proxy **:18443** · ou LAN `:10443` · ou consola PVE | + +--- + +## Como aceder à interface (canónico) + +### 1) Tailscale (recomendado — PC `caesar`) + +```text +https://100.116.138.100:18443/ +``` + +- TLS até ao pfSense (passthrough). +- Certificado self-signed do pfSense — aceitar no browser. +- Login: credenciais admin do vault (não versionar senhas nesta SPEC). + +Serviço no big1 (persistente): + +| Item | Valor | +|------|--------| +| Unit | `pfsense-admin-ts.service` | +| Bind | `100.116.138.100:18443` → `10.10.10.1:10443` | +| Pré-requisito | rota `10.10.10.1/32 dev vmbr4000 src 10.10.10.254` (o unit aplica no start) | + +```bash +systemctl status pfsense-admin-ts +# no big1 +curl -sk https://100.116.138.100:18443/ | grep -i title +``` + +### 2) LAN (a partir de uma VM, ex. 101/102) + +```text +https://10.10.10.1:10443/ +``` + +Confirmado: VMs na `vmbr4000` alcançam TCP `:10443`; o CT114 Traefik **não** deve ser o caminho público. + +### 3) Consola Proxmox + +UI PVE → VM **100** → Console (sem Guest Agent no pfSense). + +--- + +## SSH com chave (acesso de qualquer sítio com Tailscale) + +**Não** expor SSH do pfSense na WAN. Canal: **Tailscale → big1 ProxyJump → `10.10.10.1:22`**. + +| Item | Valor | +|------|--------| +| User | `admin` | +| Chave no big1 | `/root/.ssh/pfsense_roger_ed25519` | +| Fingerprint | `SHA256:RRh+KGuEeIum2vOuofepTRxcarjx/UQA+/ODCODTK8U` | +| Instalada em | User Manager `admin` → Authorized Keys (API PATCH 2026-09-11) | +| Canónico detalhado | `ACCESS-PFSENSE.md` | + +### Privada (copiar para o laptop) + +``` +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW +QyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHgAAAKhnsP6cZ7D+ +nAAAAAtzc2gtZWQyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHg +AAAEB1I+d9Xc1/GCuPZPR1E6Qx32QbikfO7sARFMc2WLD9A9V7/3NGkFl0XLskt2sAbPLr +fRtaUi2WW5XHc6fjWo4eAAAAIXJvZ2VyQHBmc2Vuc2UtYW55d2hlcmUtMjAyNi0wOS0xMQ +ECAwQ= +-----END OPENSSH PRIVATE KEY----- +``` + +### Pública + +``` +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINV7/3NGkFl0XLskt2sAbPLrfRtaUi2WW5XHc6fjWo4e roger@pfsense-anywhere-2026-09-11 +``` + +### No PC (Tailscale) — `~/.ssh/config` + +```sshconfig +Host big1 + HostName 100.116.138.100 + User root + Port 4422 + IdentityFile ~/.ssh/id_ed25519 + +Host pfsense + HostName 10.10.10.1 + User admin + Port 22 + ProxyJump big1 + IdentityFile ~/.ssh/pfsense_roger_ed25519 + IdentitiesOnly yes + StrictHostKeyChecking accept-new +``` + +```bash +chmod 600 ~/.ssh/pfsense_roger_ed25519 +ssh pfsense +``` + +### No big1 — `/root/.ssh/config` + +```sshconfig +Host pfsense + HostName 10.10.10.1 + User admin + Port 22 + IdentityFile /root/.ssh/pfsense_roger_ed25519 + IdentitiesOnly yes +``` + +Nota de rede: o host big1 **precisa** da rota `/32` via `vmbr4000` (senão cai em `vmbr1` e ARP falha). O unit `pfsense-admin-ts` garante isso ao arrancar. + +--- + +## API (agentes / automação) + +| Canal | URL | Uso | +|-------|-----|-----| +| ❌ Público | `https://firewall.itecnologys.com/api/v2/` | **Desactivado** (sem router Traefik) | +| ✅ Privado | `https://10.10.10.1:10443/api/v2/` a partir do **big1** (com rota `vmbr4000`) | NAT, firewall, apply | +| Auth | Basic `api_cursor` (vault) | Não colar segredos em chat | + +Alterações NAT/firewall: **só com OK explícito do Roger**. + +--- + +## Alterações aplicadas (2026-09-11) + +1. Removidos do Traefik CT114 (`/root/traefik/dynamic.yml`): + - `pfsense-Router` + - `pfsense-http-Router` + Backup: `dynamic.yml.bak-depub-pfsense-*` +2. Cloudflare zona `itecnologys.com`: registo A `firewall` → `proxied: false`. +3. Criado e enabled: `pfsense-admin-ts.service` no big1. +4. Validação: público `firewall.itecnologys.com` → 404; TS `:18443` → 200 Login; `rently.myvexx.com` OK. +5. Chave SSH `pfsense_roger_ed25519` gerada no big1 e instalada em `admin` via API (`authorizedkeys`); login `ssh pfsense` validado (BatchMode OK). + +--- + +## Riscos e mitigação + +| Risco | Mitigação | +|-------|-----------| +| Login pfSense na internet | Removido (esta SPEC) | +| Comprometer admin = WAN/NAT | Acesso só Tailscale / LAN / consola | +| Rota host errada (`vmbr1`) | `/32` via `vmbr4000` no unit | +| CT114 sem TCP à `:10443` | Não usar Traefik público; admin via TS proxy no host | + +**Não** reinstalar routers Traefik para `firewall.itecnologys.com` sem nova SPEC + Cloudflare Access (se um dia for necessário nome público). + +--- + +## Checklist operacional + +- [ ] Tailscale no PC activo +- [ ] Abrir `https://100.116.138.100:18443/` → Login +- [ ] `systemctl is-active pfsense-admin-ts` = active +- [ ] `curl -sk -o /dev/null -w '%{http_code}\n' https://firewall.itecnologys.com/` ≠ 200 (esperado 404) +- [ ] SSH `ProxyJump` + chave `pfsense_roger_ed25519` no laptop (`ssh pfsense`) + +--- + +## Fora de âmbito + +- Instalar Tailscale **dentro** do pfSense (opcional futuro). +- Advertise subnet `10.10.10.0/24` no Tailscale (opcional futuro). +- Cloudflare Access no domínio público (só se reabrir exposição com controlo). + +--- + +## Referências + +- `ACCESS-BIG1.md` — SSH/UI do host big1 +- Spec 045 — hardening 4422/8006 + Tailscale admin +- Credenciais: vault Obsidian / `CREDENCIAIS_COMPLETAS_*` (não duplicar senhas aqui) diff --git a/pfsense/PFSENSE_SSH_CREDENTIALS.txt b/pfsense/PFSENSE_SSH_CREDENTIALS.txt new file mode 100644 index 0000000..f40060e --- /dev/null +++ b/pfsense/PFSENSE_SSH_CREDENTIALS.txt @@ -0,0 +1,48 @@ +# 🔐 CREDENCIAIS SSH - pfSense + +**Data de Atualização:** 2026-09-11 +**VM:** 100 (pfSense) +**IP LAN:** 10.10.10.1 +**SPEC:** `Infra-Network/SPEC-053-PFSENSE-PRIVATE-ADMIN.md` · `ACCESS-PFSENSE.md` + +--- + +## Acesso SSH (chave — preferido) + +| Item | Valor | +|------|--------| +| IP | `10.10.10.1` | +| Porta | `22` | +| User | `admin` | +| Auth | chave ed25519 (sem password) | +| Fingerprint | `SHA256:RRh+KGuEeIum2vOuofepTRxcarjx/UQA+/ODCODTK8U` | +| Path big1 | `/root/.ssh/pfsense_roger_ed25519` | + +**De qualquer sítio:** Tailscale activo + `ProxyJump big1` (SSH **não** na WAN). + +Privada / pública e `~/.ssh/config`: ver **`ACCESS-PFSENSE.md`**. + +```bash +ssh pfsense +``` + +--- + +## Fallback password (legado) + +- **User:** `admin` +- **Senha:** `pfsense` (documentada; preferir chave) + +--- + +## WebGUI / API + +| Canal | URL | +|-------|-----| +| Tailscale | https://100.116.138.100:18443/ | +| LAN | https://10.10.10.1:10443/ | +| API | https://10.10.10.1:10443/api/v2/ · Basic `api_cursor` (vault) | + +--- + +**Status:** ✅ `ssh -o BatchMode=yes pfsense` OK no big1 (2026-09-11)