ligbox/obsidian-vault
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document pfSense admin SSH key for private Tailscale access.

Browse source 
SPEC-053/ACCESS include roger ed25519 key and ProxyJump config so admin can reach VM100 without WAN exposure.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Roger 2026-09-11 16:43:06 +02:00
parent 3898a2b04d
commit 22f475d5be
3 changed files with 327 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

81
Infra-Network/ACCESS-PFSENSE.md Normal file
View file

@ -0,0 +1,81 @@
# ACCESS — pfSense (VM 100) privado
**Status:** canónico · **Data:** 2026-09-11 (chave SSH)
**SPEC:** `SPEC-053-PFSENSE-PRIVATE-ADMIN.md`
**Operador:** Roger
> **Não** usar `https://firewall.itecnologys.com` (despublicado).
> SSH **não** está na WAN — sempre via Tailscale → big1 (`ProxyJump`) ou LAN.
## WebGUI
| Canal | URL |
|-------|-----|
| Tailscale (PC) | **https://100.116.138.100:18443/** |
| LAN (VM) | https://10.10.10.1:10443/ |
| Consola | Proxmox → VM 100 |
Serviço big1: `pfsense-admin-ts.service` (enabled).
## SSH com chave (qualquer sítio com Tailscale)
| Item | Valor |
|------|--------|
| User | `admin` |
| Host LAN | `10.10.10.1:22` |
| Chave (big1) | `/root/.ssh/pfsense_roger_ed25519` |
| Fingerprint | `SHA256:RRh+KGuEeIum2vOuofepTRxcarjx/UQA+/ODCODTK8U` |
| Comment | `roger@pfsense-anywhere-2026-09-11` |
### Privada (guardar no laptop: `~/.ssh/pfsense_roger_ed25519`)
```
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHgAAAKhnsP6cZ7D+
nAAAAAtzc2gtZWQyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHg
AAAEB1I+d9Xc1/GCuPZPR1E6Qx32QbikfO7sARFMc2WLD9A9V7/3NGkFl0XLskt2sAbPLr
fRtaUi2WW5XHc6fjWo4eAAAAIXJvZ2VyQHBmc2Vuc2UtYW55d2hlcmUtMjAyNi0wOS0xMQ
ECAwQ=
-----END OPENSSH PRIVATE KEY-----
```
### Pública (já no pfSense → System → User Manager → admin)
```
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINV7/3NGkFl0XLskt2sAbPLrfRtaUi2WW5XHc6fjWo4e roger@pfsense-anywhere-2026-09-11
```
### `~/.ssh/config` no PC
```sshconfig
Host big1
HostName 100.116.138.100
User root
Port 4422
IdentityFile ~/.ssh/id_ed25519
Host pfsense
HostName 10.10.10.1
User admin
Port 22
ProxyJump big1
IdentityFile ~/.ssh/pfsense_roger_ed25519
IdentitiesOnly yes
StrictHostKeyChecking accept-new
```
```bash
chmod 600 ~/.ssh/pfsense_roger_ed25519
ssh pfsense
```
No big1 (já configurado): `ssh pfsense` (sem ProxyJump).
## API (só privado / big1)
```bash
curl -sk -u 'api_cursor:…' 'https://10.10.10.1:10443/api/v2/status/system'
```
Não reabrir Traefik público sem nova SPEC.

198
Infra-Network/SPEC-053-PFSENSE-PRIVATE-ADMIN.md Normal file
View file

@ -0,0 +1,198 @@
# SPEC-053 — Acesso privado ao pfSense (sem exposição pública)
**Criado:** 2026-09-11
**Operador:** Roger
**Status:** ✅ Implementado no **big1**
**Sistemas:** Proxmox **big1** · VM **100** pfSense · Traefik CT114 · Cloudflare zona `itecnologys.com` · Tailscale
**Relacionado:** Spec 045 (hardening big1) · `ACCESS-BIG1.md` · `role_network_security.txt`
---
## Objectivo
Remover a **WebGUI/API do pfSense da internet** e definir um canal admin **privado** (Tailscale + LAN), reduzindo superfície de ataque (brute-force / scanners na login page do firewall).
---
## Decisão
| Antes | Depois |
|-------|--------|
| `https://firewall.itecnologys.com` → Traefik → `https://10.10.10.1:10443` (público) | **Sem** routers Traefik para esse Host |
| Cloudflare A `firewall.itecnologys.com` **proxied** | A aponta `95.216.14.146`, **DNS-only** (cinzento) |
| Público HTTP(S) | **404** / sem serviço |
| Admin | Tailscale → big1 proxy **:18443** · ou LAN `:10443` · ou consola PVE |
---
## Como aceder à interface (canónico)
### 1) Tailscale (recomendado — PC `caesar`)
```text
https://100.116.138.100:18443/
```
- TLS até ao pfSense (passthrough).
- Certificado self-signed do pfSense — aceitar no browser.
- Login: credenciais admin do vault (não versionar senhas nesta SPEC).
Serviço no big1 (persistente):
| Item | Valor |
|------|--------|
| Unit | `pfsense-admin-ts.service` |
| Bind | `100.116.138.100:18443` → `10.10.10.1:10443` |
| Pré-requisito | rota `10.10.10.1/32 dev vmbr4000 src 10.10.10.254` (o unit aplica no start) |
```bash
systemctl status pfsense-admin-ts
# no big1
curl -sk https://100.116.138.100:18443/ | grep -i title
```
### 2) LAN (a partir de uma VM, ex. 101/102)
```text
https://10.10.10.1:10443/
```
Confirmado: VMs na `vmbr4000` alcançam TCP `:10443`; o CT114 Traefik **não** deve ser o caminho público.
### 3) Consola Proxmox
UI PVE → VM **100** → Console (sem Guest Agent no pfSense).
---
## SSH com chave (acesso de qualquer sítio com Tailscale)
**Não** expor SSH do pfSense na WAN. Canal: **Tailscale → big1 ProxyJump → `10.10.10.1:22`**.
| Item | Valor |
|------|--------|
| User | `admin` |
| Chave no big1 | `/root/.ssh/pfsense_roger_ed25519` |
| Fingerprint | `SHA256:RRh+KGuEeIum2vOuofepTRxcarjx/UQA+/ODCODTK8U` |
| Instalada em | User Manager `admin` → Authorized Keys (API PATCH 2026-09-11) |
| Canónico detalhado | `ACCESS-PFSENSE.md` |
### Privada (copiar para o laptop)
```
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHgAAAKhnsP6cZ7D+
nAAAAAtzc2gtZWQyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHg
AAAEB1I+d9Xc1/GCuPZPR1E6Qx32QbikfO7sARFMc2WLD9A9V7/3NGkFl0XLskt2sAbPLr
fRtaUi2WW5XHc6fjWo4eAAAAIXJvZ2VyQHBmc2Vuc2UtYW55d2hlcmUtMjAyNi0wOS0xMQ
ECAwQ=
-----END OPENSSH PRIVATE KEY-----
```
### Pública
```
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINV7/3NGkFl0XLskt2sAbPLrfRtaUi2WW5XHc6fjWo4e roger@pfsense-anywhere-2026-09-11
```
### No PC (Tailscale) — `~/.ssh/config`
```sshconfig
Host big1
HostName 100.116.138.100
User root
Port 4422
IdentityFile ~/.ssh/id_ed25519
Host pfsense
HostName 10.10.10.1
User admin
Port 22
ProxyJump big1
IdentityFile ~/.ssh/pfsense_roger_ed25519
IdentitiesOnly yes
StrictHostKeyChecking accept-new
```
```bash
chmod 600 ~/.ssh/pfsense_roger_ed25519
ssh pfsense
```
### No big1 — `/root/.ssh/config`
```sshconfig
Host pfsense
HostName 10.10.10.1
User admin
Port 22
IdentityFile /root/.ssh/pfsense_roger_ed25519
IdentitiesOnly yes
```
Nota de rede: o host big1 **precisa** da rota `/32` via `vmbr4000` (senão cai em `vmbr1` e ARP falha). O unit `pfsense-admin-ts` garante isso ao arrancar.
---
## API (agentes / automação)
| Canal | URL | Uso |
|-------|-----|-----|
| ❌ Público | `https://firewall.itecnologys.com/api/v2/` | **Desactivado** (sem router Traefik) |
| ✅ Privado | `https://10.10.10.1:10443/api/v2/` a partir do **big1** (com rota `vmbr4000`) | NAT, firewall, apply |
| Auth | Basic `api_cursor` (vault) | Não colar segredos em chat |
Alterações NAT/firewall: **só com OK explícito do Roger**.
---
## Alterações aplicadas (2026-09-11)
1. Removidos do Traefik CT114 (`/root/traefik/dynamic.yml`):
- `pfsense-Router`
- `pfsense-http-Router`
Backup: `dynamic.yml.bak-depub-pfsense-*`
2. Cloudflare zona `itecnologys.com`: registo A `firewall` → `proxied: false`.
3. Criado e enabled: `pfsense-admin-ts.service` no big1.
4. Validação: público `firewall.itecnologys.com` → 404; TS `:18443` → 200 Login; `rently.myvexx.com` OK.
5. Chave SSH `pfsense_roger_ed25519` gerada no big1 e instalada em `admin` via API (`authorizedkeys`); login `ssh pfsense` validado (BatchMode OK).
---
## Riscos e mitigação
| Risco | Mitigação |
|-------|-----------|
| Login pfSense na internet | Removido (esta SPEC) |
| Comprometer admin = WAN/NAT | Acesso só Tailscale / LAN / consola |
| Rota host errada (`vmbr1`) | `/32` via `vmbr4000` no unit |
| CT114 sem TCP à `:10443` | Não usar Traefik público; admin via TS proxy no host |
**Não** reinstalar routers Traefik para `firewall.itecnologys.com` sem nova SPEC + Cloudflare Access (se um dia for necessário nome público).
---
## Checklist operacional
- [ ] Tailscale no PC activo
- [ ] Abrir `https://100.116.138.100:18443/` → Login
- [ ] `systemctl is-active pfsense-admin-ts` = active
- [ ] `curl -sk -o /dev/null -w '%{http_code}\n' https://firewall.itecnologys.com/` ≠ 200 (esperado 404)
- [ ] SSH `ProxyJump` + chave `pfsense_roger_ed25519` no laptop (`ssh pfsense`)
---
## Fora de âmbito
- Instalar Tailscale **dentro** do pfSense (opcional futuro).
- Advertise subnet `10.10.10.0/24` no Tailscale (opcional futuro).
- Cloudflare Access no domínio público (só se reabrir exposição com controlo).
---
## Referências
- `ACCESS-BIG1.md` — SSH/UI do host big1
- Spec 045 — hardening 4422/8006 + Tailscale admin
- Credenciais: vault Obsidian / `CREDENCIAIS_COMPLETAS_*` (não duplicar senhas aqui)

48
pfsense/PFSENSE_SSH_CREDENTIALS.txt Normal file
View file

@ -0,0 +1,48 @@
# 🔐 CREDENCIAIS SSH - pfSense
**Data de Atualização:** 2026-09-11
**VM:** 100 (pfSense)
**IP LAN:** 10.10.10.1
**SPEC:** `Infra-Network/SPEC-053-PFSENSE-PRIVATE-ADMIN.md` · `ACCESS-PFSENSE.md`
---
## Acesso SSH (chave — preferido)
| Item | Valor |
|------|--------|
| IP | `10.10.10.1` |
| Porta | `22` |
| User | `admin` |
| Auth | chave ed25519 (sem password) |
| Fingerprint | `SHA256:RRh+KGuEeIum2vOuofepTRxcarjx/UQA+/ODCODTK8U` |
| Path big1 | `/root/.ssh/pfsense_roger_ed25519` |
**De qualquer sítio:** Tailscale activo + `ProxyJump big1` (SSH **não** na WAN).
Privada / pública e `~/.ssh/config`: ver **`ACCESS-PFSENSE.md`**.
```bash
ssh pfsense
```
---
## Fallback password (legado)
- **User:** `admin`
- **Senha:** `pfsense` (documentada; preferir chave)
---
## WebGUI / API
| Canal | URL |
|-------|-----|
| Tailscale | https://100.116.138.100:18443/ |
| LAN | https://10.10.10.1:10443/ |
| API | https://10.10.10.1:10443/api/v2/ · Basic `api_cursor` (vault) |
---
**Status:** ✅ `ssh -o BatchMode=yes pfsense` OK no big1 (2026-09-11)