From 0b8bcb0475e69f8b4810ba0be96f8022626ecba6 Mon Sep 17 00:00:00 2001 From: Garrett Allen <98648590+Gerrrt@users.noreply.github.com> Date: Fri, 13 Nov 2026 22:40:24 -0800 Subject: [PATCH] docs(gandalf): disable the NFS plumbing and record every service it runs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The audit found rpcbind on *:111 and nfs-blkmap on a node with no NFS storage, plus spiceproxy, postfix and unattended-upgrades the repo never named. build-the-playground.md §4 now lists each with its reason, disables and masks the NFS client units, and gives the ss read-back. §7 adds a power-on check for Proxmox packages, which unattended-upgrades does not cover. Co-Authored-By: Claude Opus 5.5 --- docs/changelog.md | 12 ++++++++++ docs/runbooks/build-the-playground.md | 33 +++++++++++++++++++++++++++ 2 files changed, 45 insertions(+) diff --git a/docs/changelog.md b/docs/changelog.md index a85f1253..872a7eea 100644 --- a/docs/changelog.md +++ b/docs/changelog.md @@ -19,6 +19,18 @@ docstring gives: it is a record, not a claim about now. ## 2026-11-13 +- **`gandalf` runs only the services the range uses.** The same audit found + `rpcbind` listening on `*:111` and `nfs-blkmap` running on a node with no + NFS storage. It also found `spiceproxy`, `postfix` and `unattended-upgrades` + running, and the repository named none of them. The firewall dropped + everything but 8006 and 22, so nothing was exposed. + `build-the-playground.md` §4 now has a table of every service on `gandalf` + and the reason it stays. It disables and masks the NFS client plumbing, and + it gives the `ss` read-back to expect. It records that `unattended-upgrades` + is how ADR-0017's "patched like any other host" happens for Debian's + packages. §7 adds a power-on check for Proxmox's own packages, which that + service does not cover. Not yet run on `gandalf`. + - **`ragnarok`'s outbound scope is a filter on the VM, as ADR-0014 decided.** ADR-0014 says the attack VM's "own outbound scope is limited on the VM itself, to `10.0.30.0/24` and the target subnet". A read-only audit of diff --git a/docs/runbooks/build-the-playground.md b/docs/runbooks/build-the-playground.md index 535c2064..7b2c8a26 100644 --- a/docs/runbooks/build-the-playground.md +++ b/docs/runbooks/build-the-playground.md @@ -582,6 +582,34 @@ stop`, wait for `PveFirewallDisabled` to fire (about fifteen minutes, with the five-minute timer), then `pve-firewall start` and watch it resolve. A rule that has never fired is a rule nobody knows can. +### Services on `gandalf`: only what the range uses + +A Proxmox install starts services the range never uses. The firewall drops +every port but 8006 and 22 from outside, so this is not a hole. But a port with +nothing behind it is one fewer thing for §4 to hold. What runs, and why: + +| Service | Listens on | Keep? | +| --- | --- | --- | +| `rpcbind` (socket and service), `nfs-blkmap`, `nfs-client.target` | `*:111` tcp and udp | **No.** These are NFS client plumbing, and `/etc/pve/storage.cfg` has no NFS storage: the range is the `range` ZFS pool. Disabled below | +| `pveproxy`, `sshd` | `*:8006`, `*:22` | Yes. They are what §4's four rules admit | +| `spiceproxy` | `*:3128` | Yes. It is part of `pve-manager` and serves the SPICE console. No rule admits 3128, so the firewall drops it from everywhere | +| `postfix` | loopback `:25` only | Yes. Proxmox sends its own mail through it. It is not reachable off the box | +| `unattended-upgrades` | nothing | Yes. It is how ADR-0017's "patched like any other host" happens on Debian's side, daily while the box is on. Its origins are Debian and Debian-Security only, so Proxmox's own packages are not in it: §7 checks them at power-on | + +Disable the NFS plumbing. `--now` stops it as well, and masking `rpcbind` +stops another package's dependency from starting it again: + +```bash +systemctl disable --now rpcbind.socket rpcbind.service nfs-blkmap.service nfs-client.target +systemctl mask rpcbind.socket rpcbind.service +ss -Hltun | awk '{print $1, $5}' | sort -u +``` + +The `ss` output should list `22`, `8006` and `3128` on all addresses, and +`25` and `85` on loopback only. `chronyd`'s `323` is also loopback only. +Nothing on `111` should remain. If NFS storage is ever added, unmask and +enable them first, or the mount will fail. + --- ## 5. The attack VM @@ -850,6 +878,11 @@ probe from `morpheus`, aimed at `10.0.30.30`, should give `8006 exit=1` and `control exit=0`. Any other answer means the session does not start until §4 has been rerun. +**Then check Proxmox's own updates.** `unattended-upgrades` covers Debian's +packages only (§4, *Services on `gandalf`*). `apt update && apt list +--upgradable` at power-on shows what is waiting from the Proxmox repository, +and `apt full-upgrade` applies it before the session starts, not during one. + --- ## 8. Check the four properties