Re: [PATCH v1 0/6] Enable users to set an alternate ssh port

On 10/2/25 8:50 PM, Luis Chamberlain wrote:
> On Thu, Oct 02, 2025 at 04:21:34PM -0400, Chuck Lever wrote:
>> From: Chuck Lever <[email protected]>
>>
>> Particularly in the cloud, provisioning publicly visible instances
>> with port 22 for ssh is bad security practice. Almost as soon as
>> kdevops brings up such an instance, it comes under attack on port
>> 22.
>>
>> So, my thought is to enable the use of an alternate port for Ansible
>> control. This series provides that flexibility; the default is still
>> to use port 22.
>>
>> I've tested this with RHEL 9 on AWS, Azure, GCE, and OCI, and with
>> Debian 12 on AWS; and I tested with Fedora and guestfs.
>>
>> One of the side benefits of this series is that now all of the
>> cloud providers except Lambda make use of a cloud-init script. We
>> can introduce additional capabilities there, going forward.
>>
>> Also pushed to the linux-kdevops/kdevops alternate-ssh-port branch.
> 
> This is awesome security best practice, thanks! For cloud providers
> which support it, why don't we just make it a default?
My impression is that they all support it, but I haven't tested
OpenStack or Lambda Labs because I don't have tenancies for those
providers/stacks (also haven't tested Nixos).

Let me think about how to deal with the OCI "use an existing VCN"
setting, where the existing VCN likely has a security rule specific
to port 22.

I can merge this series as is then follow up with one or two patches to
change the default ssh port when I figure that out.

-- 
Chuck Lever