tor: CachyOS CTR CookieAuth same FP (TODO=704)
This commit is contained in:
Hernâni Marques
parent
eb4349085d
commit
8370ad2e33
7 changed files with 164 additions and 7 deletions
13
2026/2026-10-21--castopod-php-stay-off.md
Normal file
13
2026/2026-10-21--castopod-php-stay-off.md
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
# Castopod stays off
|
||||
|
||||
Rechecked 2026-10-21 after the stop note. Web unit container-koopa-castopod.service is disabled, inactive, dead. Container koopa-castopod is exited, finished 2026-10-21 22:48:06 +0200. Nothing listens on :9020. MariaDB and Redis user units stay loaded and active. No second stop. Caddy vhost unchanged.
|
||||
|
||||
Log review found no sign of a successful remote code execution. Overlay file /tmp/fw-cp.php (1448 bytes, mode 600, sha256 7bb279bffa12dbb81787183108a2641b78a6657b069cbef7967950d80e13b5bc, mtime 2026-09-07 03:25:59 +0200) is a local database script for cp_users, outside the docroot, not a web shell. /tmp/os-dry.out is an apt dry-run. Five theme files differ by one branding line from 2026-07-13. Media volume has no scripts. Access logs run 2026-10-17 through the stop and show no 2xx on a non-index script. Critical lines on 2026-09-07 match other days.
|
||||
|
||||
Limits: access logs start 2026-10-17, so HTTP from 2026-09-07 is absent. A memory-only or already rotated request is not ruled out. Whether the local script ran is not in the logs. MariaDB was not opened.
|
||||
|
||||
Stays down until an image ships PHP newer than 8.4.18. Hub tag :1 from 2026-02-24 is not that image. Parent 537, slug castopod-restart-after-php-fix.
|
||||
|
||||
Restore only then:
|
||||
|
||||
systemctl --user enable --now container-koopa-castopod.service
|
||||
23
2026/2026-10-21--castopod-php-stop.md
Normal file
23
2026/2026-10-21--castopod-php-stop.md
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
# Castopod PHP stopped
|
||||
|
||||
Checked 2026-10-21. Host has no php-fpm and no php package. The only PHP process was Castopod FrankenPHP in container koopa-castopod.
|
||||
|
||||
| Item | Value |
|
||||
|------|--------|
|
||||
| image | docker.io/castopod/castopod:1 |
|
||||
| repo digest | sha256:4e4f0440520f45257bfeac7be4347defd20048b4efef8f53d73ec9ed3a4f7966 |
|
||||
| amd64 digest | sha256:757f3c2a96b31b81753c23bc092dfcf05039d9df4d13cc12c428bb752fce882b |
|
||||
| image created | 2026-02-24 |
|
||||
| hub tags 1 / latest / 1.15.5 | same digest, pushed 2026-02-24 |
|
||||
| PHP | 8.4.18 (12 Feb 2026) |
|
||||
| FrankenPHP | v2.10.2 |
|
||||
| listen | 0.0.0.0:9020 -> 8080 |
|
||||
| public | https://castopod.hacktivism.ch/ |
|
||||
|
||||
Stable Hub tags have not moved since 2026-02-24. develop last push 2026-06-05 and is not a stable security update. php.net lists 8.4.26 (24 Sep 2026) and 8.4.27 (22 Oct 2026) after 8.4.18, with a banner to update for critical remote code execution. Pulling :1 repeats the same image. FrankenPHP ships its own PHP binary.
|
||||
|
||||
Stopped and disabled user unit container-koopa-castopod.service. ExecStop is `podman stop -t 30 koopa-castopod`. Container status after stop: Exited (0). :9020 not listening. MariaDB and Redis units left running. Caddy vhost unchanged.
|
||||
|
||||
Bring the web container back only when a newer image exists:
|
||||
|
||||
systemctl --user enable --now container-koopa-castopod.service
|
||||
41
2026/2026-10-24--todo704-tor-cachyos-cookieauth.md
Normal file
41
2026/2026-10-24--todo704-tor-cachyos-cookieauth.md
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
# TODO=704 Tor CachyOS CTR + CookieAuth (koopa)
|
||||
|
||||
Relay was down (stale PIDFile / start-timeout on forking unit), keys intact. Recreated **same identity** on CachyOS container; CookieAuth for ControlPort; host tor disabled.
|
||||
|
||||
## Stand after APPLY (2026-10-24 ~21:47–21:51 Europe/Zurich)
|
||||
|
||||
| Item | Value |
|
||||
|------|--------|
|
||||
| CTR | `koopa-tor-relay` Up, image `localhost/koopa-tor-relay:latest` (=`:cachyos`) |
|
||||
| Tor | 0.4.9.14 (CachyOS/Arch extra) |
|
||||
| Unit | `container-koopa-tor-relay.service` Type=simple, active |
|
||||
| Host tor | `tor.service` disabled + failed/inactive |
|
||||
| FP | `02C7EECCDF7814FBA2DB1CBAED000D06E8A32EE8` (keys mtime 2024-11-14) |
|
||||
| ORPort | 8080 |
|
||||
| ControlPort | 127.0.0.1:9051 CookieAuthentication=1, CookieAuthFile=/var/lib/tor/control_auth_cookie |
|
||||
| Bootstrap | PROGRESS=100 done; status/circuit-established=1 |
|
||||
| Unauth ControlPort | 514 Authentication required |
|
||||
| Cookie AUTH | 250 OK |
|
||||
|
||||
## Steps
|
||||
|
||||
1. Dry-run `/tmp/tor.sh` on koopa → STATUS=dry-run-ok; NEXT=`sudo APPLY=1 /tmp/tor.sh` (host tor was still enabled).
|
||||
2. Human: `systemctl disable --now tor.service`, then `sudo APPLY=1 /tmp/tor.sh`.
|
||||
3. APPLY: wrote CachyOS Containerfile, pulled `docker.io/cachyos/cachyos:latest`, build (cache hit), `podman create --replace --network host --user 1000:1000 --userns keep-id`, torrc bak `torrc.bak-cookie-20261024-214720`, CookieAuth on.
|
||||
4. First APPLY hit dbus fail under sudo (`$DBUS_SESSION_BUS_ADDRESS` / `$XDG_RUNTIME_DIR` unset). Unit rewrite + enable finished with XDG/DBUS set; script path re-exec as SUDO_USER for later runs.
|
||||
5. Verify from magikoopa SSH: unit active, CTR Up, FP match, circuit-established=1, unauth 514.
|
||||
|
||||
## Live paths
|
||||
|
||||
- `~/koopa-tor-relay/{torrc,data,log,build/Containerfile}`
|
||||
- `~/.config/systemd/user/container-koopa-tor-relay.service`
|
||||
- Driver: `/tmp/tor.sh` (TARGET=koopa); upgrade later: `~/upgrade-containers.sh --apply --rebuild-local --only koopa-tor-relay`
|
||||
|
||||
## Akte mirrors
|
||||
|
||||
- `configs/tor/torrc`
|
||||
- `configs/tor/build/Containerfile`
|
||||
- `configs/systemd/user/container-koopa-tor-relay.service`
|
||||
- `host/tor/README.md` updated (was stale host `tor.service`)
|
||||
|
||||
Sibling: firecuda brew tor CookieAuth same day (FP `52BB94DDC1292F950CF728708AC48523E018A718`, MyFamily both ways). Parent TODO=704.
|
||||
Loading…
Add table
Add a link
Reference in a new issue