From c4c6a7f2c244bec91558086cd2921bb6dc837b56 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hern=C3=A2ni=20Marques?= Date: Thu, 16 Jul 2026 20:34:57 +0200 Subject: [PATCH] Update ISSUES for reboot apps mitigation and tor-relay clash. Mark Taler-apps post-reboot issue mitigated; document host vs container tor ports. --- ISSUES.md | 147 +++++++++++++++++++++++++++++------------------------- 1 file changed, 80 insertions(+), 67 deletions(-) diff --git a/ISSUES.md b/ISSUES.md index 2f70914..33f4f2a 100644 --- a/ISSUES.md +++ b/ISSUES.md @@ -1,24 +1,32 @@ # Open issues -As of **2026-07-16** (live scan on koopa). No secrets. +Stand **2026-07-16** (koopa, live). Keine Secrets. + +## Index + +| ID | Severity | Status | Kurz | +|----|----------|--------|------| +| [I-01](#i-2026-07-16-01) | high | open | firewalld: Nym-Ports unbestätigt | +| [I-02](#i-2026-07-16-02) | medium | open | Nym nicht bonded / nicht in Explorern | +| [I-03](#i-2026-07-16-03) | medium | mitigated | Taler-Apps nach Reboot | +| [I-04](#i-2026-07-16-04) | low | open | Stray `kind_taussig` | +| [I-05](#i-2026-07-16-05) | low | open | Alte exited Podman-Container | +| [I-06](#i-2026-07-16-06) | low–medium | open | Nym HTTP API `*:9080` | +| [I-07](#i-2026-07-16-07) | medium | **fixed** | Tor host vs `koopa-tor-relay` | --- -## I-2026-07-16-01 — firewalld: Nym ports on koopa unverified +### I-2026-07-16-01 -| | | -|--|--| -| **Severity** | high (for public Nym reachability) | -| **Host** | koopa | -| **Status** | open | +**firewalld: Nym-Ports auf koopa unbestätigt** +Severity: high · Host: koopa · Status: open -VeciGate DNATs **1789/tcp+udp**, **1790/tcp**, **51822/udp** → koopa. -Without matching **firewalld** allow rules on koopa, traffic dies on the host. +VeciGate DNAT **1789/tcp+udp**, **1790/tcp**, **51822/udp** → koopa. +Ohne passende **firewalld**-Allow-Regeln stirbt der Traffic am Host. -Agent could not run `firewall-cmd` (**sudo password required**). +Agent konnte `firewall-cmd` nicht ausführen (sudo-Passwort). ```bash -# on koopa (with sudo) sudo firewall-cmd --permanent --add-port=1789/tcp sudo firewall-cmd --permanent --add-port=1789/udp sudo firewall-cmd --permanent --add-port=1790/tcp @@ -29,98 +37,103 @@ sudo firewall-cmd --list-ports --- -## I-2026-07-16-02 — Nym node not bonded / not in public explorers +### I-2026-07-16-02 -| | | -|--|--| -| **Severity** | medium (visibility on the Nym network) | -| **Host** | koopa (`koopa-nym`) | -| **Status** | open | +**Nym-Node nicht bonded / nicht in öffentlichen Explorern** +Severity: medium · Host: koopa (`koopa-nym`) · Status: open -Container **is running** (mixnode); API on **9080** answers. -Without a **bond** in the Nym wallet the node typically does **not** show up in Harbour Master / network explorers (unlike Tor after ORPort publish). +Container läuft (mixnode); API auf **9080** antwortet. +Ohne **Bond** im Nym-Wallet erscheint der Node typischerweise nicht in Harbour Master / Explorern (anders als Tor nach ORPort-Publish). -See also: `configs/nym/PUBLIC-LISTING.md`. +Siehe `configs/nym/PUBLIC-LISTING.md`. -Logs: WARN `validator.nymtech.net/api/.../refresh-described` → **404** (API path/version; node still runs mixmode). +Logs: WARN `validator.nymtech.net/api/.../refresh-described` → **404** (API-Pfad; Node läuft trotzdem im Mixmode). **Identity key (public):** `55gPqeyHHj4CwpVZXLEQy9MjSvVTVXM8t2pMmNCH2MsW` --- -## I-2026-07-16-03 — `podman-restart.service` enabled, inactive this session +### I-2026-07-16-03 -| | | -|--|--| -| **Severity** | low (until reboot is tested) | -| **Host** | koopa (user hernani) | -| **Status** | open / expected until reboot | +**`podman-restart` / Taler-Apps nach Reboot** +Severity: medium → mitigated · Host: koopa (hernani) · Status: mitigated 2026-07-16 Abend -`systemctl --user is-enabled podman-restart` = **enabled**, -`is-active` = **inactive** (oneshot; has not run this boot session). +**Beobachtet:** Container up, aber Merchant/Bank nur `sleep infinity` → öffentlich **502** bis manuelles `start_base` / `start_*.sh`. -After reboot: +**Mitigation:** User-Units `taler-merchant-apps.service` / `taler-bank-apps.service` + `~/.local/bin/ensure-taler-apps.sh` +→ `2026/2026-07-16--reboot-recovery.md`. Nächster voller Reboot als Test. ```bash -systemctl --user is-active podman-restart.service -podman ps -a --filter should-start-on-boot=true --format '{{.Names}} {{.Status}}' +systemctl --user is-active podman-restart.service \ + taler-merchant-apps.service taler-bank-apps.service +~/.local/bin/ensure-taler-apps.sh status ``` --- -## I-2026-07-16-04 — Stray container `kind_taussig` +### I-2026-07-16-04 -| | | -|--|--| -| **Severity** | low (hygiene) | -| **Host** | koopa | -| **Status** | open | +**Stray-Container `kind_taussig`** +Severity: low · Host: koopa · Status: open -Container **Up** ~5 days: `kind_taussig` (`debian:bookworm-slim`), one-off wallet/DEB test script, **`restart=no`**, not a production name. - -Candidate to stop/remove when logs are no longer needed: +Container **Up** ~5 Tage: `kind_taussig` (`debian:bookworm-slim`), einmaliger Wallet/DEB-Test, `restart=no`, kein Prod-Name. ```bash -podman stop kind_taussig -podman rm kind_taussig +podman stop kind_taussig && podman rm kind_taussig ``` --- -## I-2026-07-16-05 — Old exited Podman containers (clutter) +### I-2026-07-16-05 -| | | -|--|--| -| **Severity** | low (hygiene) | -| **Host** | koopa | -| **Status** | open | +**Alte exited Podman-Container (Müll)** +Severity: low · Host: koopa · Status: open -Several **Exited** containers (months/years old), e.g. `pensive_dubinsky`, -`hardcore_edison`, `taler-exchange-no-network`, `debian00`, … -No autostart; only clutter `podman ps -a`. +Mehrere **Exited**-Container (Monate/Jahre), z. B. `pensive_dubinsky`, `hardcore_edison`, `taler-exchange-no-network`, `debian00`, … +Kein Autostart; nur Unordnung in `podman ps -a`. -Optional cleanup: `podman container prune` (exited only, after review). +Optional: `podman container prune` (nur exited, nach Review). --- -## I-2026-07-16-06 — Nym HTTP API listens on `*:9080` +### I-2026-07-16-06 -| | | -|--|--| -| **Severity** | low–medium (attack surface) | -| **Host** | koopa | -| **Status** | open (as configured in compose) | +**Nym HTTP-API lauscht auf `*:9080`** +Severity: low–medium · Host: koopa · Status: open (compose so konfiguriert) -`ss` shows **\*:9080** (rootlessport). **No** VeciGate DNAT for 9080. -Usually not reachable from WAN without NAT; reachable from LAN. +`ss` zeigt **\*:9080** (rootlessport). **Kein** VeciGate-DNAT für 9080 → WAN normalerweise nicht erreichbar; LAN ja. -Optional harden: publish only `127.0.0.1:9080:8080` in compose. +Härten optional: in compose nur `127.0.0.1:9080:8080` publishen. + +Hinweis: `nym-node` startet intern mit `--http-bind-address [::]:8080` (Container-intern). Öffentlich relevant ist das Host-Mapping **9080**, nicht WAN :8080 (das ist Tor OR). --- -## Not an issue (scan) +### I-2026-07-16-07 -- All production `should-start-on-boot` containers **Up** -- No failed user units -- Taler ports 9010–9015 respond (401/302 OK) -- Linger=yes, container-* units enabled +**`koopa-tor-relay` vs host `tor.service` (Port-Clash)** +Severity: medium · Host: koopa · Status: **fixed** 2026-07-16 + +**War:** Nach Reboot crash-loopte `koopa-tor-relay` — Host-`tor.service` hielt **8080**/**9051**. +**Soll:** nur Container (`KoopaRelay`, ORPort **8080**, VeciGate WAN→koopa:8080). + +**Fix:** Host-Tor gestoppt/disabled; ggf. hängenden Prozess gekillt; User-Unit: + +```bash +sudo systemctl disable --now tor +sudo systemctl mask tor # optional +systemctl --user enable --now container-koopa-tor-relay.service +ss -lntp | grep -E '8080|9051' +podman ps --filter name=koopa-tor-relay +``` + +**Live (nach Fix):** Host-`tor` inactive/disabled; `koopa-tor-relay` Up; 8080 + 127.0.0.1:9051 vom Relay-Prozess. + +--- + +## Kein Issue (Scan) + +- Prod-Container mit Boot-Autostart: Up +- Taler-Ports 9010–9015 antworten (401/302 OK) +- Linger=yes, container-*-Units enabled +- Tor-OR: Container-Pfad (I-07 fixed)