From 8eb34818317ba7b834642440d423210b9539d9ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ullrich=20Sch=C3=A4fer?= <hi+github@ullrich.is>
Date: Sun, 29 Mar 2026 22:32:30 +0200
Subject: [PATCH] Harden SSH: disable passwords, forwarding, add keepalive

Add SSH hardening to user_data for future server rebuilds:
- PasswordAuthentication no (key-only access)
- X11Forwarding no (headless server)
- AllowTcpForwarding no (no SSH tunnels needed)
- AllowAgentForwarding no (no agent forwarding needed)
- MaxAuthTries 3 (reduced from 6)
- ClientAliveInterval 300 + ClientAliveCountMax 2 (clean up dead sessions)

Already applied manually to the existing server via
/etc/ssh/sshd_config.d/99-hardening.conf.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 infrastructure/terraform/main.tf | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/infrastructure/terraform/main.tf b/infrastructure/terraform/main.tf
index 81b770b..98cb828 100644
--- a/infrastructure/terraform/main.tf
+++ b/infrastructure/terraform/main.tf
@@ -41,6 +41,18 @@ resource "hcloud_server" "trails" {
 
     # Create app directory
     mkdir -p /opt/trails-cool
+
+    # Harden SSH
+    cat > /etc/ssh/sshd_config.d/99-hardening.conf <<'SSHD'
+    PasswordAuthentication no
+    X11Forwarding no
+    AllowTcpForwarding no
+    AllowAgentForwarding no
+    MaxAuthTries 3
+    ClientAliveInterval 300
+    ClientAliveCountMax 2
+    SSHD
+    systemctl reload ssh
   EOF
 }