Description of Changes

• Fail2Ban is enabled on all VMs to protect against SSH brute-force attacks.
• A custom jail is configured to redirect SSH connections from banned IPs to the ssh-tarpit server on the net-vm, slowing down attackers by deliberately delaying their connections.
• On all other VMs, packets from banned IPs are dropped immediately.
• VMs allow a maximum of 5 ICMP request packets (ping) in a single burst per minute for each IP address.
• SSH sync flood protection has been activated for every VM. ( maximum 30 new ssh connection requests/minute)

Type of Change

• New Feature
• Bug Fix
• Improvement / Refactor

Related Issues / Tickets

Checklist

• Clear summary in PR description
• Detailed and meaningful commit message(s)
• Commits are logically organized and squashed if appropriate
• Contribution guidelines followed
• Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
• Author has run make-checks and it passes
• All automatic GitHub Action checks pass - see actions
• Author has added reviewers and removed PR draft status

Testing Instructions

Applicable Targets

• Orin AGX aarch64
• Orin NX aarch64
• Lenovo X1 x86_64
• Dell Latitude x86_64
• System 76 x86_64

Installation Method

• Requires full re-installation
• Can be updated with nixos-rebuild ... switch
• Other:

Test Steps To Verify:

Scenario - 1 (External Network - Netvm)

1. Regression test for network-related services
2. Check endless-go in net-vm whether it is activated with systemctl status endless-go
3. Attempt to establish an SSH connection, but enter the password incorrectly more than three times.
4. Check the blacklist on the net-vm by using the command ipset list f2b-blacklist. You should see the attacker's IP address listed in the members section.
5. Try to make an SSH connection again from the attacker's device. The connection should hang.

Scenario - 2 (VM - VM)

1. Attempt to establish a VM-to-VM SSH connection, such as comms-vm to gui-vm, but enter the password incorrectly more than three times.
2. Check the blacklist on the gui-vm by using the command ipset list f2b-blacklist. You should see the comms-vm IP address listed in the members section.
3. Try to make an SSH connection again from the comms-vm to gui-vm. The connection should hang.
4. You can also try other combinations. (chrome-vm to admin-vm)

Scenario - 3 (SSH sync flood protection, Icmp flood protection)

1. Ping the VMs; however, you cannot send more than five pings in a single burst. You can ping them once every minute.
2. Launch an attack(VM-to-VM or External Network-to-Netvm) using the command hping3 -S -p 22 -i u10000 -c 35 ${VmIp}
3. Check the blacklist on the victim VM with ipset list BLACKLIST. You should see attacker's IP in the members section.

Note: The device under test must be in its default state before each test scenario.(Can be rebooted)