Merge "Make SSH bind to management net only"

diskimage-create/diskimage-create.sh

@@ -329,6 +329,7 @@ fi
 
 # Add the Octavia keepalived, Amphora Agent and Pyroute elements
 if [ "$AMP_BASEOS" = "ubuntu" ]; then
+    AMP_element_sequence="$AMP_element_sequence rebind-sshd"
     AMP_element_sequence="$AMP_element_sequence no-resolvconf"
     AMP_element_sequence="$AMP_element_sequence amphora-agent-ubuntu"
     AMP_element_sequence="$AMP_element_sequence pyroute2"

elements/rebind-sshd/README.rst

@@ -0,0 +1,8 @@
+This element adds a post-BOUND script to the dhclient configuration to rebind
+the ssh daemon to listen only on the management network interface.  The reason
+for doing this is that some use cases require load balancing services on TCP
+port 22 to work, and if SSH binds to the wildcard address on port 22, then
+haproxy can't.
+
+This also has the secondary benefit of making the amphora slightly more secure
+as its SSH daemon will only respond to requests on the management network.

elements/rebind-sshd/finalise.d/98-rebind-sshd-after-dhcp

@@ -0,0 +1,11 @@
+#!/bin/bash
+echo '#!/bin/sh
+if [ "$reason" = "BOUND" ]; then
+    if `grep -q "#ListenAddress 0.0.0.0" /etc/ssh/sshd_config`; then
+        /bin/sed -i "s/^#ListenAddress 0.0.0.0.*$/ListenAddress $new_ip_address/g" /etc/ssh/sshd_config
+        if `/bin/ps -ef|/bin/grep -v grep|/bin/grep -q sshd`; then
+            /usr/sbin/service ssh restart
+        fi
+    fi
+fi' > /etc/dhcp/dhclient-enter-hooks.d/rebind-sshd
+chmod +x /etc/dhcp/dhclient-enter-hooks.d/rebind-sshd