USAGE.md

@@ -1067,7 +1067,6 @@ sudo env \
   UVM_BRIDGE='uvm50' \
   UVM_FIRECRACKER_SHA256='<sha256-of-firecracker-archive>' \
   UVM_KERNEL_SHA256='<sha256-of-vmlinux>' \
-  UVM_ROOTFS_SHA256='<sha256-of-rootfs>' \
   ./uvm.py install
 ```
 
@@ -1086,10 +1085,10 @@ automatically detects every conflict with host routes or other managers.
 | `UVM_BRIDGE` | Linux bridge name; default `uvm0` |
 | `UVM_KNOWN_HOSTS_FILES` | Override deletion's local SSH cache files; colon-separated absolute paths |
 | `UVM_KERNEL_URL` | Override the host-architecture default kernel URL |
-| `UVM_ROOTFS_URL` | Override the host-architecture default rootfs URL |
+| `UVM_ROOTFS_URL` | Optional prebuilt ext4 URL; unset to build Ubuntu 22.04 locally |
 | `UVM_FIRECRACKER_SHA256` | Strict Firecracker archive checksum |
 | `UVM_KERNEL_SHA256` | Strict kernel checksum |
-| `UVM_ROOTFS_SHA256` | Strict rootfs checksum |
+| `UVM_ROOTFS_SHA256` | Strict prebuilt rootfs checksum, used with `UVM_ROOTFS_URL` |
 | `UVM_FIRECRACKER_BINARY_SHA256` | Optional local binary checksum |
 | `UVM_ALLOW_UNVERIFIED_DOWNLOADS` | Set to `1` only for local development |
 | `UVM_API_TOKEN` | Required API token |

tests/test_images.py

@@ -143,6 +143,31 @@ class ImageStoreTests(unittest.TestCase):
         self.assertLess(updated.index("Match User codemate-user"), updated.index("Match Group restricted"))
         self.assertIn("Match Group restricted\n    X11Forwarding no", updated)
 
+    @unittest.skipUnless(
+        shutil.which("sshd") and shutil.which("ssh-keygen") and Path("/run/sshd").is_dir(),
+        "OpenSSH server tools and the privilege-separation directory are required",
+    )
+    def test_openssh_accepts_the_full_config_and_limits_password_auth_to_the_guest_user(self) -> None:
+        runner = CommandRunner(emit=None)
+        with tempfile.TemporaryDirectory() as temporary:
+            key = Path(temporary) / "host_key"
+            runner.run(("ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-f", key), capture=True)
+            contents = _enable_ssh_password_authentication(
+                "UsePAM yes\nSubsystem sftp internal-sftp\nPermitRootLogin no\n",
+                "codemate-user",
+            )
+            for key_type in ("rsa", "ecdsa", "ed25519"):
+                contents = contents.replace(f"/etc/ssh/ssh_host_{key_type}_key", str(key))
+            config = Path(temporary) / "sshd_config"
+            config.write_text(contents, encoding="utf-8")
+            for username, expected in (("codemate-user", "yes"), ("root", "no")):
+                with self.subTest(username=username):
+                    result = runner.run((
+                        shutil.which("sshd"), "-T", "-f", config,
+                        "-C", f"user={username},host=localhost,addr=127.0.0.1",
+                    ), capture=True)
+                    self.assertIn(f"passwordauthentication {expected}\n", result.stdout)
+
     def test_removes_only_the_public_firecracker_demo_key(self) -> None:
         own_key = "ssh-ed25519 AAAA-own-key developer@example"
 
@@ -325,6 +350,11 @@ class OfflineGuestCredentialsTests(unittest.TestCase):
         self.assertIn("Defaults:codemate-user !rootpw, !runaspw, !targetpw\n", self.contents("/etc/sudoers"))
         self.assert_metadata("/etc/sudoers", 0o440, 0, 0)
         self.assert_metadata("/usr/bin/sudo", 0o4755, 0, 0)
+        if shutil.which("visudo"):
+            sudoers = self.base / "sudoers"
+            sudoers.write_text(self.contents("/etc/sudoers"), encoding="utf-8")
+            sudoers.chmod(0o440)
+            self.runner.run(("visudo", "-c", "-f", sudoers), capture=True)
         for guest_path in ("/etc/passwd", "/etc/group"):
             self.assert_metadata(guest_path, 0o644, 0, 0)
         for guest_path in ("/etc/shadow", "/etc/gshadow"):

uvm/dashboard/static/index.html

@@ -193,7 +193,7 @@
           <form id="create-form" class="create-layout">
             <div class="create-fields"><section class="soft-panel form-section"><header class="section-heading"><div><h2><span class="step-number">01</span>A name and a little space</h2><span>Give your new machine a shape.</span></div></header><label class="field" for="create-name"><span>Machine name <small>Optional</small></span><input id="create-name" type="text" name="name" placeholder="e.g. my-little-server" pattern="[a-z][a-z0-9\-]{0,62}" maxlength="63" autocomplete="off" /></label><fieldset class="preset-fieldset"><legend>Start with a size</legend><div class="size-presets"><button class="size-preset active" type="button" data-preset="small" aria-pressed="true"><svg class="icon"><use href="#i-server"/></svg><strong>Small</strong><span>1 vCPU · 512 MiB</span></button><button class="size-preset" type="button" data-preset="balanced" aria-pressed="false"><svg class="icon"><use href="#i-server"/></svg><strong>Balanced</strong><span>2 vCPU · 1 GiB</span></button><button class="size-preset" type="button" data-preset="roomy" aria-pressed="false"><svg class="icon"><use href="#i-server"/></svg><strong>Roomy</strong><span>4 vCPU · 2 GiB</span></button></div></fieldset><div class="form-grid"><label class="field" for="create-cpu"><span>CPU capacity</span><input id="create-cpu" name="cpu" type="number" value="1" min="0.01" step="any" required /><small>Fractional requests round up to whole vCPUs.</small></label><label class="field" for="create-ram"><span>Memory</span><input id="create-ram" name="ram" type="text" value="512M" required /><small>At least 128 MiB. Try 512M, 1G, or 2G.</small></label></div></section>
             <section class="soft-panel form-section"><label class="field" for="create-storage"><span>Private storage</span><input id="create-storage" name="storage" type="text" value="30G" required /><small>Minimum 30 GiB. Try 30G, 50G, or 1T. You can resize this disk later.</small></label></section>
-            <section class="soft-panel form-section"><header class="section-heading"><div><h2><span class="step-number">02</span>A way to connect</h2><span>Private networking and guest access.</span></div></header><label class="field" for="create-guest-ip"><span>Guest IPv4 address <small>Optional</small></span><input id="create-guest-ip" name="guest_ip" type="text" placeholder="Automatically assigned" autocomplete="off" /></label><div class="form-grid"><label class="field" for="create-username"><span>Guest user</span><input id="create-username" name="username" type="text" value="root" autocomplete="username" required /></label><label class="field" for="create-password"><span>Guest password</span><span class="password-field"><input id="create-password" name="password" type="password" value="root" autocomplete="new-password" maxlength="128" required /><button class="icon-button" type="button" data-action="toggle-password" aria-label="Show password" aria-pressed="false"><svg class="icon"><use href="#i-eye"/></svg></button></span></label></div><p class="panel-footnote">Missing users are created with a home directory. Credentials are applied to the machine’s private disk.</p></section>
+            <section class="soft-panel form-section"><header class="section-heading"><div><h2><span class="step-number">02</span>A way to connect</h2><span>Private networking and guest access.</span></div></header><label class="field" for="create-guest-ip"><span>Guest IPv4 address <small>Optional</small></span><input id="create-guest-ip" name="guest_ip" type="text" placeholder="Automatically assigned" autocomplete="off" /></label><div class="form-grid"><label class="field" for="create-username"><span>Guest user</span><input id="create-username" name="username" type="text" value="root" autocomplete="username" required /></label><label class="field" for="create-password"><span>Guest password</span><span class="password-field"><input id="create-password" name="password" type="password" value="root" autocomplete="new-password" maxlength="128" required /><button class="icon-button" type="button" data-action="toggle-password" aria-label="Show password" aria-pressed="false"><svg class="icon"><use href="#i-eye"/></svg></button></span></label></div><p class="panel-footnote">Missing users are created with a home directory and sudo access using their guest password. Credentials are applied to the machine’s private disk.</p></section>
             <section class="soft-panel form-section"><header class="section-heading"><div><h2><span class="step-number">03</span>Open the right doors</h2><span>Choose which private TCP services are allowed.</span></div></header><label class="toggle-field"><span><strong>Include the default SSH rule</strong><small>Allow TCP port 22 for terminal access.</small></span><input id="create-default-ssh" name="default_ssh" type="checkbox" checked /><span class="toggle-track" aria-hidden="true"></span></label><label class="field" for="create-ports"><span>Additional port rules <small>Optional</small></span><input id="create-ports" name="ports" type="text" placeholder="80:HTTP, 443:HTTPS" spellcheck="false" /><small>Separate rules with commas. HTTP and HTTPS both use TCP.</small></label></section></div>
             <aside class="create-summary soft-panel"><div class="summary-art" aria-hidden="true"><div></div><div></div><span><svg class="icon"><use href="#i-server"/></svg></span></div><span class="subtle-label">Your next little machine</span><h2 id="create-summary-name">Room for an idea.</h2><p>A private disk, a network identity,<br />and a fresh start.</p><dl id="create-summary-details" class="detail-list"></dl><p id="create-error" class="form-error" role="alert"></p><button id="create-submit" class="button button-primary button-wide" type="submit"><span>Create machine</span><svg class="icon"><use href="#i-arrow"/></svg></button><a href="#vms" class="quiet-link summary-cancel">Maybe later</a><span class="summary-note"><svg class="icon"><use href="#i-spark"/></svg>Built on Firecracker</span></aside>
           </form>
@@ -202,7 +202,7 @@
         <section id="page-system" class="page" aria-labelledby="system-heading" hidden>
           <div class="page-heading"><div><span class="subtle-label">Behind every little machine</span><h1 id="system-heading" tabindex="-1">A look at your host<span class="heading-period">.</span></h1></div><button id="diagnostics-refresh-btn" class="button" type="button" data-action="diagnostics"><svg class="icon"><use href="#i-refresh"/></svg>Run checks</button></div>
           <div id="health-summary" class="compact-metrics"></div>
-          <div class="health-layout"><article class="soft-panel diagnostics-panel"><header class="section-heading"><div><h2>The essentials, checked</h2><span>Readiness checks from your local host.</span></div><span id="diagnostics-count" class="tag">Checking</span></header><div id="diagnostics-list" class="diagnostics-list"><div class="loading-state">Checking in with your host…</div></div></article><div class="health-side"><article class="soft-panel install-panel"><span class="round-icon"><svg class="icon"><use href="#i-download"/></svg></span><h2>A foundation for your fleet</h2><p>Install the Firecracker binary, guest kernel, and root filesystem, ready for your next machine.</p><div class="install-assets"><span><svg class="icon"><use href="#i-cpu"/></svg>Firecracker</span><span><svg class="icon"><use href="#i-terminal"/></svg>Guest kernel</span><span><svg class="icon"><use href="#i-server"/></svg>Root filesystem</span></div><label class="toggle-field"><span><strong>Refresh existing assets</strong><small>Reinstall with force enabled.</small></span><input id="install-force" type="checkbox" /><span class="toggle-track" aria-hidden="true"></span></label><button id="install-btn" class="button button-primary button-wide" type="button" data-action="install"><span>Install assets</span><svg class="icon"><use href="#i-arrow"/></svg></button><pre id="install-result" class="install-result" role="status" hidden></pre></article><article class="soft-panel server-info"><header class="section-heading"><h2>Close to home</h2><svg class="icon caption-icon"><use href="#i-network"/></svg></header><dl class="detail-list"><div><dt>API origin</dt><dd id="info-api-url"></dd></div><div><dt>Last host check</dt><dd id="info-observed">Not checked yet</dd></div><div><dt>Connection</dt><dd>Session token</dd></div></dl><a href="/docs" target="_blank" rel="noopener" class="quiet-link">Open API reference <svg class="icon"><use href="#i-arrow"/></svg></a></article></div></div>
+          <div class="health-layout"><article class="soft-panel diagnostics-panel"><header class="section-heading"><div><h2>The essentials, checked</h2><span>Readiness checks from your local host.</span></div><span id="diagnostics-count" class="tag">Checking</span></header><div id="diagnostics-list" class="diagnostics-list"><div class="loading-state">Checking in with your host…</div></div></article><div class="health-side"><article class="soft-panel install-panel"><span class="round-icon"><svg class="icon"><use href="#i-download"/></svg></span><h2>A foundation for your fleet</h2><p>Install Firecracker, a guest kernel, and a root filesystem. The default Ubuntu 22.04 image includes SSH, sudo, and apt.</p><div class="install-assets"><span><svg class="icon"><use href="#i-cpu"/></svg>Firecracker</span><span><svg class="icon"><use href="#i-terminal"/></svg>Guest kernel</span><span><svg class="icon"><use href="#i-server"/></svg>Root filesystem</span></div><label class="toggle-field"><span><strong>Refresh existing assets</strong><small>Refresh downloads and rebuild the Ubuntu image.</small></span><input id="install-force" type="checkbox" /><span class="toggle-track" aria-hidden="true"></span></label><button id="install-btn" class="button button-primary button-wide" type="button" data-action="install"><span>Install assets</span><svg class="icon"><use href="#i-arrow"/></svg></button><pre id="install-result" class="install-result" role="status" hidden></pre></article><article class="soft-panel server-info"><header class="section-heading"><h2>Close to home</h2><svg class="icon caption-icon"><use href="#i-network"/></svg></header><dl class="detail-list"><div><dt>API origin</dt><dd id="info-api-url"></dd></div><div><dt>Last host check</dt><dd id="info-observed">Not checked yet</dd></div><div><dt>Connection</dt><dd>Session token</dd></div></dl><a href="/docs" target="_blank" rel="noopener" class="quiet-link">Open API reference <svg class="icon"><use href="#i-arrow"/></svg></a></article></div></div>
         </section>
       </main>
     </div>

uvm/images.py

@@ -253,8 +253,10 @@ class ImageStore:
         owner = _OWNER_PATTERN.search(sudo.stdout)
         if (
             sudoers is None
+            or sudoers.uid != 0 or sudoers.mode & 0o022
             or re.search(r"Type:\s+regular\b", sudo.stdout) is None
             or mode is None or not int(mode.group(1), 8) & 0o4000
+            or not int(mode.group(1), 8) & 0o111
             or owner is None or int(owner.group(1)) != 0
         ):
             raise UvmError(

uvm/install.py

@@ -204,6 +204,13 @@ class Installer:
                 label="guest kernel",
                 environment_name="UVM_KERNEL_SHA256",
             )
+        verify_file(
+            kernel,
+            self._settings.kernel_sha256,
+            "guest kernel",
+            "UVM_KERNEL_SHA256",
+            allow_unverified=self._settings.allow_unverified_downloads,
+        )
         if not self._settings.rootfs_url:
             self._install_ubuntu_rootfs(rootfs, force=force)
         elif force or not rootfs.exists():
@@ -214,13 +221,6 @@ class Installer:
                 label="guest root filesystem",
                 environment_name="UVM_ROOTFS_SHA256",
             )
-        verify_file(
-            kernel,
-            self._settings.kernel_sha256,
-            "guest kernel",
-            "UVM_KERNEL_SHA256",
-            allow_unverified=self._settings.allow_unverified_downloads,
-        )
         if self._settings.rootfs_url:
             verify_file(
                 rootfs,