feat(hardening): add sshd_config hardening page

New /hardening page for generating hardened sshd_config:
- Presets: Paranoico (A+), Equilibrado (A), Permissivo (B)
- Security score (0-100) with A-F grade and color-coded bar
- Warnings: danger/warn/info for risky options
- Grouped form: Autenticação, Controle de Acesso, Rede, Segurança, Banners
- Live preview of sshd_config with section comments in PT-BR
- Download sshd_config and apply script (bash with backup + sshd -t)
- Copy to clipboard

New libs: sshd-generator.ts, sshd-options.ts (25 new tests, 107 total)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: luizomf

src/layouts/Base.astro

@@ -10,7 +10,7 @@ const currentPath = Astro.url.pathname;
 const navItems = [
   { href: '/', label: 'Home', disabled: false },
   { href: '/tunnels/', label: 'Tunnels', disabled: false },
-  { href: '/hardening/', label: 'Hardening', disabled: true },
+  { href: '/hardening/', label: 'Hardening', disabled: false },
   { href: '/config/', label: 'Config', disabled: false },
   { href: '/keygen/', label: 'KeyGen', disabled: true },
 ];

src/lib/__tests__/sshd-generator.test.ts

@@ -0,0 +1,226 @@
+import { describe, it, expect } from 'vitest';
+import { generateSshdConfig, generateApplyScript } from '../sshd-generator';
+import { getPreset, calculateSecurityScore } from '../sshd-options';
+import type { SshdConfig } from '../types';
+
+function getParanoid(): SshdConfig {
+  return getPreset('paranoid');
+}
+
+describe('generateSshdConfig', () => {
+  it('generates header comments', () => {
+    const result = generateSshdConfig(getParanoid());
+    expect(result).toContain('gerado por SSH Toolkit');
+    expect(result).toContain('sshtoolkit.otaviomiranda.com.br');
+  });
+
+  it('generates paranoid defaults correctly', () => {
+    const result = generateSshdConfig(getParanoid());
+    expect(result).toContain('Port 22');
+    expect(result).toContain('PermitRootLogin no');
+    expect(result).toContain('PubkeyAuthentication yes');
+    expect(result).toContain('PasswordAuthentication no');
+    expect(result).toContain('KbdInteractiveAuthentication no');
+    expect(result).toContain('ChallengeResponseAuthentication no');
+    expect(result).toContain('PermitEmptyPasswords no');
+    expect(result).toContain('AuthenticationMethods publickey');
+    expect(result).toContain('MaxAuthTries 3');
+    expect(result).toContain('LoginGraceTime 30');
+    expect(result).toContain('X11Forwarding no');
+    expect(result).toContain('AllowAgentForwarding no');
+    expect(result).toContain('AllowTcpForwarding no');
+    expect(result).toContain('AllowStreamLocalForwarding no');
+    expect(result).toContain('GatewayPorts no');
+    expect(result).toContain('PermitTunnel no');
+    expect(result).toContain('PermitUserEnvironment no');
+    expect(result).toContain('PermitUserRC no');
+    expect(result).toContain('StrictModes yes');
+    expect(result).toContain('ClientAliveInterval 300');
+    expect(result).toContain('ClientAliveCountMax 2');
+    expect(result).toContain('UseDNS no');
+    expect(result).toContain('UsePAM yes');
+    expect(result).toContain('LogLevel VERBOSE');
+    expect(result).toContain('PrintMotd no');
+    expect(result).toContain('PrintLastLog yes');
+    expect(result).toContain('MaxSessions 5');
+    expect(result).toContain('MaxStartups 10:30:60');
+  });
+
+  it('generates balanced preset', () => {
+    const result = generateSshdConfig(getPreset('balanced'));
+    expect(result).toContain('AllowTcpForwarding yes');
+    expect(result).toContain('MaxAuthTries 4');
+    expect(result).toContain('MaxSessions 10');
+  });
+
+  it('generates permissive preset', () => {
+    const result = generateSshdConfig(getPreset('permissive'));
+    expect(result).toContain('PermitRootLogin prohibit-password');
+    expect(result).toContain('X11Forwarding yes');
+    expect(result).toContain('AllowAgentForwarding yes');
+    expect(result).toContain('GatewayPorts clientspecified');
+    expect(result).toContain('PermitTunnel yes');
+    expect(result).toContain('PrintMotd yes');
+  });
+
+  it('includes custom port', () => {
+    const config = { ...getParanoid(), port: 2222 };
+    const result = generateSshdConfig(config);
+    expect(result).toContain('Port 2222');
+  });
+
+  it('includes listen addresses', () => {
+    const config = { ...getParanoid(), listenAddress: '0.0.0.0 ::' };
+    const result = generateSshdConfig(config);
+    expect(result).toContain('ListenAddress 0.0.0.0');
+    expect(result).toContain('ListenAddress ::');
+  });
+
+  it('omits listen address when empty', () => {
+    const result = generateSshdConfig(getParanoid());
+    expect(result).not.toContain('ListenAddress');
+  });
+
+  it('includes address family when not any', () => {
+    const config = { ...getParanoid(), addressFamily: 'inet' as const };
+    const result = generateSshdConfig(config);
+    expect(result).toContain('AddressFamily inet');
+  });
+
+  it('omits address family when any', () => {
+    const result = generateSshdConfig(getParanoid());
+    expect(result).not.toContain('AddressFamily');
+  });
+
+  it('includes access control directives', () => {
+    const config = {
+      ...getParanoid(),
+      allowUsers: 'deploy admin',
+      allowGroups: 'ssh-users',
+      denyUsers: 'root',
+      denyGroups: 'nogroup',
+    };
+    const result = generateSshdConfig(config);
+    expect(result).toContain('AllowUsers deploy admin');
+    expect(result).toContain('AllowGroups ssh-users');
+    expect(result).toContain('DenyUsers root');
+    expect(result).toContain('DenyGroups nogroup');
+    expect(result).toContain('Controle de Acesso');
+  });
+
+  it('omits access control section when empty', () => {
+    const result = generateSshdConfig(getParanoid());
+    expect(result).not.toContain('AllowUsers');
+    expect(result).not.toContain('Controle de Acesso');
+  });
+
+  it('includes banner when set', () => {
+    const config = { ...getParanoid(), banner: '/etc/ssh/banner.txt' };
+    const result = generateSshdConfig(config);
+    expect(result).toContain('Banner /etc/ssh/banner.txt');
+  });
+
+  it('omits Banner directive when empty', () => {
+    const result = generateSshdConfig(getParanoid());
+    expect(result).not.toMatch(/^Banner /m);
+  });
+});
+
+describe('calculateSecurityScore', () => {
+  it('gives A grade to paranoid preset', () => {
+    const { score, grade, warnings } = calculateSecurityScore(getParanoid());
+    expect(grade).toBe('A');
+    expect(score).toBeGreaterThanOrEqual(90);
+    // Only info-level warnings for paranoid
+    const dangerWarnings = warnings.filter((w) => w.severity === 'danger');
+    expect(dangerWarnings).toHaveLength(0);
+  });
+
+  it('penalizes root login yes', () => {
+    const config = { ...getParanoid(), permitRootLogin: 'yes' as const };
+    const { score, warnings } = calculateSecurityScore(config);
+    expect(score).toBeLessThan(80);
+    expect(warnings.some((w) => w.message.includes('Root login'))).toBe(true);
+  });
+
+  it('penalizes password authentication', () => {
+    const config = { ...getParanoid(), passwordAuthentication: true };
+    const { warnings } = calculateSecurityScore(config);
+    expect(warnings.some((w) => w.message.includes('senha') && w.severity === 'danger')).toBe(true);
+  });
+
+  it('penalizes disabled pubkey auth', () => {
+    const config = { ...getParanoid(), pubkeyAuthentication: false };
+    const { score } = calculateSecurityScore(config);
+    expect(score).toBeLessThan(75);
+  });
+
+  it('penalizes empty passwords', () => {
+    const config = { ...getParanoid(), permitEmptyPasswords: true };
+    const { warnings } = calculateSecurityScore(config);
+    expect(warnings.some((w) => w.message.includes('vazias'))).toBe(true);
+  });
+
+  it('warns about x11 forwarding', () => {
+    const config = { ...getParanoid(), x11Forwarding: true };
+    const { warnings } = calculateSecurityScore(config);
+    expect(warnings.some((w) => w.message.includes('X11'))).toBe(true);
+  });
+
+  it('warns about gateway ports yes', () => {
+    const config = { ...getParanoid(), gatewayPorts: 'yes' as const };
+    const { warnings } = calculateSecurityScore(config);
+    expect(warnings.some((w) => w.message.includes('GatewayPorts'))).toBe(true);
+  });
+
+  it('gives F grade to worst case', () => {
+    const config: SshdConfig = {
+      ...getParanoid(),
+      permitRootLogin: 'yes',
+      passwordAuthentication: true,
+      pubkeyAuthentication: false,
+      permitEmptyPasswords: true,
+      x11Forwarding: true,
+      allowAgentForwarding: true,
+      gatewayPorts: 'yes',
+      permitTunnel: true,
+      permitUserEnvironment: true,
+      maxAuthTries: 10,
+    };
+    const { grade } = calculateSecurityScore(config);
+    expect(grade).toBe('F');
+  });
+
+  it('gives balanced preset a good score', () => {
+    const { grade } = calculateSecurityScore(getPreset('balanced'));
+    expect(['A', 'B']).toContain(grade);
+  });
+
+  it('gives permissive preset a lower score', () => {
+    const { score } = calculateSecurityScore(getPreset('permissive'));
+    expect(score).toBeLessThan(90);
+  });
+});
+
+describe('getPreset', () => {
+  it('returns different configs per preset', () => {
+    const paranoid = getPreset('paranoid');
+    const balanced = getPreset('balanced');
+    const permissive = getPreset('permissive');
+
+    expect(paranoid.allowTcpForwarding).toBe(false);
+    expect(balanced.allowTcpForwarding).toBe(true);
+    expect(permissive.x11Forwarding).toBe(true);
+  });
+});
+
+describe('generateApplyScript', () => {
+  it('generates a bash script', () => {
+    const script = generateApplyScript();
+    expect(script).toContain('#!/bin/bash');
+    expect(script).toContain('sshd -t');
+    expect(script).toContain('sshd_config.bak');
+    expect(script).toContain('systemctl');
+    expect(script).toContain('launchctl');
+  });
+});

src/lib/sshd-generator.ts

@@ -0,0 +1,127 @@
+import type { SshdConfig } from './types';
+
+function line(key: string, value: string | number | boolean): string {
+  if (typeof value === 'boolean') {
+    return `${key} ${value ? 'yes' : 'no'}`;
+  }
+  return `${key} ${value}`;
+}
+
+export function generateSshdConfig(config: SshdConfig): string {
+  const lines: string[] = [];
+
+  lines.push('# ============================================================');
+  lines.push('# sshd_config — gerado por SSH Toolkit');
+  lines.push('# https://sshtoolkit.otaviomiranda.com.br');
+  lines.push('# ============================================================');
+  lines.push('');
+
+  // Basic Authentication
+  lines.push('# --- Autenticação ---');
+  lines.push(line('Port', config.port));
+
+  if (config.listenAddress) {
+    for (const addr of config.listenAddress.split(/[,\s]+/).filter(Boolean)) {
+      lines.push(line('ListenAddress', addr));
+    }
+  }
+
+  if (config.addressFamily !== 'any') {
+    lines.push(line('AddressFamily', config.addressFamily));
+  }
+
+  lines.push(line('PermitRootLogin', config.permitRootLogin));
+  lines.push(line('PubkeyAuthentication', config.pubkeyAuthentication));
+  lines.push(line('PasswordAuthentication', config.passwordAuthentication));
+  lines.push(line('KbdInteractiveAuthentication', config.kbdInteractiveAuthentication));
+  lines.push(line('ChallengeResponseAuthentication', config.challengeResponseAuthentication));
+  lines.push(line('PermitEmptyPasswords', config.permitEmptyPasswords));
+
+  if (config.authenticationMethods) {
+    lines.push(line('AuthenticationMethods', config.authenticationMethods));
+  }
+
+  lines.push(line('MaxAuthTries', config.maxAuthTries));
+  lines.push(line('LoginGraceTime', config.loginGraceTime));
+  lines.push(line('UsePAM', config.usePAM));
+
+  // Access Control
+  if (config.allowUsers || config.allowGroups || config.denyUsers || config.denyGroups) {
+    lines.push('');
+    lines.push('# --- Controle de Acesso ---');
+    if (config.allowUsers) lines.push(line('AllowUsers', config.allowUsers));
+    if (config.allowGroups) lines.push(line('AllowGroups', config.allowGroups));
+    if (config.denyUsers) lines.push(line('DenyUsers', config.denyUsers));
+    if (config.denyGroups) lines.push(line('DenyGroups', config.denyGroups));
+  }
+
+  // Security
+  lines.push('');
+  lines.push('# --- Segurança ---');
+  lines.push(line('X11Forwarding', config.x11Forwarding));
+  lines.push(line('AllowAgentForwarding', config.allowAgentForwarding));
+  lines.push(line('AllowTcpForwarding', config.allowTcpForwarding));
+  lines.push(line('AllowStreamLocalForwarding', config.allowStreamLocalForwarding));
+  lines.push(line('GatewayPorts', config.gatewayPorts));
+  lines.push(line('PermitTunnel', config.permitTunnel));
+  lines.push(line('PermitUserEnvironment', config.permitUserEnvironment));
+  lines.push(line('PermitUserRC', config.permitUserRC));
+  lines.push(line('StrictModes', config.strictModes));
+
+  // Sessions & Limits
+  lines.push('');
+  lines.push('# --- Sessões e Limites ---');
+  lines.push(line('MaxSessions', config.maxSessions));
+  lines.push(line('MaxStartups', config.maxStartups));
+  lines.push(line('ClientAliveInterval', config.clientAliveInterval));
+  lines.push(line('ClientAliveCountMax', config.clientAliveCountMax));
+  lines.push(line('UseDNS', config.useDNS));
+  lines.push(line('LogLevel', config.logLevel));
+
+  // Banners
+  lines.push('');
+  lines.push('# --- Banners ---');
+  lines.push(line('PrintMotd', config.printMotd));
+  lines.push(line('PrintLastLog', config.printLastLog));
+
+  if (config.banner) {
+    lines.push(line('Banner', config.banner));
+  }
+
+  lines.push('');
+  return lines.join('\n');
+}
+
+export function generateApplyScript(): string {
+  return `#!/bin/bash
+# Script para aplicar o sshd_config gerado
+# Execute com: sudo bash apply-sshd.sh
+
+set -e
+
+echo "Fazendo backup do sshd_config atual..."
+sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
+
+echo "Copiando novo sshd_config..."
+sudo cp sshd_config /etc/ssh/sshd_config
+
+echo "Testando configuração..."
+sudo sshd -t
+
+if [ $? -eq 0 ]; then
+  echo "Configuração válida. Reiniciando sshd..."
+  if command -v systemctl &> /dev/null; then
+    sudo systemctl restart sshd
+  elif command -v launchctl &> /dev/null; then
+    sudo launchctl kickstart -k system/com.openssh.sshd
+  else
+    sudo service sshd restart
+  fi
+  echo "sshd reiniciado com sucesso!"
+else
+  echo "ERRO: configuração inválida. Restaurando backup..."
+  sudo cp /etc/ssh/sshd_config.bak /etc/ssh/sshd_config
+  echo "Backup restaurado."
+  exit 1
+fi`;
+}