raucao
b299910dc6
CVE-2026-98432 is a use-after-free in the Linux IPv4 TCP option handling (inet_opt/ireq_opt are freed with a plain kfree()) that is reachable by sending a TCP SYN carrying IP options. No fixed kernel has been released for any supported Ubuntu release yet, so mitigate in role[base] until one is: * Drop inbound IPv4 TCP segments that carry IP options (no legitimate traffic uses them) and log the drops, rate limited, so probing is visible. The rules are added to /etc/ufw/before.rules so they survive ufw reloads, and are idempotent. * Disable Multipath TCP where the kernel supports it (5.6+). Go programs built with Go >= 1.24 open MPTCP listeners by default, which is the precondition of the published exploit; nothing here needs MPTCP. Hosts on older kernels (5.4, no MPTCP) skip this. The sysctl drop-in is written directly rather than via the core sysctl resource, whose reload runs `sysctl -p` against /etc/sysctl.conf - a file that no longer exists on Ubuntu 26.04. Opt node_exporter (Go >= 1.24, so it opened an MPTCP listener) out of MPTCP with GODEBUG=multipathtcp=0, and restart it when the unit changes so the change takes effect without a separate restart.
This repository contains all infrastructure automation code that we use to set up and configure servers, virtual machines, and applications for Kosmos hosted services.
Chef cookbooks are written in Ruby, and based on Chef Infra resources. Some cookbooks contain integration test suites based on Test Kitchen.
Note: Manual configuration of servers and applications is highly discouraged, and can be overwritten or lost without notice!
Setup
Install Chef Workstation
- macOS, Windows, RHEL, Ubuntu: https://docs.chef.io/workstation/install_workstation/
- Arch Linux: https://aur.archlinux.org/packages/chef-workstation
rbenv
If you use rbenv to manage Ruby versions on your system, install the rbenv-chef-workstation plugin.
Install gem dependencies
Clone this repository, cd into it, and run:
bundle install
Common tasks
Bootstrap a new host server
knife zero bootstrap root@server-name.kosmos.org --run-list "role[base],role[kvm_host]" --secret-file .chef/encrypted_data_bag_secret
Bootstrap a new VM
knife zero bootstrap ubuntu@zerotier-ip-address -x ubuntu --sudo --run-list "role[base],role[kvm_guest]" --secret-file .chef/encrypted_data_bag_secret
Bootstrap a new VM with environment and role/app (postgres replica as example)
knife zero bootstrap ubuntu@10.1.1.134 -x ubuntu --sudo --environment production --run-list "role[base],role[kvm_guest],role[postgresql_replica]" --secret-file .chef/encrypted_data_bag_secret
Run Chef Zero on a host server
knife zero converge -p2222 name:server-name.kosmos.org
Run Chef Zero on a VM
knife zero converge -a knife_zero.host name:vm-name-23
Update Chef Client on a server:
knife zero converge name:dev.kosmos.org --client-version 15.3.14
Upgrade Chef Client on a node:
knife ssh -a knife_zero.host 'name:foo-1' 'curl -L https://chef.io/chef/install.sh | sudo bash -s -- -v 18.10.17'
Managing cookbooks
Cookbooks are managed via Berkshelf. Run berks --help for command help.
Install cookbooks listed in Berksfile:
berks install
Vendor installed cookbooks to the cookbooks/ dir:
berks vendor cookbooks/ --delete
"Expired" TLS certificates
If you encounter expired TLS certificates during a Chef run (e.g. for remote files), the issue is likely that the certificate has been issued by Let's Encrypt and Chef is still using its own, outdated CA cert store (see here for example).
As a hotfix, you can manually remove the "DST Root CA X3" cert from
/opt/chef/embedded/ssl/cert.pem on the machine you're trying to converge.