Coolify SSH files are updated all the time

[sneko]

Hi @andrasbacsai ,

I'm using aide (https://aide.github.io/) to snapshot all sensitive files signatures and compare them regularly. But my checks always trigger due to Coolify. See below accross 3 aide --config /etc/aide/aide.conf --check (or --update), files seem always being touched.

I could exclude them from the scope of checks but I doubt since ssh folder is sensitive. Do you know if Coolify is responsible of this? Like overriding files all the time even if same keys?

---------------------------------------------------
Detailed information about changes:
---------------------------------------------------


Directory: /data/coolify/ssh/keys
 Ctime     : 2024-09-12 13:52:01 +0000        | 2024-09-12 14:04:01 +0000

File: /data/coolify/ssh/keys/id.root@xxxxxxxxxxxxxxxxx
 Mtime     : 2024-09-12 13:52:01 +0000        | 2024-09-12 14:04:01 +0000
 Ctime     : 2024-09-12 13:52:01 +0000        | 2024-09-12 14:04:01 +0000

Directory: /data/coolify/ssh/mux
 Ctime     : 2024-09-12 13:52:01 +0000        | 2024-09-12 14:04:01 +0000



-------


Directory: /data/coolify/ssh/keys
 Ctime     : 2024-09-12 13:52:01 +0000        | 2024-09-12 14:08:01 +0000

File: /data/coolify/ssh/keys/id.root@xxxxxxxxxxxxxxxxx
 Mtime     : 2024-09-12 13:52:01 +0000        | 2024-09-12 14:08:01 +0000
 Ctime     : 2024-09-12 13:52:01 +0000        | 2024-09-12 14:08:01 +0000

Directory: /data/coolify/ssh/mux
 Ctime     : 2024-09-12 13:52:01 +0000        | 2024-09-12 14:08:01 +0000




---------


Directory: /data/coolify/ssh/keys
 Ctime     : 2024-09-12 13:52:01 +0000        | 2024-09-12 14:11:01 +0000

File: /data/coolify/ssh/keys/id.root@xxxxxxxxxxxxxxxxx
 Mtime     : 2024-09-12 13:52:01 +0000        | 2024-09-12 14:11:01 +0000
 Ctime     : 2024-09-12 13:52:01 +0000        | 2024-09-12 14:11:01 +0000

Directory: /data/coolify/ssh/mux
 Ctime     : 2024-09-12 13:52:01 +0000        | 2024-09-12 14:11:01 +0000

[peaklabs-dev]

Coolify needs to write to mux as this is a needed for SSH multiplexing to work, so yes these files will change. SSH keys are always kept even if they are no longer used, which piles up. I will open a PR soon to fix this problem.

[sneko]

@peaklabs-dev to confirm, I should exclude the /data/coolify/ssh/mux from checks only? In my case I have nothing piling up, I just have /data/coolify/ssh/keys/id.root@abcd for days, but despite having the same content the file is considered as modified all the time. Is it part of your upcoming fix?

I don't think I should exclude the /data/coolify/ssh/keys/, do you confirm? (since adding a new server is a low probably, and it would make sense to update fingerprints manually)

[andrasbacsai]

Coolify needs to write to mux as this is a needed for SSH multiplexing to work, so yes these files will change. SSH keys are always kept even if they are no longer used, which piles up. I will open a PR soon to fix this problem.

We also need to make sure that private keys are only saved when the user changes it from the UI.

Now, it is written every time (stupid solution) it needs to be used, so it will make sure that it is available.

@peaklabs-dev Can you please include this as well in your fixes?

[peaklabs-dev]

@sneko yes correct in the mux folder there are files written every hour and if you have multiple servers then more. I am working on the ssh key accumulation, duplication and cleaning up of old keys.

[peaklabs-dev]

Created an Issue: #3413

[peaklabs-dev]

@sneko The ssh keys should be populated once on creation (or trough one of the next updates) the mux folder is for multiplexing ssh every hour the file is removed and recreated by ssh so I would not watch mux as the file signature will probably change. But I would watch the ssh key folder after one of the next updates.