[P2602][F1] SSH port 7022 verified on fenix+maurik, w-zombi payload ssh_port7022.ps1

adn/03_seguridad.md

@@ -85,7 +85,7 @@ Las identidades permanecen activas mientras dure la sesión del agente SSH (sin
 | :--- | :--- | :--- | :--- |
 | **Hipervisores** (pmox1/2/3) | `root` | Llave RSA (passphrase `rsa`) | `ssh root@10.0.10.201` |
 | **VMs/CTs Linux** | `rmonla` | Llave RSA (desplegada) + sudo (`sudo`) | `ssh rmonla@10.0.10.4` |
-| **VMs Windows** | `monlaricardo` | Password (`win_domain`) + OpenSSH | `ssh monlaricardo@10.0.10.200` |
+| **VMs Windows** | `monlaricardo` | Password (`win_domain`) + OpenSSH **port 7022** | `ssh -p 7022 monlaricardo@10.0.10.200` |
 | **XenServer** (xen1) | `rmonla` | Password (`sudo`) | `ssh rmonla@10.0.10.23` |
 
 **Despliegue de llaves**: La llave pública de srv-ns8 (`~/.ssh/id_rsa.pub`) fue desplegada a todos los nodos Linux via `ssh-copy-id rmonla@<ip>` el 28/02/2026.

bitacoras/2026-02-28.md

@@ -54,6 +54,7 @@
 | ⏳ 10:52 | (IA) 🔧 Hostname VM 102 corregido: `srvv-SCERO` → `srvv-SITIO0`. |
 | ⏳ 11:00 | (IA) 📋 **XenServer agregado a P2602**: srv-xen1 + srvv-maurik + srvv-sysacadweb. Renombrado `srv-xen01` → `srv-xen1` en nodos/ontología. SSH `rmonla@` a srv-xen1 ✅ (password). Total: 15 guests a respaldar. |
 | ✅ 11:27 | (IA) 🧟 **OpenSSH en VMs Windows**: Instalado en srvv-fenix (`10.0.10.200`) y srvv-maurik (`10.0.10.10`) via w-zombi. SSH verificado con usuario `monlaricardo` (dominio). Credencial `win_domain` almacenada en bóveda. `[Físico: 0:21 hs]` |
+| ✅ 17:38 | (IA) 🔒 **SSH Port Hardening**: Puerto cambiado de 22 → **7022** en srvv-fenix y srvv-maurik via payload w-zombi `ssh_port7022.ps1`. Verificado: port 7022 ✅, port 22 refused ✅. `[Remoto: 0:13 hs]` |
 
 ### Operaciones Centrales
 

tools/w-zombi/payloads/activo.ps1

@@ -7,34 +7,40 @@ function Log-Msg {
 }
 
 Log-Msg "=========================================================="
-Log-Msg "INSTALANDO Y HABILITANDO OPENSSH SERVER NATIVO"
+Log-Msg "CONFIGURANDO SSH EN PUERTO 7022"
 Log-Msg "=========================================================="
+
+$cfg = "C:\ProgramData\ssh\sshd_config"
+
 try {
-    $sshCheck = Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Server*'
+    # Leer config, quitar cualquier linea Port anterior
-    if ($sshCheck.State -ne 'Installed') {
+    $lines = Get-Content $cfg | Where-Object { $_ -notmatch '^\s*#?\s*Port\s+\d+' }
-        Log-Msg "Instalando caracteristica OpenSSH.Server (esto puede tomar un minuto)..."
+    
-        Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 | Out-Null
+    # Agregar Port 7022 al inicio
-    } else {
+    $lines = @("Port 7022") + $lines
-        Log-Msg "OpenSSH.Server ya se encuentra instalado."
+    
-    }
+    # Escribir config limpia
+    $lines | Set-Content $cfg -Force
+    Log-Msg "sshd_config actualizado: Port 7022"
 
-    Log-Msg "Configurando servicio sshd en Inicio Automatico..."
+    # Firewall: agregar 7022, quitar 22
-    Set-Service -Name sshd -StartupType 'Automatic'
+    New-NetFirewallRule -Name 'SSH-7022' -DisplayName 'SSH 7022' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 7022 -ErrorAction SilentlyContinue | Out-Null
-    Start-Service sshd -ErrorAction SilentlyContinue
+    Remove-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue
+    Log-Msg "Firewall actualizado: 7022 abierto, 22 cerrado"
 
-    if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue)) {
+    # Reiniciar servicio
-        Log-Msg "Abriendo puerto TCP 22 en el Firewall local..."
+    Stop-Service sshd -Force -ErrorAction SilentlyContinue
-        New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 | Out-Null
+    Start-Sleep -Seconds 2
-    }
+    Start-Service sshd
+    Log-Msg "Servicio sshd reiniciado OK"
 
-    $ip = (Get-NetIPAddress -AddressFamily IPv4 | Where-Object InterfaceAlias -notmatch 'Loopback').IPAddress
+    $port = (Get-Content $cfg | Select-String "^Port").ToString().Trim()
-    Log-Msg "OpenSSH Server instalado y corriendo en el puerto 22."
+    Log-Msg "Verificacion: $port"
-    Log-Msg "Conectar via: ssh Administrador@$($ip[0])"
 } catch {
-    Log-Msg "Fallo al instalar SSH: $_"
+    Log-Msg "ERROR: $_"
 }
 
 Log-Msg "=========================================================="
-Log-Msg "OPERACION COMPLETADA. Ahora SSH esta disponible."
+Log-Msg "OPERACION COMPLETADA"
 Log-Msg "=========================================================="
 exit

tools/w-zombi/payloads/ssh_port7022.ps1

@@ -0,0 +1,46 @@
+function Log-Msg {
+    param([string]$Message)
+    Write-Host $Message -ForegroundColor Cyan
+    try {
+        Invoke-RestMethod -Uri "http://10.0.10.8:8000/log" -Method Post -Body @{msg=$Message} -UseBasicParsing -ErrorAction SilentlyContinue | Out-Null
+    } catch {}
+}
+
+Log-Msg "=========================================================="
+Log-Msg "CONFIGURANDO SSH EN PUERTO 7022"
+Log-Msg "=========================================================="
+
+$cfg = "C:\ProgramData\ssh\sshd_config"
+
+try {
+    # Leer config, quitar cualquier linea Port anterior
+    $lines = Get-Content $cfg | Where-Object { $_ -notmatch '^\s*#?\s*Port\s+\d+' }
+    
+    # Agregar Port 7022 al inicio
+    $lines = @("Port 7022") + $lines
+    
+    # Escribir config limpia
+    $lines | Set-Content $cfg -Force
+    Log-Msg "sshd_config actualizado: Port 7022"
+
+    # Firewall: agregar 7022, quitar 22
+    New-NetFirewallRule -Name 'SSH-7022' -DisplayName 'SSH 7022' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 7022 -ErrorAction SilentlyContinue | Out-Null
+    Remove-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue
+    Log-Msg "Firewall actualizado: 7022 abierto, 22 cerrado"
+
+    # Reiniciar servicio
+    Stop-Service sshd -Force -ErrorAction SilentlyContinue
+    Start-Sleep -Seconds 2
+    Start-Service sshd
+    Log-Msg "Servicio sshd reiniciado OK"
+
+    $port = (Get-Content $cfg | Select-String "^Port").ToString().Trim()
+    Log-Msg "Verificacion: $port"
+} catch {
+    Log-Msg "ERROR: $_"
+}
+
+Log-Msg "=========================================================="
+Log-Msg "OPERACION COMPLETADA"
+Log-Msg "=========================================================="
+exit