105 lines
7.3 KiB
PHP
105 lines
7.3 KiB
PHP
<?php
|
||
|
||
// Human-readable strings returned by backend services (HardeningService,
|
||
// FirewallService, Fail2banService, MaintenanceService, OsProfile) and shown in
|
||
// the UI: confirm-modal copy, guard/lockout refusals, read errors, and the
|
||
// supports()/reason sentences. Technical tokens (sshd, ufw, firewalld, ports,
|
||
// paths) stay verbatim. Reuse common.* for save/cancel/active/inactive/etc.
|
||
return [
|
||
// ── HardeningService: state labels + detail ──────────────────────────
|
||
'item_not_installed' => 'not installed',
|
||
'label_ssh_root' => 'SSH root login',
|
||
'label_ssh_password' => 'SSH password login',
|
||
'label_auto_updates' => 'Automatic updates',
|
||
|
||
// ── HardeningService: modal titles (per direction) ───────────────────
|
||
'title_ssh_root_enable' => 'Allow SSH root login',
|
||
'title_ssh_root_disable' => 'Disable SSH root login',
|
||
'title_ssh_password_enable' => 'Allow SSH password login',
|
||
'title_ssh_password_disable' => 'Disable SSH password login',
|
||
'title_fail2ban_enable' => 'Enable fail2ban',
|
||
'title_fail2ban_disable' => 'Disable fail2ban',
|
||
'title_firewall_enable' => 'Enable firewall',
|
||
'title_firewall_disable' => 'Disable firewall',
|
||
'title_unattended_enable' => 'Enable automatic updates',
|
||
'title_unattended_disable' => 'Disable automatic updates',
|
||
|
||
// ── HardeningService: modal descriptions (per direction) ─────────────
|
||
'desc_ssh_root_enable' => 'Re-allows direct root login over SSH (PermitRootLogin yes) and reloads the SSH service.',
|
||
'desc_ssh_root_disable' => 'Blocks direct root login over SSH (PermitRootLogin no) and reloads the SSH service.',
|
||
'desc_ssh_password_enable' => 'Re-allows password login (PasswordAuthentication yes).',
|
||
'desc_ssh_password_disable' => 'Login via SSH key only (PasswordAuthentication no). Only possible if a key is in place.',
|
||
'desc_fail2ban_enable' => 'Installs fail2ban (if needed) and starts the service. Repeated failed logins get banned.',
|
||
'desc_fail2ban_disable' => 'Stops fail2ban and disables autostart.',
|
||
'desc_firewall_enable' => 'Installs the firewall (if needed), opens SSH + 80/443 first, then enables it.',
|
||
'desc_firewall_disable' => 'Disables the server firewall.',
|
||
'desc_unattended_enable' => 'Installs (if needed) and enables the system\'s automatic security updates.',
|
||
'desc_unattended_disable' => 'Turns off automatic updates.',
|
||
|
||
// ── HardeningService: errors + guards ────────────────────────────────
|
||
'hardening_status_read_failed' => 'Could not read hardening status.',
|
||
'ssh_probe_no_exec' => 'SSH login succeeded, but commands could not be executed.',
|
||
'ssh_password_self_lockout' => 'Clusev connects itself via password — password login cannot be disabled, otherwise Clusev loses access. Set up SSH key access first.',
|
||
'ssh_password_no_key' => 'No SSH key in place — password login cannot be disabled (lockout risk).',
|
||
|
||
// ── FirewallService: guards / reasons / errors ───────────────────────
|
||
'firewalld_read_only' => 'Rule management for firewalld is read-only in this version — please configure it on the server.',
|
||
'invalid_port' => 'Invalid port (1–65535).',
|
||
'invalid_source' => 'Invalid source — IP address or CIDR expected.',
|
||
'port_or_source_required' => 'Port or source is required.',
|
||
'deny_without_port_blocks_ssh' => 'A :action rule without a port would also block SSH access and is not allowed. Use fail2ban to block individual IPs from SSH access.',
|
||
'deny_on_ssh_port_blocks_ssh' => 'A :action rule on the SSH port (:port) is not allowed (lockout risk). Use fail2ban to block individual IPs from SSH access.',
|
||
'firewalld_port_required' => 'firewalld: Please specify a port.',
|
||
'firewall_status_read_failed' => 'Could not read firewall status — rule not removed.',
|
||
'rule_gone' => 'Rule no longer exists.',
|
||
'ssh_rule_guard' => 'This rule keeps SSH access (port :port) open and cannot be removed — otherwise Clusev locks itself out. Disable the whole firewall if needed.',
|
||
|
||
// ── Fail2banService: guards / reasons / errors ───────────────────────
|
||
'ip_belongs_to_clusev' => 'This IP belongs to Clusev\'s access and cannot be banned (lockout risk).',
|
||
'already_whitelisted' => 'Already on the whitelist.',
|
||
'not_on_whitelist' => 'Not on the whitelist.',
|
||
'loopback_stays_whitelisted' => 'Loopback always stays on the whitelist.',
|
||
'invalid_input' => 'Invalid input.',
|
||
'invalid_ip_or_cidr' => 'Invalid IP address or CIDR.',
|
||
'fail2ban_config_read_failed' => 'Could not read fail2ban configuration.',
|
||
|
||
// ── OsProfile: family labels ─────────────────────────────────────────
|
||
'family_debian' => 'Debian/Ubuntu',
|
||
'family_rhel' => 'RHEL/Fedora',
|
||
'family_suse' => 'openSUSE/SLES',
|
||
'family_arch' => 'Arch Linux',
|
||
'family_alpine' => 'Alpine Linux',
|
||
'family_unknown' => 'Unknown system',
|
||
|
||
// ── OsProfile: firewall labels ───────────────────────────────────────
|
||
'firewall_label_ufw' => 'Firewall (UFW)',
|
||
'firewall_label_firewalld' => 'Firewall (firewalld)',
|
||
'firewall_label_generic' => 'Firewall',
|
||
|
||
// ── OsProfile: supports() reasons (:family = familyLabel()) ──────────
|
||
'support_ssh' => 'SSH hardening requires systemd, which was not detected on :family.',
|
||
'support_services' => 'Service control requires systemd, which was not detected here.',
|
||
'support_updates' => 'Package updates via Clusev are not yet supported on :family.',
|
||
'support_fail2ban' => 'fail2ban is not yet supported on :family via Clusev.',
|
||
'support_firewall' => 'No supported firewall (UFW or firewalld) was found on :family.',
|
||
'support_auto_updates' => 'Automatic updates are not yet supported on :family via Clusev.',
|
||
|
||
// ── FleetService: SFTP / file-manager / journal errors ───────────────
|
||
'authorized_keys_unreadable' => 'authorized_keys is empty or unreadable.',
|
||
'delete_failed_perms' => 'Delete failed (permissions?).',
|
||
'file_too_large_download' => 'File too large to download (>50 MB).',
|
||
'save_failed_perms' => 'Save failed (permissions?).',
|
||
'upload_failed_perms' => 'Upload failed (permissions?).',
|
||
'journal_needs_privileges' => 'The system journal requires elevated privileges (group adm/systemd-journal) or sudo.',
|
||
|
||
// ── CredentialVault: SSH credential guards (:server = name) ──────────
|
||
'no_ssh_credential' => 'No SSH credential stored for server :server.',
|
||
'ssh_access_locked' => 'SSH access for :server is locked.',
|
||
|
||
// ── HardeningService: invalid action invariant (:action) ─────────────
|
||
'unknown_hardening' => 'Unknown hardening action: :action',
|
||
|
||
// ── SshKeyProvisioner ─────────────────────────────────────────────────
|
||
'ssh_key_verify_failed' => 'Key login could not be verified (:error) — password login stays enabled.',
|
||
];
|