chore(archive): preserve KNELServerBuild remainder + layout notes [#474]

Archive the non-ported remainder of the legacy KNELServerBuild repo under archive/KNELServerBuild/ with its original structure intact, completing the legacy repo merge for everything except the live LibreNMS patterns (ported in the previous commit). Exclusions: - .git history (superseded; legacy repo remains at its original path) - ported files (Agents/librenms, Modules/OAM/oam-librenms.sh, ConfigFiles/SNMP/snmp-sudo.conf) - vendored KNELShellFramework tree (byte-identical duplicate of the copy already vendored at vendor/ in this repo) - SSH authorized-keys files (live access-control material; carrying them in an archive invites drift — key policy lives elsewhere) The whole tree is skip-listed in tests/shellcheck.sh (archived legacy code, not maintained — same standing as vendor/); check-rules.sh already prunes archive/. Rule 9 (conflict markers) now also excludes archive/ staged files: preserved-verbatim legacy scripts contain decorative "====" banners that false-positive as conflict markers (same archive exclusion precedent as rule 11). AGENTS.md: note archive/KNELServerBuild and oam/librenms-agent in the Repository Layout, and fix the stale KNELIAC path to /home/reachableceo/projects/KNEL/KNELIAC. 💘 Generated with Crush Assisted-by: Crush:glm-5.2
2026-08-28 06:12:05 -05:00
parent 75de9d7104
commit 39bb855a98
89 changed files with 8589 additions and 3 deletions
@@ -0,0 +1,105 @@
+#!/bin/bash
+
+#########################################
+#Core framework functions...
+#########################################
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+export PROJECT_ROOT_PATH
+PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+
+export GIT_VENDOR_PATH_ROOT
+GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
+
+export KNELShellFrameworkRoot
+KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
+
+export CONFIGFILES_PATH
+CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
+
+source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
+
+for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
+    source "$framework_include_file"
+done
+
+for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
+    source "$project_include_file"
+done
+
+
+#########################################
+# Core script code begins here
+#########################################
+
+export SUBODEV_CHECK
+SUBODEV_CHECK="$(getent passwd | grep -c subodev || true)"
+
+export LOCALUSER_CHECK
+LOCALUSER_CHECK="$(getent passwd | grep -c localuser || true)"
+
+export ROOT_SSH_DIR
+ROOT_SSH_DIR="/root/.ssh"
+
+export LOCALUSER_SSH_DIR
+LOCALUSER_SSH_DIR="/home/localuser/.ssh"
+
+export SUBODEV_SSH_DIR
+SUBODEV_SSH_DIR="/home/subodev/.ssh"
+
+
+if [ ! -d $ROOT_SSH_DIR ]; then
+    mkdir /root/.ssh/
+fi
+
+cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/root-ssh-authorized-keys" >/root/.ssh/authorized_keys
+chmod 400 /root/.ssh/authorized_keys
+chown root: /root/.ssh/authorized_keys
+
+if [ "$LOCALUSER_CHECK" -gt 0 ]; then
+    if [ ! -d $LOCALUSER_SSH_DIR ]; then
+        mkdir -p /home/localuser/.ssh/
+    fi
+    
+    cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/localuser-ssh-authorized-keys" >/home/localuser/.ssh/authorized_keys
+    chown localuser /home/localuser/.ssh/authorized_keys &&
+    chmod 400 /home/localuser/.ssh/authorized_keys
+fi
+
+if [ "$SUBODEV_CHECK" = 1 ]; then
+    
+    if [ ! -d $SUBODEV_SSH_DIR ]; then
+        mkdir /home/subodev/.ssh/
+    fi
+    
+    cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/localuser-ssh-authorized-keys" >/home/subodev/.ssh/authorized_keys
+    chmod 400 /home/subodev/.ssh/authorized_keys &&
+    chown subodev: /home/subodev/.ssh/authorized_keys
+fi
+
+export DEV_WORKSTATION_CHECK
+DEV_WORKSTATION_CHECK="$(hostname | egrep -c 'subopi-dev|CharlesDevServer' || true)"
+
+if [ "$DEV_WORKSTATION_CHECK" -eq 0 ]; then
+    
+    cat "$CONFIGFILES_PATH/SSH/Configs/tsys-sshd-config" >/etc/ssh/sshd_config
+fi
+
+
+#Don't deploy this config to a ubuntu server, it breaks openssh server. Works on kali/debian.
+
+export UBUNTU_CHECK
+UBUNTU_CHECK="$(distro | grep -c Ubuntu||true)"
+
+if [ "$UBUNTU_CHECK" -ne 1 ]; then
+    cat "$CONFIGFILES_PATH/SSH/Configs/ssh-audit-hardening.conf" >/etc/ssh/sshd_config.d/ssh-audit_hardening.conf
+    chmod og-rwx /etc/ssh/sshd_config.d/*
+fi
+
+# Perms on sshd_config
+chmod og-rwx /etc/ssh/sshd_config
+
+#todo
+
+# only strong MAC algos are used