KNEL/PFVCluster
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(archive): preserve KNELServerBuild remainder + layout notes [#474]

Browse Source 
Archive the non-ported remainder of the legacy KNELServerBuild repo
under archive/KNELServerBuild/ with its original structure intact,
completing the legacy repo merge for everything except the live
LibreNMS patterns (ported in the previous commit).

Exclusions:
- .git history (superseded; legacy repo remains at its original path)
- ported files (Agents/librenms, Modules/OAM/oam-librenms.sh,
  ConfigFiles/SNMP/snmp-sudo.conf)
- vendored KNELShellFramework tree (byte-identical duplicate of the
  copy already vendored at vendor/ in this repo)
- SSH authorized-keys files (live access-control material; carrying
  them in an archive invites drift — key policy lives elsewhere)

The whole tree is skip-listed in tests/shellcheck.sh (archived legacy
code, not maintained — same standing as vendor/); check-rules.sh
already prunes archive/. Rule 9 (conflict markers) now also excludes
archive/ staged files: preserved-verbatim legacy scripts contain
decorative "====" banners that false-positive as conflict markers
(same archive exclusion precedent as rule 11).

AGENTS.md: note archive/KNELServerBuild and oam/librenms-agent in the
Repository Layout, and fix the stale KNELIAC path to
/home/reachableceo/projects/KNEL/KNELIAC.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
mrcharles
2026-08-28 06:12:05 -05:00
parent 75de9d7104
commit 39bb855a98
89 changed files with 8589 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+6 -2
View File
@@ -319,19 +319,23 @@ dcinfra/ Data-center infra: PDU (powerman), serial console (console),
netinfra/ DNS/NTP/DHCP setup + audit; DNS cluster replication (dns-cluster-setup);
switch captures (switches); DHCP config (dhcp)
k8s/ k3s cluster setup scripts (HA control plane over Tailscale) + docs/
oam/ OAM platform tooling (oxidized, unpoller, smokeping, netdisco, weathermap;
librenms-agent: check_mk agent + snmp-extend scripts ported from KNELServerBuild [#474])
proxmox/ Proxmox fleet docs (hardware audit, capacity, storage) + perf tuning (perf/)
awx/ Ansible AWX deployment (k3s + AWX Operator)
tests/ Test suite + VM validation harness + remote.sh SSH chokepoint
scripts/ Framework: git hooks, rule engine (check-rules.sh), shared lib
docs/ Server-build docs, docmap index, and archive
archive/ Historical/superseded code (provisioning -> replaced by KNELIAC project)
archive/ Historical/superseded code (provisioning -> replaced by KNELIAC project;
KNELServerBuild -> live patterns ported to oam/librenms-agent/, remainder
preserved under archive/KNELServerBuild/ [#474])
vendor/ Vendored KNELShellFramework
```
- **Server provisioning moved to KNELIAC**: The
[`archive/provisioning/`](archive/provisioning/) tree is historical. Active
server provisioning lives in the **KNELIAC** project at
`/home/reachableceo/projects/KNELIAC`.
`/home/reachableceo/projects/KNEL/KNELIAC`.
- **Non-bash files**: Some files under `archive/provisioning/Agents/` have `.sh`
extension but are PHP (shebang `#!/usr/bin/php`). Skip in syntax checks.
- **Remote access (NON-NEGOTIABLE):** ALL SSH/SCP to ANY host MUST go
archive/KNELServerBuild/.gitignore
+13
View File
@@ -0,0 +1,13 @@
# LOGFILENAME artifacts: the framework (Logging.sh + PrettyPrint.sh) appends
# every print_info/print_error line to LOGFILENAME, defined as
# "$0.<Weekday>-YYYY-MM-DD-HH:MM:SS.$$". Running any script that sources the
# framework therefore drops a timestamped log file next to it. Ignore these
# everywhere in the repo.
*.Monday-*
*.Tuesday-*
*.Wednesday-*
*.Thursday-*
*.Friday-*
*.Saturday-*
*.Sunday-*
dns-cluster-setup/.export/
archive/KNELServerBuild/AGENTS.md
+76
View File
@@ -0,0 +1,76 @@
# Agent Guidelines
## Repository Layout
Knowing where things live prevents broken edits:
- **Vendored framework**: `KNELShellFramework` lives at
`vendor/git@git.knownelement.com/29418/KNEL/KNELShellFramework/`, **not** at
the repo root. Its includes are under `Framework-Includes/` there. Never
assume `./Framework-Includes` exists relative to the repo root.
- **Self-locating scripts**: All provisioning scripts derive their own
location via `BASH_SOURCE` and compute `PROJECT_ROOT_PATH` from it. They must
**never** depend on the current working directory or on `cd`/`realpath ..`
chains. Run them from anywhere — `sudo bash SetupNewSystem.sh` works.
- **Local config files are the source of truth**: Configs in
`ProjectCode/ConfigFiles/` are read with `cat`/`cp`. Do **not** re-introduce
`curl ${DL_ROOT}/...` downloads from `dl.knownelement.com` — that CDN is
deprecated for this repo.
- **Path variables**: Scripts export `PROJECT_ROOT_PATH`, `CONFIGFILES_PATH`,
`MODULES_PATH`, `SCRIPTS_PATH`, and `AGENTS_PATH` for locating repo content.
- **Non-bash agents**: Some files under `ProjectCode/Agents/` carry a `.sh`
extension but are PHP (e.g. `mysql.sh`, shebang `#!/usr/bin/php`). Syntax
checkers must skip these.
## Git Commit Requirements
When making changes to this repository, ALWAYS:
1. **Commit atomically**: Each logical change should be its own commit
2. **Use conventional commit format**:
- `feat(scope): description` - New feature
- `fix(scope): description` - Bug fix
- `docs: description` - Documentation changes
- `refactor(scope): description` - Code refactoring
- `test(scope): description` - Test additions/changes
- `chore: description` - Maintenance tasks
3. **Write verbose, beautifully formatted messages**:
- Title line (50 chars max)
- Blank line
- Body explaining WHAT and WHY (not how)
- Reference related files/issues
- Include footer with attribution
## Example Commit
```
feat(security-hardening): implement SCAP-STIG compliance logic
Refactor apply script to implement comprehensive security hardening:
- Add GRUB bootloader permission hardening (root:root, mode 0400)
- Disable and remove autofs service per STIG requirements
- Deploy modprobe configurations for kernel module blacklisting
- Create STIG-compliant network protocol blacklist
This ensures servers meet DoD security requirements for production
deployment.
🤖 Generated with [Crush](https://github.com/charmassociates/crush)
Assisted-by: GLM-5 via Crush <crush@charm.land>
```
## Autonomous Git Workflow
**Agents are authorized to commit AND push autonomously. Do not wait to be
asked.** After each logical unit of work:
1. Stage only the files belonging to that logical change.
2. Commit with a conventional, well-formed message (see above).
3. Push to `origin` (`git push`). The branch tracks `origin/main`.
4. Repeat per logical unit.
Group changes so each commit is coherent on its own (a reader should
understand the commit without seeing the others). Never batch unrelated
changes into one commit.
archive/KNELServerBuild/LICENSE
+235
View File
@@ -0,0 +1,235 @@
GNU AFFERO GENERAL PUBLIC LICENSE
Version 3, 19 November 2007
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
Preamble
The GNU Affero General Public License is a free, copyleft license for software and other kinds of works, specifically designed to ensure cooperation with the community in the case of network server software.
The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, our General Public Licenses are intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users.
When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.
Developers that use our General Public Licenses protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License which gives you legal permission to copy, distribute and/or modify the software.
A secondary benefit of defending all users' freedom is that improvements made in alternate versions of the program, if they receive widespread use, become available for other developers to incorporate. Many developers of free software are heartened and encouraged by the resulting cooperation. However, in the case of software used on network servers, this result may fail to come about. The GNU General Public License permits making a modified version and letting the public access it on a server without ever releasing its source code to the public.
The GNU Affero General Public License is designed specifically to ensure that, in such cases, the modified source code becomes available to the community. It requires the operator of a network server to provide the source code of the modified version running there to the users of that server. Therefore, public use of a modified version, on a publicly accessible server, gives the public access to the source code of the modified version.
An older license, called the Affero General Public License and published by Affero, was designed to accomplish similar goals. This is a different license, not a version of the Affero GPL, but Affero has released a new version of the Affero GPL which permits relicensing under this license.
The precise terms and conditions for copying, distribution and modification follow.
TERMS AND CONDITIONS
0. Definitions.
"This License" refers to version 3 of the GNU Affero General Public License.
"Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.
"The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations.
To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work.
A "covered work" means either the unmodified Program or a work based on the Program.
To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.
1. Source Code.
The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work.
A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.
The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.
The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those
subprograms and other parts of the work.
The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.
The Corresponding Source for a work in source code form is that same work.
2. Basic Permissions.
All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.
You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.
When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices".
c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
6. Conveying Non-Source Forms.
You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.
d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.
A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.
A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.
"Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.
Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.
7. Additional Terms.
"Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.
When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or
b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or
c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or
d) Limiting the use for publicity purposes of names of licensors or authors of the material; or
e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.
All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.
If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.
Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
8. Termination.
You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.
9. Acceptance Not Required for Having Copies.
You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.
10. Automatic Licensing of Downstream Recipients.
Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.
An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.
You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.
If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent
license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.
If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.
A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.
Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.
12. No Surrender of Others' Freedom.
If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may
not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
13. Remote Network Interaction; Use with the GNU General Public License.
Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph.
Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the work with which it is combined will remain governed by version 3 of the GNU General Public License.
14. Revised Versions of this License.
The Free Software Foundation may publish revised and/or new versions of the GNU Affero General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU Affero General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU Affero General Public License, you may choose any version ever published by the Free Software Foundation.
If the Program specifies that a proxy can decide which future versions of the GNU Affero General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.
Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.
15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
17. Interpretation of Sections 15 and 16.
If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found.
FetchApply
Copyright (C) 2024 VpTechnicalOperations
This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.
Also add information on how to contact you by electronic and paper mail.
If your software can interact with users remotely through a computer network, you should also make sure that it provides a way for users to get its source. For example, if your program is a web application, its interface could display a "Source" link that leads users to an archive of the code. There are many ways you could offer source, and different solutions will be better for different programs; see section 13 for the specific requirements.
You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU AGPL, see <http://www.gnu.org/licenses/>.
archive/KNELServerBuild/Project-ConfigFiles/CONFIG_VARS
+3
View File
@@ -0,0 +1,3 @@
export DL_ROOT
DL_ROOT="https://dl.knownelement.com/KNEL/FetchApply/"
archive/KNELServerBuild/Project-Includes/LocalHelp.sh
+13
View File
@@ -0,0 +1,13 @@
#!/bin/bash
function LocalHelp()
{
echo "$0 is <description here>"
echo "$0 takes <num> arguments: "
echo "1) <stuff>"
echo "2) <other stuff>"
echo "<additional info on arguments...>:"
echo "<put>"
echo "<stuff>"
echo "<here>"
}
archive/KNELServerBuild/Project-Includes/PreflightCheck.sh
+19
View File
@@ -0,0 +1,19 @@
#!/bin/bash
function PreflightCheck()
{
export curr_user="$USER"
export user_check
user_check="$(echo "$curr_user" | grep -c root)"
if [ $user_check -ne 1 ]; then
print_error "Must run as root."
error_out
fi
echo "All checks passed...."
}
archive/KNELServerBuild/Project-Includes/pi-detect.sh
+13
View File
@@ -0,0 +1,13 @@
function pi-detect()
{
print_info Now running "$FUNCNAME"....
if [ -f /sys/firmware/devicetree/base/model ] ; then
export IS_RASPI="1"
fi
if [ ! -f /sys/firmware/devicetree/base/model ] ; then
export IS_RASPI="0"
fi
print_info Completed running "$FUNCNAME"
}
archive/KNELServerBuild/Project-Tests/README.md
+176
View File
@@ -0,0 +1,176 @@
# TSYS FetchApply Testing Framework
## Overview
This testing framework provides comprehensive validation for the TSYS FetchApply infrastructure provisioning system. It includes unit tests, integration tests, security tests, and system validation.
## Test Categories
### 1. Unit Tests (`unit/`)
- **Purpose:** Test individual framework functions and components
- **Scope:** Framework includes, helper functions, syntax validation
- **Example:** `framework-functions.sh` - Tests logging, pretty print, and error handling functions
### 2. Integration Tests (`integration/`)
- **Purpose:** Test complete workflows and module interactions
- **Scope:** End-to-end deployment scenarios, module integration
- **Future:** Module interaction testing, deployment workflow validation
### 3. Security Tests (`security/`)
- **Purpose:** Validate security configurations and practices
- **Scope:** HTTPS enforcement, deployment security, SSH hardening
- **Example:** `https-enforcement.sh` - Validates all URLs use HTTPS
### 4. Validation Tests (`validation/`)
- **Purpose:** System compatibility and pre-flight checks
- **Scope:** System requirements, network connectivity, permissions
- **Example:** `system-requirements.sh` - Validates minimum system requirements
## Usage
### Run All Tests
```bash
./Project-Tests/run-tests.sh
```
### Run Specific Test Categories
```bash
./Project-Tests/run-tests.sh unit # Unit tests only
./Project-Tests/run-tests.sh integration # Integration tests only
./Project-Tests/run-tests.sh security # Security tests only
./Project-Tests/run-tests.sh validation # Validation tests only
```
### Run Individual Tests
```bash
./Project-Tests/validation/system-requirements.sh
./Project-Tests/security/https-enforcement.sh
./Project-Tests/unit/framework-functions.sh
```
## Test Results
- **Console Output:** Real-time test results with color-coded status
- **JSON Reports:** Detailed test reports saved to `logs/tests/`
- **Exit Codes:** 0 for success, 1 for failures
## Configuration Validation
The validation framework performs pre-flight checks to ensure system compatibility:
### System Requirements
- **Memory:** Minimum 2GB RAM
- **Disk Space:** Minimum 10GB available
- **OS Compatibility:** Ubuntu/Debian (tested), others (may work)
### Network Connectivity
- Tests connection to required download sources
- Validates HTTPS endpoints are accessible
- Checks for firewall/proxy issues
### Command Dependencies
- Verifies required tools are installed (`curl`, `wget`, `git`, `systemctl`, `apt-get`)
- Checks for proper versions where applicable
### Permissions
- Validates write access to system directories
- Checks for required administrative privileges
## Adding New Tests
### Test File Structure
```bash
#!/bin/bash
set -euo pipefail
function test_something() {
echo "🔍 Testing something..."
if [[ condition ]]; then
echo "✅ Test passed"
return 0
else
echo "❌ Test failed"
return 1
fi
}
function main() {
echo "🧪 Running Test Suite Name"
echo "=========================="
local total_failures=0
test_something || ((total_failures++))
echo "=========================="
if [[ $total_failures -eq 0 ]]; then
echo "✅ All tests passed"
exit 0
else
echo "❌ $total_failures tests failed"
exit 1
fi
}
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
main "$@"
fi
```
### Test Categories Guidelines
- **Unit Tests:** Focus on individual functions, fast execution
- **Integration Tests:** Test module interactions, longer execution
- **Security Tests:** Validate security configurations
- **Validation Tests:** Pre-flight system checks
## Continuous Integration
The testing framework is designed to integrate with CI/CD pipelines:
```bash
# Example CI script
./Project-Tests/run-tests.sh all
test_exit_code=$?
if [[ $test_exit_code -eq 0 ]]; then
echo "All tests passed - deployment approved"
else
echo "Tests failed - deployment blocked"
exit 1
fi
```
## Test Development Best Practices
1. **Clear Test Names:** Use descriptive function names
2. **Proper Exit Codes:** Return 0 for success, 1 for failure
3. **Informative Output:** Use emoji and clear messages
4. **Timeout Protection:** Use timeout for network operations
5. **Cleanup:** Remove temporary files and resources
6. **Error Handling:** Use `set -euo pipefail` for strict error handling
## Troubleshooting
### Common Issues
- **Permission Denied:** Run tests with appropriate privileges
- **Network Timeouts:** Check firewall and proxy settings
- **Missing Dependencies:** Install required tools before testing
- **Script Errors:** Validate syntax with `bash -n script.sh`
### Debug Mode
```bash
# Enable debug output
export DEBUG=1
./Project-Tests/run-tests.sh
```
## Contributing
When adding new functionality to FetchApply:
1. Add corresponding tests in appropriate category
2. Run full test suite before committing
3. Update documentation for new test cases
4. Ensure tests pass in clean environment
archive/KNELServerBuild/Project-Tests/remote.sh
Executable
+97
View File
@@ -0,0 +1,97 @@
#!/usr/bin/bash
#
# remote.sh
#
# Single chokepoint for ALL ssh/scp access to the Proxmox host and the sandbox
# VM. Every other script (and every agent/dev) MUST route remote operations
# through this wrapper — never call ssh/scp directly.
#
# WHY: one place to configure hosts/users/keys, one place to audit, and the
# command scanner only allows ssh when it is invoked indirectly via a script.
#
# CONFIG (override via env):
# PROX_HOST (default pfv-tsys5) Proxmox node
# PROX_USER (default root) SSH user on Proxmox
# VM_IP (default 192.168.3.50) sandbox VM IP
# VM_USER (default localuser) SSH user on the VM (has passwordless sudo)
#
# USAGE:
# remote.sh prox <cmd...> run command on Proxmox
# remote.sh vm <cmd...> run command on VM as $VM_USER
# remote.sh vmroot <cmd...> run command on VM as root via sudo
# remote.sh prox-file <local-script> run a local script file on Proxmox (bash -s)
# remote.sh vm-file <local-script> run a local script file on the VM (bash -s)
# remote.sh vm-copy <local> <dest> copy a local file to the VM (~$VM_USER space)
# remote.sh prox-copy <local> <dest> copy a local file to Proxmox
#
set -uo pipefail
PROX_HOST="${PROX_HOST:-pfv-tsys5}"
PROX_USER="${PROX_USER:-root}"
VM_IP="${VM_IP:-192.168.3.50}"
VM_USER="${VM_USER:-localuser}"
VM_ID="${VM_ID:-}"
GUEST_TIMEOUT="${GUEST_TIMEOUT:-900}"
SSH_OPTS=(-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15)
die() { echo "remote.sh: $*" >&2; exit 1; }
_prox() { ssh "${SSH_OPTS[@]}" "${PROX_USER}@${PROX_HOST}" "$@"; }
_vm() { ssh "${SSH_OPTS[@]}" "${VM_USER}@${VM_IP}" "$@"; }
_vmroot() { _vm "sudo -n bash -c $(printf '%q' "$*")"; }
_copy() {
# $1=target user@host, $2=local, $3=remote dest
# Use cat-over-ssh (portable: no rsync needed on either side). rsync is only
# used when present on BOTH ends, else we transparently fall back to cat.
local target="$1" local="$2" dest="$3"
local userhost="${target%@*}@${target#*@}"
if command -v rsync >/dev/null 2>&1 \
&& ssh "${SSH_OPTS[@]}" "$userhost" 'command -v rsync' >/dev/null 2>&1; then
rsync -az -e "ssh ${SSH_OPTS[*]}" "$local" "${userhost}:${dest}"
else
ssh "${SSH_OPTS[@]}" "$userhost" "cat > '$dest'" < "$local"
fi
}
# Out-of-band VM access via the Proxmox qemu-guest-agent. This runs commands
# as root inside the VM and does NOT depend on SSH, so it works even after
# secharden-ssh replaces authorized_keys and secharden-2fa enforces
# publickey+keyboard-interactive (which blocks non-interactive SSH).
GUEST_PARSER="/root/.knel-guest-parse.py"
GUEST_PARSER_SRC="import sys, json
try:
d = json.load(sys.stdin)
except Exception:
sys.exit(3)
sys.stdout.write(d.get('out-data', '') or '')
sys.stderr.write(d.get('err-data', '') or '')
ec = d.get('exitcode', 1)
sys.exit(ec if ec is not None else 1)"
_ensure_guest_parser() {
if _prox "test -f '$GUEST_PARSER'" >/dev/null 2>&1; then return 0; fi
printf '%s\n' "$GUEST_PARSER_SRC" | _prox "cat > '$GUEST_PARSER'" >/dev/null 2>&1
}
_vm_guest() {
[ -n "$VM_ID" ] || die "vm-guest requires VM_ID"
_ensure_guest_parser
local cmdb64; cmdb64="$(printf '%s' "$*" | base64 -w0)"
_prox "qm guest exec $VM_ID --timeout ${GUEST_TIMEOUT} -- /bin/sh -c 'echo $cmdb64 | base64 -d | /bin/sh' 2>/dev/null | python3 '$GUEST_PARSER'"
}
mode="${1:-}"; shift || true
case "$mode" in
prox) [ "$#" -ge 0 ] || die "need command"; _prox "$*" ;;
vm) _vm "$*" ;;
vmroot) [ "$#" -ge 1 ] || die "need command"; _vmroot "$*" ;;
prox-file) [ -f "${1:-}" ] || die "need local script file"; _prox "bash -s" < "$1" ;;
vm-file) [ -f "${1:-}" ] || die "need local script file"; _vm "bash -s" < "$1" ;;
vm-copy) [ -f "${1:-}" ] || die "need local file"; _copy "${VM_USER}@${VM_IP}" "$1" "${2:-}" ;;
prox-copy) [ -f "${1:-}" ] || die "need local file"; _copy "${PROX_USER}@${PROX_HOST}" "$1" "${2:-}" ;;
vm-guest) [ "$#" -ge 1 ] || die "need command"; _vm_guest "$*" ;;
""|-h|--help|help) sed -n '2,40p' "${BASH_SOURCE[0]}" >&2; exit 0 ;;
*) die "unknown mode '$mode'. Run '$0 help'." ;;
esac
archive/KNELServerBuild/Project-Tests/run-tests.sh
Executable
+137
View File
@@ -0,0 +1,137 @@
#!/bin/bash
# TSYS FetchApply Testing Framework
# Main test runner script
set -euo pipefail
# Resolve repository root from this script's location (Project-Tests/ -> repo root)
PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
# The KNELShellFramework is vendored under vendor/
FRAMEWORK_INCLUDES="$PROJECT_ROOT/vendor/git@git.knownelement.com/29418/KNEL/KNELShellFramework/Framework-Includes"
source "$FRAMEWORK_INCLUDES/Logging.sh"
source "$FRAMEWORK_INCLUDES/PrettyPrint.sh"
# The vendored PrettyPrint only defines print_info/print_error; provide the
# additional output helpers the test suite relies on.
function print_header() { echo ""; echo "=== $1 ==="; }
function print_success() { echo "✅ $1"; }
function print_warning() { echo "⚠️ $1"; }
# Test configuration
TEST_LOG_DIR="$PROJECT_ROOT/logs/tests"
TEST_RESULTS_FILE="$TEST_LOG_DIR/test-results-$(date +%Y%m%d-%H%M%S).json"
# Ensure test log directory exists
mkdir -p "$TEST_LOG_DIR"
# Test counters
declare -g TESTS_PASSED=0
declare -g TESTS_FAILED=0
declare -g TESTS_SKIPPED=0
# Test runner functions
function run_test_suite() {
local suite_name="$1"
local test_dir="$2"
print_header "Running $suite_name Tests"
if [[ ! -d "$test_dir" ]]; then
print_warning "Test directory $test_dir not found, skipping"
return 0
fi
for test_file in "$test_dir"/*.sh; do
if [[ -f "$test_file" ]]; then
run_single_test "$test_file"
fi
done
}
function run_single_test() {
local test_file="$1"
local test_name="$(basename "$test_file" .sh)"
print_info "Running test: $test_name"
if timeout 300 bash "$test_file"; then
print_success "✅ $test_name PASSED"
TESTS_PASSED=$((TESTS_PASSED + 1))
else
print_error "❌ $test_name FAILED"
TESTS_FAILED=$((TESTS_FAILED + 1))
fi
}
function generate_test_report() {
local total_tests=$((TESTS_PASSED + TESTS_FAILED + TESTS_SKIPPED))
print_header "Test Results Summary"
print_info "Total Tests: $total_tests"
print_success "Passed: $TESTS_PASSED"
print_error "Failed: $TESTS_FAILED"
print_warning "Skipped: $TESTS_SKIPPED"
# Generate JSON report
cat > "$TEST_RESULTS_FILE" <<EOF
{
"timestamp": "$(date -Iseconds)",
"total_tests": $total_tests,
"passed": $TESTS_PASSED,
"failed": $TESTS_FAILED,
"skipped": $TESTS_SKIPPED,
"success_rate": $(awk "BEGIN {printf \"%.2f\", ($TESTS_PASSED/$total_tests)*100}")
}
EOF
print_info "Test report saved to: $TEST_RESULTS_FILE"
}
# Main execution
function main() {
print_header "TSYS FetchApply Test Suite"
# Parse command line arguments
local test_type="${1:-all}"
case "$test_type" in
"unit")
run_test_suite "Unit" "$(dirname "$0")/unit"
;;
"integration")
run_test_suite "Integration" "$(dirname "$0")/integration"
;;
"security")
run_test_suite "Security" "$(dirname "$0")/security"
;;
"validation")
run_test_suite "Validation" "$(dirname "$0")/validation"
;;
"all")
run_test_suite "Unit" "$(dirname "$0")/unit"
run_test_suite "Integration" "$(dirname "$0")/integration"
run_test_suite "Security" "$(dirname "$0")/security"
run_test_suite "Validation" "$(dirname "$0")/validation"
;;
*)
print_error "Usage: $0 [unit|integration|security|validation|all]"
exit 1
;;
esac
generate_test_report
# Exit with appropriate code
if [[ $TESTS_FAILED -gt 0 ]]; then
exit 1
else
exit 0
fi
}
# Run main if executed directly
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
main "$@"
fi
archive/KNELServerBuild/Project-Tests/security/2fa-validation.sh
Executable
+312
View File
@@ -0,0 +1,312 @@
#!/bin/bash
# Two-Factor Authentication Validation Test
# Validates 2FA configuration for SSH, Cockpit, and Webmin
set -euo pipefail
PROJECT_ROOT="$(dirname "$(realpath "${BASH_SOURCE[0]}")")/../.."
function test_2fa_packages() {
echo "🔍 Testing 2FA package installation..."
local packages=("libpam-google-authenticator" "qrencode")
local failed=0
for package in "${packages[@]}"; do
if dpkg -s "$package" 2>/dev/null | grep -q "^Status:.*installed"; then
echo "✅ Package installed: $package"
else
echo "❌ Package missing: $package"
((++failed))
fi
done
# Check if google-authenticator command exists
if command -v google-authenticator >/dev/null 2>&1; then
echo "✅ Google Authenticator command available"
else
echo "❌ Google Authenticator command not found"
((++failed))
fi
return $failed
}
function test_ssh_2fa_config() {
echo "🔍 Testing SSH 2FA configuration..."
local ssh_config="/etc/ssh/sshd_config"
local failed=0
# Check required SSH settings
if grep -q "^ChallengeResponseAuthentication yes" "$ssh_config"; then
echo "✅ ChallengeResponseAuthentication enabled"
else
echo "❌ ChallengeResponseAuthentication not enabled"
((++failed))
fi
if grep -q "^UsePAM yes" "$ssh_config"; then
echo "✅ UsePAM enabled"
else
echo "❌ UsePAM not enabled"
((++failed))
fi
if grep -q "^AuthenticationMethods publickey,keyboard-interactive" "$ssh_config"; then
echo "✅ AuthenticationMethods configured for 2FA"
else
echo "❌ AuthenticationMethods not configured for 2FA"
((++failed))
fi
return $failed
}
function test_pam_2fa_config() {
echo "🔍 Testing PAM 2FA configuration..."
local pam_sshd="/etc/pam.d/sshd"
local failed=0
# Check if PAM includes Google Authenticator
if grep -q "pam_google_authenticator.so" "$pam_sshd"; then
echo "✅ PAM Google Authenticator module configured"
else
echo "❌ PAM Google Authenticator module not configured"
((++failed))
fi
# Check if nullok is present (allows users without 2FA setup)
if grep -q "pam_google_authenticator.so nullok" "$pam_sshd"; then
echo "✅ PAM nullok option configured (allows gradual rollout)"
else
echo "⚠️ PAM nullok option not configured (immediate enforcement)"
fi
return $failed
}
function test_cockpit_2fa_config() {
echo "🔍 Testing Cockpit 2FA configuration..."
local cockpit_config="/etc/cockpit/cockpit.conf"
local cockpit_pam="/etc/pam.d/cockpit"
local failed=0
# Check if Cockpit is installed
if ! command -v cockpit-ws >/dev/null 2>&1; then
echo "⚠️ Cockpit not installed, skipping test"
return 0
fi
# Check Cockpit configuration
if [[ -f "$cockpit_config" ]]; then
echo "✅ Cockpit configuration file exists"
else
echo "❌ Cockpit configuration file missing"
((++failed))
fi
# Check Cockpit PAM configuration
if [[ -f "$cockpit_pam" ]] && grep -q "pam_google_authenticator.so" "$cockpit_pam"; then
echo "✅ Cockpit PAM 2FA configured"
else
echo "❌ Cockpit PAM 2FA not configured"
((++failed))
fi
return $failed
}
function test_webmin_2fa_config() {
echo "🔍 Testing Webmin 2FA configuration..."
local webmin_config="/etc/webmin/miniserv.conf"
local failed=0
# Check if Webmin is installed
if [[ ! -f "$webmin_config" ]]; then
echo "⚠️ Webmin not installed, skipping test"
return 0
fi
# Check Webmin 2FA settings
if grep -q "^twofactor_provider=totp" "$webmin_config"; then
echo "✅ Webmin TOTP provider configured"
else
echo "❌ Webmin TOTP provider not configured"
((++failed))
fi
if grep -q "^twofactor=1" "$webmin_config"; then
echo "✅ Webmin 2FA enabled"
else
echo "❌ Webmin 2FA not enabled"
((++failed))
fi
return $failed
}
function test_user_2fa_setup() {
echo "🔍 Testing user 2FA setup preparation..."
local users=("localuser" "root")
local failed=0
for user in "${users[@]}"; do
if id "$user" &>/dev/null; then
local user_home; user_home="$(getent passwd "$user" | cut -d: -f6)"
# Check if setup script exists
if [[ -f "/tmp/setup-2fa-$user.sh" ]]; then
echo "✅ 2FA setup script exists for user: $user"
else
echo "❌ 2FA setup script missing for user: $user"
((++failed))
fi
# Check if instructions exist
if [[ -n "$user_home" && -f "$user_home/2fa-setup-instructions.txt" ]]; then
echo "✅ 2FA instructions exist for user: $user"
else
echo "❌ 2FA instructions missing for user: $user"
((++failed))
fi
else
echo "⚠️ User $user not found, skipping"
fi
done
return $failed
}
function test_service_status() {
echo "🔍 Testing service status..."
local failed=0
# Test SSH service
if systemctl is-active sshd >/dev/null 2>&1; then
echo "✅ SSH service is running"
else
echo "❌ SSH service is not running"
((++failed))
fi
# Test SSH configuration
if sshd -t 2>/dev/null; then
echo "✅ SSH configuration is valid"
else
echo "❌ SSH configuration is invalid"
((++failed))
fi
# Test Cockpit service if installed
if systemctl is-enabled cockpit.socket >/dev/null 2>&1; then
if systemctl is-active cockpit.socket >/dev/null 2>&1; then
echo "✅ Cockpit service is running"
else
echo "❌ Cockpit service is not running"
((++failed))
fi
fi
# Test Webmin service if installed
if systemctl is-enabled webmin >/dev/null 2>&1; then
if systemctl is-active webmin >/dev/null 2>&1; then
echo "✅ Webmin service is running"
else
echo "❌ Webmin service is not running"
((++failed))
fi
fi
return $failed
}
function test_backup_existence() {
echo "🔍 Testing backup existence..."
local backup_dir="/root/backup"
local failed=0
if [[ -d "$backup_dir" ]]; then
# Look for recent 2FA backups
local recent_backups=$(find "$backup_dir" -name "2fa-*" -type d -newer /etc/ssh/sshd_config 2>/dev/null | wc -l)
if [[ $recent_backups -gt 0 ]]; then
echo "✅ Recent 2FA backup found in $backup_dir"
else
echo "⚠️ No recent 2FA backups found"
fi
else
echo "❌ Backup directory does not exist"
((++failed))
fi
return $failed
}
function test_2fa_enforcement() {
echo "🔍 Testing 2FA enforcement level..."
local pam_sshd="/etc/pam.d/sshd"
# Check if nullok is used (allows users without 2FA)
if grep -q "pam_google_authenticator.so nullok" "$pam_sshd"; then
echo "⚠️ 2FA enforcement: GRADUAL (nullok allows users without 2FA)"
echo " Users can log in without 2FA during setup phase"
else
echo "✅ 2FA enforcement: STRICT (all users must have 2FA)"
echo " All users must have 2FA configured to log in"
fi
return 0
}
# Main test execution
function main() {
echo "🔒 Running Two-Factor Authentication Validation Tests"
echo "=================================================="
local total_failures=0
# Run all 2FA validation tests
test_2fa_packages || ((total_failures++))
test_ssh_2fa_config || ((total_failures++))
test_pam_2fa_config || ((total_failures++))
test_cockpit_2fa_config || ((total_failures++))
test_webmin_2fa_config || ((total_failures++))
test_user_2fa_setup || ((total_failures++))
test_service_status || ((total_failures++))
test_backup_existence || ((total_failures++))
test_2fa_enforcement || ((total_failures++))
echo "=================================================="
if [[ $total_failures -eq 0 ]]; then
echo "✅ All 2FA validation tests passed"
echo ""
echo "📋 Next Steps:"
echo "1. Run user setup scripts: /tmp/setup-2fa-*.sh"
echo "2. Test 2FA login from another terminal"
echo "3. Remove nullok from PAM config for strict enforcement"
exit 0
else
echo "❌ $total_failures 2FA validation tests failed"
echo ""
echo "🔧 Troubleshooting:"
echo "1. Re-run secharden-2fa.sh script"
echo "2. Check system logs: journalctl -u sshd"
echo "3. Verify package installation"
exit 1
fi
}
# Run main if executed directly
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
main "$@"
fi
archive/KNELServerBuild/Project-Tests/security/https-enforcement.sh
Executable
+148
View File
@@ -0,0 +1,148 @@
#!/bin/bash
# HTTPS Enforcement Security Test
# Validates that all scripts use HTTPS instead of HTTP
set -euo pipefail
PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
FRAMEWORK_INCLUDES="$PROJECT_ROOT/vendor/git@git.knownelement.com/29418/KNEL/KNELShellFramework/Framework-Includes"
function test_no_http_urls() {
echo "🔍 Checking for HTTP URLs in scripts..."
local http_violations=0
local script_dirs=("$PROJECT_ROOT/ProjectCode" "$FRAMEWORK_INCLUDES" "$PROJECT_ROOT/Project-Includes")
for dir in "${script_dirs[@]}"; do
if [[ -d "$dir" ]]; then
# Find HTTP URLs in shell scripts (excluding comments)
while IFS= read -r -d '' file; do
# grep -n prefixes "linenum:", so the comment filter must allow
# for that prefix before the leading '#' of a comment line.
if grep -n "http://" "$file" | grep -vE '^[0-9]+:[[:space:]]*#' | grep -v "schema.org" | grep -v "xmlns"; then
echo "❌ HTTP URL found in: $file"
((++http_violations))
fi
done < <(find "$dir" -name "*.sh" -type f -print0)
fi
done
if [[ $http_violations -eq 0 ]]; then
echo "✅ No HTTP URLs found in active scripts"
return 0
else
echo "❌ Found $http_violations HTTP URL violations"
return 1
fi
}
function test_https_urls_valid() {
echo "🔍 Validating HTTPS URLs are accessible..."
local script_dirs=("$PROJECT_ROOT/ProjectCode" "$FRAMEWORK_INCLUDES" "$PROJECT_ROOT/Project-Includes")
local https_failures=0
# Extract HTTPS URLs from scripts
for dir in "${script_dirs[@]}"; do
if [[ -d "$dir" ]]; then
while IFS= read -r -d '' file; do
# Extract HTTPS URLs from non-comment lines
grep -o "https://[^[:space:]\"']*" "$file" | grep -v "schema.org" | while read -r url; do
# Test connectivity with timeout
if timeout 30 curl -s --head --fail "$url" >/dev/null 2>&1; then
echo "✅ HTTPS URL accessible: $url"
else
echo "❌ HTTPS URL not accessible: $url"
((++https_failures))
fi
done
done < <(find "$dir" -name "*.sh" -type f -print0)
fi
done
return $https_failures
}
function test_ssl_certificate_validation() {
echo "🔍 Testing SSL certificate validation..."
local test_urls=(
"https://archive.ubuntu.com"
"https://linux.dell.com"
"https://download.proxmox.com"
)
local ssl_failures=0
for url in "${test_urls[@]}"; do
# Verify TLS is required and the certificate chain is valid. Do NOT use
# --cert-status: that requires OCSP stapling, which many valid CDNs do
# not provide, producing false negatives for otherwise-valid certs.
if curl -s --fail --ssl-reqd "$url" >/dev/null 2>&1; then
echo "✅ SSL certificate valid: $url"
else
echo "❌ SSL certificate validation failed: $url"
((++ssl_failures))
fi
done
return $ssl_failures
}
function test_deployment_security() {
echo "🔍 Testing deployment method security..."
local readme_file="$PROJECT_ROOT/README.md"
if [[ -f "$readme_file" ]]; then
# Check for insecure curl | bash patterns
if grep -q "curl.*|.*bash" "$readme_file" || grep -q "wget.*|.*bash" "$readme_file"; then
echo "❌ Insecure deployment method found in README.md"
return 1
else
echo "✅ Secure deployment method in README.md"
fi
# Check for git clone method
if grep -q "git clone" "$readme_file"; then
echo "✅ Git clone deployment method found"
return 0
else
echo "⚠️ No git clone method found in README.md"
return 1
fi
else
echo "❌ README.md not found"
return 1
fi
}
# Main test execution
function main() {
echo "🔒 Running HTTPS Enforcement Security Tests"
echo "=========================================="
local total_failures=0
# Run all security tests
test_no_http_urls || ((total_failures++))
test_https_urls_valid || ((total_failures++))
test_ssl_certificate_validation || ((total_failures++))
test_deployment_security || ((total_failures++))
echo "=========================================="
if [[ $total_failures -eq 0 ]]; then
echo "✅ All HTTPS enforcement security tests passed"
exit 0
else
echo "❌ $total_failures HTTPS enforcement security tests failed"
exit 1
fi
}
# Run main if executed directly
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
main "$@"
fi
archive/KNELServerBuild/Project-Tests/unit/framework-functions.sh
Executable
+179
View File
@@ -0,0 +1,179 @@
#!/bin/bash
# Framework Functions Unit Tests
# Tests core framework functionality
set -euo pipefail
PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
# Source framework functions from the vendored KNELShellFramework
FRAMEWORK_INCLUDES="$PROJECT_ROOT/vendor/git@git.knownelement.com/29418/KNEL/KNELShellFramework/Framework-Includes"
source "$FRAMEWORK_INCLUDES/Logging.sh" 2>/dev/null || echo "Warning: Logging.sh not found"
source "$FRAMEWORK_INCLUDES/PrettyPrint.sh" 2>/dev/null || echo "Warning: PrettyPrint.sh not found"
source "$FRAMEWORK_INCLUDES/ErrorHandling.sh" 2>/dev/null || echo "Warning: ErrorHandling.sh not found"
function test_logging_variables() {
echo "🔍 Testing logging variables..."
if [[ -n "${CURRENT_TIMESTAMP:-}" ]]; then
echo "✅ CURRENT_TIMESTAMP is set"
else
echo "❌ CURRENT_TIMESTAMP is not set"
return 1
fi
if [[ -n "${LOGFILENAME:-}" ]]; then
echo "✅ LOGFILENAME is set"
else
echo "❌ LOGFILENAME is not set"
return 1
fi
return 0
}
function test_pretty_print_functions() {
echo "🔍 Testing pretty print functions..."
# Test if pretty print functions exist
if command -v print_info >/dev/null 2>&1; then
print_info "Test info message" >/dev/null 2>&1 || true
echo "✅ print_info function exists"
else
echo "❌ print_info function missing"
return 1
fi
if command -v print_error >/dev/null 2>&1; then
print_error "Test error message" >/dev/null 2>&1 || true
echo "✅ print_error function exists"
else
echo "❌ print_error function missing"
return 1
fi
return 0
}
function test_error_handling() {
echo "🔍 Testing error handling..."
# Test if error handling functions exist
if command -v error_out >/dev/null 2>&1; then
echo "✅ error_out function exists"
else
echo "❌ error_out function missing"
return 1
fi
if command -v handle_failure >/dev/null 2>&1; then
echo "✅ handle_failure function exists"
else
echo "❌ handle_failure function missing"
return 1
fi
# Test bash strict mode is set
if [[ "$-" == *e* ]]; then
echo "✅ Bash strict mode (set -e) is enabled"
else
echo "❌ Bash strict mode (set -e) not enabled"
return 1
fi
if [[ "$-" == *u* ]]; then
echo "✅ Bash unset variable checking (set -u) is enabled"
else
echo "❌ Bash unset variable checking (set -u) not enabled"
return 1
fi
return 0
}
function test_framework_includes_exist() {
echo "🔍 Testing framework includes exist..."
local required_includes=(
"Logging.sh"
"PrettyPrint.sh"
"ErrorHandling.sh"
"PreflightCheck.sh"
)
local missing_files=0
for include_file in "${required_includes[@]}"; do
if [[ -f "$FRAMEWORK_INCLUDES/$include_file" ]]; then
echo "✅ Framework include exists: $include_file"
else
echo "❌ Framework include missing: $include_file"
((++missing_files))
fi
done
return $missing_files
}
function test_syntax_validation() {
echo "🔍 Testing script syntax validation..."
local syntax_errors=0
local script_dirs=(
"$FRAMEWORK_INCLUDES"
"$PROJECT_ROOT/Project-Includes"
"$PROJECT_ROOT/ProjectCode"
)
for dir in "${script_dirs[@]}"; do
if [[ -d "$dir" ]]; then
while IFS= read -r -d '' file; do
# Skip files that aren't bash scripts despite a .sh extension (e.g. PHP agents)
local shebang
shebang="$(head -c 32 "$file" 2>/dev/null)"
case "$shebang" in
*php*|*python*|*perl*) continue ;;
esac
if bash -n "$file" 2>/dev/null; then
echo "✅ Syntax valid: $(basename "$file")"
else
echo "❌ Syntax error in: $(basename "$file")"
((++syntax_errors))
fi
done < <(find "$dir" -name "*.sh" -type f -print0)
fi
done
return $syntax_errors
}
# Main test execution
function main() {
echo "🧪 Running Framework Functions Unit Tests"
echo "========================================"
local total_failures=0
# Run all unit tests
test_framework_includes_exist || ((total_failures++))
test_logging_variables || ((total_failures++))
test_pretty_print_functions || ((total_failures++))
test_error_handling || ((total_failures++))
test_syntax_validation || ((total_failures++))
echo "========================================"
if [[ $total_failures -eq 0 ]]; then
echo "✅ All framework function unit tests passed"
exit 0
else
echo "❌ $total_failures framework function unit tests failed"
exit 1
fi
}
# Run main if executed directly
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
main "$@"
fi
archive/KNELServerBuild/Project-Tests/unit/safe-download.sh
Executable
+297
View File
@@ -0,0 +1,297 @@
#!/bin/bash
# Safe Download Framework Unit Tests
# Tests the SafeDownload.sh framework functionality
set -euo pipefail
PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
# Source framework functions from the vendored KNELShellFramework
FRAMEWORK_INCLUDES="$PROJECT_ROOT/vendor/git@git.knownelement.com/29418/KNEL/KNELShellFramework/Framework-Includes"
# The vendored PrettyPrint only defines print_info/print_error, but SafeDownload.sh
# calls print_success/print_warning; define lightweight shims before sourcing.
function print_success() { echo "✅ $1"; }
function print_warning() { echo "⚠️ $1"; }
source "$FRAMEWORK_INCLUDES/SafeDownload.sh"
function test_network_connectivity() {
echo "🔍 Testing network connectivity..."
if check_url_accessibility "https://github.com"; then
echo "✅ Network connectivity test passed"
return 0
else
echo "❌ Network connectivity test failed"
return 1
fi
}
function test_url_accessibility() {
echo "🔍 Testing URL accessibility..."
local test_urls=(
"https://archive.ubuntu.com"
"https://github.com"
)
local failed=0
for url in "${test_urls[@]}"; do
if check_url_accessibility "$url"; then
echo "✅ URL accessible: $url"
else
echo "❌ URL not accessible: $url"
((++failed))
fi
done
return $failed
}
function test_safe_download() {
echo "🔍 Testing safe download functionality..."
local test_url="https://raw.githubusercontent.com/torvalds/linux/master/README"
local test_dest="/tmp/test-download-$$"
local failed=0
# Test successful download
if safe_download "$test_url" "$test_dest"; then
echo "✅ Safe download successful"
# Verify file exists and has content
if [[ -f "$test_dest" && -s "$test_dest" ]]; then
echo "✅ Downloaded file exists and has content"
else
echo "❌ Downloaded file is missing or empty"
((++failed))
fi
# Cleanup
rm -f "$test_dest"
else
echo "❌ Safe download failed"
((++failed))
fi
# Test download with invalid URL
if safe_download "https://invalid.example.com/nonexistent" "/tmp/test-invalid-$$" 2>/dev/null; then
echo "❌ Invalid URL download should have failed"
((++failed))
else
echo "✅ Invalid URL download failed as expected"
fi
return $failed
}
function test_checksum_verification() {
echo "🔍 Testing checksum verification..."
local test_file="/tmp/test-checksum-$$"
local test_content="Hello, World!"
local expected_checksum="dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f"
local failed=0
# Create test file with known content
echo -n "$test_content" > "$test_file"
# Test correct checksum
if verify_checksum "$test_file" "$expected_checksum"; then
echo "✅ Correct checksum verification passed"
else
echo "❌ Correct checksum verification failed"
((++failed))
fi
# Test incorrect checksum
if verify_checksum "$test_file" "invalid_checksum" 2>/dev/null; then
echo "❌ Incorrect checksum should have failed"
((++failed))
else
echo "✅ Incorrect checksum verification failed as expected"
fi
# Test missing file
if verify_checksum "/tmp/nonexistent-file-$$" "$expected_checksum" 2>/dev/null; then
echo "❌ Missing file checksum should have failed"
((++failed))
else
echo "✅ Missing file checksum verification failed as expected"
fi
# Cleanup
rm -f "$test_file"
return $failed
}
function test_batch_download() {
echo "🔍 Testing batch download functionality..."
# Create test download map
declare -A test_downloads=(
["https://raw.githubusercontent.com/torvalds/linux/master/README"]="/tmp/batch-test-1-$$"
["https://raw.githubusercontent.com/torvalds/linux/master/COPYING"]="/tmp/batch-test-2-$$"
)
local failed=0
# Test batch download
if batch_download test_downloads; then
echo "✅ Batch download successful"
# Verify all files were downloaded
for file in "${test_downloads[@]}"; do
if [[ -f "$file" && -s "$file" ]]; then
echo "✅ Batch file downloaded: $(basename "$file")"
else
echo "❌ Batch file missing: $(basename "$file")"
((++failed))
fi
done
# Cleanup
for file in "${test_downloads[@]}"; do
rm -f "$file"
done
else
echo "❌ Batch download failed"
((++failed))
fi
return $failed
}
function test_config_backup_and_restore() {
echo "🔍 Testing config backup and restore..."
local test_config="/tmp/test-config-$$"
local original_content="Original configuration"
local failed=0
# Create original config file
echo "$original_content" > "$test_config"
# Test safe config download (this will fail with invalid URL, triggering restore)
if safe_config_download "https://invalid.example.com/config" "$test_config" ".test-backup" 2>/dev/null; then
echo "❌ Invalid config download should have failed"
((++failed))
else
echo "✅ Invalid config download failed as expected"
# Verify original file was restored
if [[ -f "$test_config" ]] && grep -q "$original_content" "$test_config"; then
echo "✅ Original config was restored after failed download"
else
echo "❌ Original config was not restored properly"
((++failed))
fi
fi
# Cleanup
rm -f "$test_config" "$test_config.test-backup"
return $failed
}
function test_download_error_handling() {
echo "🔍 Testing download error handling..."
local failed=0
# Test download with missing parameters
if safe_download "" "/tmp/test" 2>/dev/null; then
echo "❌ Download with empty URL should have failed"
((++failed))
else
echo "✅ Download with empty URL failed as expected"
fi
if safe_download "https://example.com" "" 2>/dev/null; then
echo "❌ Download with empty destination should have failed"
((++failed))
else
echo "✅ Download with empty destination failed as expected"
fi
# Test download to read-only location (should fail). Only meaningful for
# non-root users: root bypasses filesystem permissions, so the expected
# write failure never happens and the assertion is invalid.
if [[ $EUID -eq 0 ]]; then
echo "⏭️ Skipping read-only-location test (running as root; root bypasses FS perms)"
elif safe_download "https://github.com" "/test-readonly-$$" 2>/dev/null; then
echo "❌ Download to read-only location should have failed"
((++failed))
else
echo "✅ Download to read-only location failed as expected"
fi
return $failed
}
function test_download_performance() {
echo "🔍 Testing download performance..."
local test_url="https://raw.githubusercontent.com/torvalds/linux/master/README"
local test_dest="/tmp/perf-test-$$"
local start_time end_time duration
start_time=$(date +%s)
if safe_download "$test_url" "$test_dest"; then
end_time=$(date +%s)
duration=$((end_time - start_time))
echo "✅ Download completed in ${duration}s"
if [[ $duration -gt 30 ]]; then
echo "⚠️ Download took longer than expected (>30s)"
else
echo "✅ Download performance acceptable"
fi
# Cleanup
rm -f "$test_dest"
return 0
else
echo "❌ Performance test download failed"
return 1
fi
}
# Main test execution
function main() {
echo "🧪 Running Safe Download Framework Unit Tests"
echo "==========================================="
local total_failures=0
# Run all tests
test_network_connectivity || ((total_failures++))
test_url_accessibility || ((total_failures++))
test_safe_download || ((total_failures++))
test_checksum_verification || ((total_failures++))
test_batch_download || ((total_failures++))
test_config_backup_and_restore || ((total_failures++))
test_download_error_handling || ((total_failures++))
test_download_performance || ((total_failures++))
echo "==========================================="
if [[ $total_failures -eq 0 ]]; then
echo "✅ All safe download framework tests passed"
exit 0
else
echo "❌ $total_failures safe download framework tests failed"
exit 1
fi
}
# Run main if executed directly
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
main "$@"
fi
archive/KNELServerBuild/Project-Tests/validation/dns-ntp-redundancy.sh
+202
View File
@@ -0,0 +1,202 @@
#!/bin/bash
# Redundant DNS/NTP Validation Test
# Validates that the host is configured to use the redundant pfv-netinfra-01/02
# pair for name resolution and time, and that both servers actually answer.
set -euo pipefail
PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
# The authoritative pair (pfv-netinfra-01 / pfv-netinfra-02).
DNS_PRIMARY="192.168.3.252"
DNS_SECONDARY="192.168.3.253"
NTP_PRIMARY="192.168.3.252"
NTP_SECONDARY="192.168.3.253"
RESOLV_CONF="/etc/resolv.conf"
NTP_CONF="/etc/ntpsec/ntp.conf"
# A name every recursive resolver must be able to resolve.
DNS_PROBE_NAME="github.com"
failed=0
have() { command -v "$1" >/dev/null 2>&1; }
# --- Configuration assertions -------------------------------------------------
function test_dns_config_present() {
echo "🔍 Checking $RESOLV_CONF ..."
local problems=0
if [[ -L "$RESOLV_CONF" ]]; then
echo "❌ $RESOLV_CONF is a symlink (would be overwritten by a resolver manager)"
((++problems))
elif [[ ! -f "$RESOLV_CONF" ]]; then
echo "❌ $RESOLV_CONF missing"
((++problems))
fi
for ns in "$DNS_PRIMARY" "$DNS_SECONDARY"; do
if grep -Eq "^[[:space:]]*nameserver[[:space:]]+$ns" "$RESOLV_CONF" 2>/dev/null; then
echo "✅ nameserver $ns configured"
else
echo "❌ nameserver $ns NOT in $RESOLV_CONF"
((++problems))
fi
done
return $problems
}
function test_ntp_config_present() {
echo "🔍 Checking $NTP_CONF ..."
if [[ ! -f "$NTP_CONF" ]]; then
echo "❌ $NTP_CONF missing (is ntpsec installed?)"
return 1
fi
local problems=0
for s in "$NTP_PRIMARY" "$NTP_SECONDARY"; do
if grep -Eq "^[[:space:]]*(server|pool)[[:space:]]+$s" "$NTP_CONF"; then
echo "✅ NTP server $s configured"
else
echo "❌ NTP server $s NOT in $NTP_CONF"
((++problems))
fi
done
return $problems
}
# --- Functional assertions: each server actually answers ----------------------
function _dns_resolves() {
# $1 = server ip. Returns 0 if it resolves DNS_PROBE_NAME.
local server="$1"
if have dig; then
dig @"$server" +short +time=4 +tries=1 "$DNS_PROBE_NAME" A 2>/dev/null | grep -Eq '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+'
elif have nslookup; then
nslookup "$DNS_PROBE_NAME" "$server" 2>/dev/null | grep -Eq 'Address:[[:space:]]*[0-9]'
elif have host; then
host "$DNS_PROBE_NAME" "$server" 2>/dev/null | grep -Eq 'has address'
else
# Last resort: the resolver itself.
getent ahostsv4 "$DNS_PROBE_NAME" >/dev/null 2>&1
fi
}
function test_dns_servers_answer() {
echo "🔍 Probing DNS servers ..."
local problems=0
for ns in "$DNS_PRIMARY" "$DNS_SECONDARY"; do
if _dns_resolves "$ns"; then
echo "✅ $ns resolves $DNS_PROBE_NAME"
else
echo "❌ $ns did not resolve $DNS_PROBE_NAME"
((++problems))
fi
done
return $problems
}
function _ntp_answers() {
# $1 = server ip. Returns 0 if it responds to a time query.
local server="$1"
if have ntpdate; then
timeout 8 ntpdate -q "$server" 2>/dev/null | grep -Eq 'no-leap|leap'
elif have sntp; then
timeout 8 sntp -t 4 "$server" >/dev/null 2>&1
elif have chronyc; then
# NTS/chrony not expected here, but be tolerant.
chronyc -n -h "$server" tracking >/dev/null 2>&1
else
return 2 # cannot test
fi
}
function test_ntp_servers_answer() {
echo "🔍 Probing NTP servers ..."
local problems=0
for s in "$NTP_PRIMARY" "$NTP_SECONDARY"; do
if _ntp_answers "$s"; then
echo "✅ NTP $s responds to time query"
else
echo "❌ $s did not respond to NTP query"
((++problems))
fi
done
return $problems
}
# --- End-to-end: the host is actually USING the pair --------------------------
function test_resolver_endtoend() {
echo "🔍 End-to-end resolution via $RESOLV_CONF ..."
if getent ahostsv4 "$DNS_PROBE_NAME" >/dev/null 2>&1; then
echo "✅ Host resolves $DNS_PROBE_NAME via configured resolver"
return 0
else
echo "❌ Host cannot resolve $DNS_PROBE_NAME via configured resolver"
return 1
fi
}
function test_ntp_daemon_peers() {
echo "🔍 NTP daemon peer list ..."
local peers
if have ntpq; then
peers="$(ntpq -pn 2>/dev/null || true)"
elif have chronyc; then
peers="$(chronyc -n sources 2>/dev/null || true)"
else
echo "⚠️ No ntpq/chronyc available; skipping daemon peer check"
return 0
fi
local problems=0
for s in "$NTP_PRIMARY" "$NTP_SECONDARY"; do
if echo "$peers" | grep -Eq "^\\s*${s//./\\.}"; then
echo "✅ NTP daemon has peer $s"
else
echo "❌ NTP daemon is NOT tracking $s"
((++problems))
fi
done
# Sync status is informational only: a freshly started daemon needs several
# polls before the reach counter stabilises, so we warn rather than fail.
if echo "$peers" | grep -Eq '\*'; then
echo "✅ NTP daemon reports a synced peer"
else
echo "⚠️ NTP daemon not yet synced (normal for a few minutes after restart)"
fi
return $problems
}
# --- Main ---------------------------------------------------------------------
function main() {
echo "🛰️ Running Redundant DNS/NTP Validation Tests"
echo "================================================"
local total_failures=0
test_dns_config_present || ((++total_failures))
test_ntp_config_present || ((++total_failures))
test_dns_servers_answer || ((++total_failures))
test_ntp_servers_answer || ((++total_failures))
test_resolver_endtoend || ((++total_failures))
test_ntp_daemon_peers || ((++total_failures))
echo "================================================"
if [[ $total_failures -eq 0 ]]; then
echo "✅ All redundant DNS/NTP validation tests passed"
exit 0
else
echo "❌ $total_failures redundant DNS/NTP tests failed"
exit 1
fi
}
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
main "$@"
fi
archive/KNELServerBuild/Project-Tests/validation/system-requirements.sh
Executable
+142
View File
@@ -0,0 +1,142 @@
#!/bin/bash
# System Requirements Validation Test
# Validates minimum system requirements before deployment
set -euo pipefail
# Test configuration
MIN_RAM_GB=2
MIN_DISK_GB=10
REQUIRED_COMMANDS=("curl" "wget" "git" "systemctl" "apt-get")
# Test functions
function test_memory_requirements() {
local total_mem_kb=$(grep MemTotal /proc/meminfo | awk '{print $2}')
local total_mem_gb=$((total_mem_kb / 1024 / 1024))
if [[ $total_mem_gb -ge $MIN_RAM_GB ]]; then
echo "✅ Memory requirement met: ${total_mem_gb}GB >= ${MIN_RAM_GB}GB"
return 0
else
echo "❌ Memory requirement not met: ${total_mem_gb}GB < ${MIN_RAM_GB}GB"
return 1
fi
}
function test_disk_space() {
local available_gb=$(df / | tail -1 | awk '{print int($4/1024/1024)}')
if [[ $available_gb -ge $MIN_DISK_GB ]]; then
echo "✅ Disk space requirement met: ${available_gb}GB >= ${MIN_DISK_GB}GB"
return 0
else
echo "❌ Disk space requirement not met: ${available_gb}GB < ${MIN_DISK_GB}GB"
return 1
fi
}
function test_required_commands() {
local failed=0
for cmd in "${REQUIRED_COMMANDS[@]}"; do
if command -v "$cmd" >/dev/null 2>&1; then
echo "✅ Required command available: $cmd"
else
echo "❌ Required command missing: $cmd"
((++failed))
fi
done
return $failed
}
function test_os_compatibility() {
if [[ -f /etc/os-release ]]; then
local os_id=$(grep "^ID=" /etc/os-release | cut -d'=' -f2 | tr -d '"')
local os_version=$(grep "^VERSION_ID=" /etc/os-release | cut -d'=' -f2 | tr -d '"')
case "$os_id" in
ubuntu|debian)
echo "✅ OS compatibility: $os_id $os_version (supported)"
return 0
;;
*)
echo "⚠️ OS compatibility: $os_id $os_version (may work, not fully tested)"
return 0
;;
esac
else
echo "❌ Cannot determine OS version"
return 1
fi
}
function test_network_connectivity() {
local test_urls=(
"https://archive.ubuntu.com"
"https://linux.dell.com"
"https://download.proxmox.com"
"https://github.com"
)
local failed=0
for url in "${test_urls[@]}"; do
if curl -s --connect-timeout 10 --max-time 30 "$url" >/dev/null 2>&1; then
echo "✅ Network connectivity: $url"
else
echo "❌ Network connectivity failed: $url"
((++failed))
fi
done
return $failed
}
function test_permissions() {
local test_dirs=("/etc" "/usr/local/bin" "/var/log")
local failed=0
for dir in "${test_dirs[@]}"; do
if [[ -w "$dir" ]]; then
echo "✅ Write permission: $dir"
else
echo "❌ Write permission denied: $dir"
((++failed))
fi
done
return $failed
}
# Main test execution
function main() {
echo "🔍 Running System Requirements Validation"
echo "========================================"
local total_failures=0
# Run all validation tests
test_memory_requirements || ((total_failures++))
test_disk_space || ((total_failures++))
test_required_commands || ((total_failures++))
test_os_compatibility || ((total_failures++))
test_network_connectivity || ((total_failures++))
test_permissions || ((total_failures++))
echo "========================================"
if [[ $total_failures -eq 0 ]]; then
echo "✅ All system requirements validation tests passed"
exit 0
else
echo "❌ $total_failures system requirements validation tests failed"
exit 1
fi
}
# Run main if executed directly
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
main "$@"
fi
archive/KNELServerBuild/Project-Tests/vm-validation.sh
Executable
+330
View File
@@ -0,0 +1,330 @@
#!/usr/bin/bash
#
# vm-validation.sh
#
# End-to-end validation driver for KNELServerBuild on a sandbox VM.
#
# This script drives a Proxmox VM through: snapshot -> deploy -> validate, with
# one-command rollback. It is designed to be re-run after code fixes are pushed.
#
# DESIGN: deployment is GIT-BASED. The VM clones (or pulls) the public repo
# itself, exactly as a real fresh server would — so the result is identical no
# matter who runs this script (no reliance on a local working copy or rsync).
# All SSH/SCP access goes through Project-Tests/remote.sh; never call ssh here.
#
# USAGE:
# # Discover the numeric VMID on Proxmox:
# ./Project-Tests/vm-validation.sh find-vmid
#
# # Full loop (snapshot + deploy + validate), auto-rollback on failure:
# VM_ID=6000 ./Project-Tests/vm-validation.sh all
#
# # Individual steps:
# VM_ID=6000 ./Project-Tests/vm-validation.sh snapshot
# VM_ID=6000 ./Project-Tests/vm-validation.sh deploy
# VM_ID=6000 ./Project-Tests/vm-validation.sh validate
# VM_ID=6000 ./Project-Tests/vm-validation.sh rollback [snapshot-name]
#
# # Clean re-deploy from scratch (delete + re-clone on VM):
# VM_ID=6000 CLEAN_CLONE=1 ./Project-Tests/vm-validation.sh deploy
#
# CONFIG (override via env, all have sensible defaults):
# PROX_HOST Proxmox node hostname (default: pfv-tsys5)
# PROX_USER SSH user on Proxmox (default: root)
# VM_NAME VM name for VMID lookup/logging (default: sectestbed-sandbox)
# VM_IP VM IP for SSH (default: 192.168.3.50)
# VM_USER SSH user on the VM (default: localuser)
# VM_ID Numeric VMID on Proxmox (REQUIRED except for find-vmid)
# REPO_URL git URL the VM clones (default: https://git.knownelement.com/KNEL/KNELServerBuild.git)
# REMOTE_REPO clone dir under ~$VM_USER (default: KNELServerBuild)
# SNAP_PREFIX snapshot name prefix (default: pre-knel-deploy)
# CLEAN_CLONE if set, delete + re-clone on VM (default: unset)
#
set -uo pipefail
# ---------------------------------------------------------------------------
# Config
# ---------------------------------------------------------------------------
PROX_HOST="${PROX_HOST:-pfv-tsys5}"
PROX_USER="${PROX_USER:-root}"
VM_NAME="${VM_NAME:-sectestbed-sandbox}"
VM_IP="${VM_IP:-192.168.3.50}"
VM_USER="${VM_USER:-localuser}"
VM_ID="${VM_ID:-}"
REPO_URL="${REPO_URL:-https://git.knownelement.com/KNEL/KNELServerBuild.git}"
REMOTE_REPO="${REMOTE_REPO:-KNELServerBuild}"
SNAP_PREFIX="${SNAP_PREFIX:-pre-knel-deploy}"
ACCESS_PUBKEY="${ACCESS_PUBKEY:-$HOME/.ssh/id_ed25519.pub}"
# Re-inject the validation pubkey after each deploy (secharden-ssh replaces
# authorized_keys with the managed production key set, locking out the
# bootstrap/dev key). Set RESTORE_ACCESS=0 to disable.
RESTORE_ACCESS="${RESTORE_ACCESS:-1}"
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_SRC="$(cd "$HERE/.." && pwd)"
REMOTE="$HERE/remote.sh"
STAMP="$(date +%Y%m%d-%H%M%S)"
SNAP_NAME="${SNAP_PREFIX}-${STAMP}"
LOCAL_LOG_DIR="$REPO_SRC/logs/vm-validation"
mkdir -p "$LOCAL_LOG_DIR"
LOCAL_LOG="$LOCAL_LOG_DIR/run-${STAMP}.log"
# ---------------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------------
log() { printf '[%s] %s\n' "$(date +%H:%M:%S)" "$*" | tee -a "$LOCAL_LOG"; }
die() { log "ERROR: $*"; exit 1; }
# All remote access funnels through remote.sh.
vm() { bash "$REMOTE" vm "$@"; } # as $VM_USER (SSH)
vmroot() { bash "$REMOTE" vmroot "$@"; } # as root via sudo (SSH)
vmfile() { bash "$REMOTE" vm-file "$@"; } # run local script on VM (SSH)
vmguest() { bash "$REMOTE" vm-guest "$@"; } # as root via guest agent (no SSH/2FA)
prox() { bash "$REMOTE" prox "$@"; } # as $PROX_USER on Proxmox
require_vm_id() {
[[ -n "$VM_ID" ]] || die "VM_ID is required for this command. Find it with: $0 find-vmid"
}
wait_for_vm_ssh() {
log "Waiting for SSH on ${VM_USER}@${VM_IP} to come up..."
for i in $(seq 1 60); do
if vm 'true' >/dev/null 2>&1; then
log "SSH is up (after ${i} tries)."
return 0
fi
sleep 5
done
die "VM did not become SSH-reachable within 5 minutes."
}
# Resolve the ABSOLUTE path of the repo clone on the VM (as $VM_USER) and echo
# it. Using an absolute path avoids the '~' -> root's home trap under sudo.
resolve_remote_repo() {
local p
p="$(vm "cd ~/${REMOTE_REPO} 2>/dev/null && pwd" 2>/dev/null)"
[[ -n "$p" ]] || p="$(vmguest "cd ~${VM_USER}/${REMOTE_REPO} 2>/dev/null && pwd" 2>/dev/null)"
printf '%s' "$p"
}
# Re-inject the validation pubkey into ~$VM_USER/.ssh/authorized_keys OUT OF
# BAND via the Proxmox guest agent (qm guest exec runs as root inside the VM
# and does not depend on SSH). This is necessary because secharden-ssh replaces
# authorized_keys with the managed production key set, which would otherwise
# lock out the bootstrap key used to drive validation. No-op if SSH still works.
restore_vm_access() {
[[ "$RESTORE_ACCESS" = "1" ]] || { log "RESTORE_ACCESS=0; skipping access restore."; return 0; }
[[ -f "$ACCESS_PUBKEY" ]] || { log "WARN: ACCESS_PUBKEY not found ($ACCESS_PUBKEY); cannot restore access."; return 0; }
if vm 'true' >/dev/null 2>&1; then
log "SSH access already works; no need to restore."
return 0
fi
log "SSH access lost (expected after secharden-ssh). Restoring via Proxmox guest agent..."
local payload_b64
# Leading newline guards against the managed authorized_keys lacking a
# trailing newline (which would otherwise concatenate two keys into one).
payload_b64="$(printf '\n%s' "$(cat "$ACCESS_PUBKEY")" | base64 -w0)"
prox "qm guest exec $VM_ID -- /bin/sh -c 'echo $payload_b64 | base64 -d >> /home/${VM_USER}/.ssh/authorized_keys'" \
>/dev/null 2>&1 || { log "WARN: guest-agent key append failed."; return 0; }
prox "qm guest exec $VM_ID -- /bin/sh -c 'chown ${VM_USER}:${VM_USER} /home/${VM_USER}/.ssh/authorized_keys; chmod 600 /home/${VM_USER}/.ssh/authorized_keys'" \
>/dev/null 2>&1 || true
if vm 'true' >/dev/null 2>&1; then
log "Access restored."
return 0
fi
# If SSH still fails after re-injecting the key, 2FA is almost certainly the
# cause (secharden-2fa enforces publickey+keyboard-interactive, which no
# non-interactive SSH client can satisfy). That is expected and not fatal:
# the guest agent still gives us full out-of-band access for log fetch and
# the validation suite.
if vmguest 'grep -q "^AuthenticationMethods" /etc/ssh/sshd_config' >/dev/null 2>&1; then
log "SSH requires 2FA (expected after secharden-2fa); using guest agent for further access."
else
log "WARN: access still not working after restore and 2FA not detected. Check sshd_config."
fi
}
# ---------------------------------------------------------------------------
# Commands
# ---------------------------------------------------------------------------
cmd_find_vmid() {
log "Listing VMs on Proxmox host '$PROX_HOST' matching '$VM_NAME':"
prox 'qm list' 2>&1 | tee -a "$LOCAL_LOG" \
| { IFS= read -r header; echo "$header"; grep -i "$VM_NAME" || true; }
log "Set VM_ID=<number> env var based on the row above."
}
cmd_snapshot() {
require_vm_id
log "Creating snapshot '$SNAP_NAME' of VMID $VM_ID on $PROX_HOST..."
prox "qm snapshot $VM_ID $SNAP_NAME --vmstate 1" 2>&1 | tee -a "$LOCAL_LOG" \
|| die "Snapshot creation failed."
echo "$SNAP_NAME" > "$LOCAL_LOG_DIR/.last-snapshot"
log "Snapshot '$SNAP_NAME' recorded as rollback target."
}
cmd_rollback() {
require_vm_id
local target="${1:-$(cat "$LOCAL_LOG_DIR/.last-snapshot" 2>/dev/null || true)}"
[[ -n "$target" ]] || die "No snapshot name given and no .last-snapshot on disk."
log "Rolling back VMID $VM_ID to snapshot '$target'..."
# Proxmox rollback requires the VM to be stopped.
prox "qm stop $VM_ID" 2>&1 | tee -a "$LOCAL_LOG" || true
sleep 5
prox "qm rollback $VM_ID $target" 2>&1 | tee -a "$LOCAL_LOG" \
|| die "Rollback command failed."
log "Starting VMID $VM_ID..."
prox "qm start $VM_ID" 2>&1 | tee -a "$LOCAL_LOG" || true
wait_for_vm_ssh
log "Rollback complete."
}
# Ensure the VM has git + ca-certificates (fresh-server bootstrap).
bootstrap_git_on_vm() {
log "Ensuring git is present on the VM..."
vm 'command -v git >/dev/null 2>&1 || sudo -n DEBIAN_FRONTEND=noninteractive apt-get -y -qq install git ca-certificates' \
2>&1 | tee -a "$LOCAL_LOG" || die "Failed to bootstrap git on VM."
vm 'sudo -n DEBIAN_FRONTEND=noninteractive apt-get -y -qq install ca-certificates' 2>&1 | tee -a "$LOCAL_LOG" || true
}
# Clone or pull the repo on the VM. Returns absolute path on stdout (via log).
sync_repo_on_vm() {
bootstrap_git_on_vm
if [[ -n "${CLEAN_CLONE:-}" ]]; then
log "CLEAN_CLONE set: removing existing clone on VM."
vm "rm -rf ~/${REMOTE_REPO}" 2>&1 | tee -a "$LOCAL_LOG" || true
fi
log "Ensuring repo is cloned/pulled on the VM from:"
log " $REPO_URL"
vm "
set -e
if [ -d ~/${REMOTE_REPO}/.git ]; then
cd ~/${REMOTE_REPO}
git fetch --all --prune
git reset --hard origin/HEAD 2>/dev/null || git reset --hard origin/main
git clean -xfd
else
git clone --filter=blob:none '$REPO_URL' ~/${REMOTE_REPO}
cd ~/${REMOTE_REPO}
fi
git log --oneline -1
" 2>&1 | tee -a "$LOCAL_LOG" || die "Repo sync failed on VM."
log "Repo ready on VM."
}
# The remote setup runner: a self-contained script we ship to the VM so the
# sudo'd setup runs from a known-good absolute path with full logging. Using a
# file avoids nested-quote hell across local -> ssh -> sudo -> bash -c.
deploy_runner_script() {
cat <<RUNNER
#!/usr/bin/bash
# remote-setup-runner.sh (generated by vm-validation.sh)
# Runs ProjectCode/SetupNewSystem.sh from the repo given by \$1, as root.
set -uo pipefail
# Ensure a sane TERM so the framework's tput-based color helpers work when run
# over a non-interactive SSH session (which has no TTY/TERM by default).
export TERM="\${TERM:-linux}"
REPO_ABS="\${1:?repo abs path required}"
REMOTE_LOG="/tmp/knel-setup.log"
echo "=== KNEL SetupNewSystem start: \$(date -Is) repo=\$REPO_ABS ===" | tee -a "\$REMOTE_LOG"
cd "\$REPO_ABS/ProjectCode" || { echo "FATAL: ProjectCode missing at \$REPO_ABS"; exit 2; }
bash SetupNewSystem.sh 2>&1 | tee -a "\$REMOTE_LOG"
rc=\${PIPESTATUS[0]}
echo "=== KNEL SetupNewSystem end: rc=\$rc \$(date -Is) ===" | tee -a "\$REMOTE_LOG"
exit \$rc
RUNNER
}
cmd_deploy() {
require_vm_id
sync_repo_on_vm
local repo_abs
repo_abs="$(resolve_remote_repo)"
[[ -n "$repo_abs" ]] || die "Could not resolve absolute repo path on VM."
log "Repo absolute path on VM: $repo_abs"
# Ship the runner script and execute it as root via sudo, passing abs path.
local runner_local="$LOCAL_LOG_DIR/remote-setup-runner.sh"
deploy_runner_script > "$runner_local"
vm "mkdir -p ~/${REMOTE_REPO}/Project-Tests/.run" 2>&1 | tee -a "$LOCAL_LOG"
bash "$REMOTE" vm-copy "$runner_local" "${REMOTE_REPO}/Project-Tests/.run/remote-setup-runner.sh" \
2>&1 | tee -a "$LOCAL_LOG" || die "Failed to ship runner script."
log "Running SetupNewSystem.sh on the VM as root (this takes several minutes)..."
# Resolve abs runner path the same way (no ~ under sudo).
local runner_abs
runner_abs="$(vm "cd ~/${REMOTE_REPO}/Project-Tests/.run && pwd")/remote-setup-runner.sh"
vmroot "bash '$runner_abs' '$repo_abs'" 2>&1 | tee -a "$LOCAL_LOG" || true
# secharden-ssh (run near the end of setup) replaces authorized_keys with the
# managed production key set, locking out the bootstrap key. Restore the
# validation key out-of-band BEFORE we try to fetch the log over SSH.
restore_vm_access
# Fetch the remote log for full fidelity (strip ANSI color codes). SSH works
# only until secharden-2fa flips 2FA on; after that, use the guest agent.
local fetch_cmd="sed -r 's/\\x1B\\[[0-9;]*[mK]//g' /tmp/knel-setup.log 2>/dev/null || cat /tmp/knel-setup.log"
if ! vm "$fetch_cmd" > "$LOCAL_LOG_DIR/setup-output-${STAMP}.log" 2>/dev/null; then
vmguest "$fetch_cmd" > "$LOCAL_LOG_DIR/setup-output-${STAMP}.log" 2>/dev/null || true
fi
# Detect the exit marker. Prefer the full fetched log, but always fall back
# to the live stream ($LOCAL_LOG) which is captured regardless of whether
# post-setup SSH/2FA let us fetch the remote log.
local rc_marker
rc_marker=$(grep -oE 'rc=[0-9]+' "$LOCAL_LOG_DIR/setup-output-${STAMP}.log" 2>/dev/null | tail -1 || true)
[[ -n "$rc_marker" ]] || rc_marker=$(grep -oE 'rc=[0-9]+' "$LOCAL_LOG" 2>/dev/null | tail -1 || true)
log "Setup run finished. Marker: ${rc_marker:-unknown}"
if [[ "${rc_marker:-}" != "rc=0" ]]; then
log "Setup did NOT complete cleanly. See: $LOCAL_LOG_DIR/setup-output-${STAMP}.log (and $LOCAL_LOG)"
return 1
fi
log "Setup completed successfully."
}
cmd_validate() {
require_vm_id
log "Running post-deploy validation suite on the VM..."
local repo_abs
repo_abs="$(resolve_remote_repo)"
[[ -n "$repo_abs" ]] || die "Could not resolve absolute repo path on VM."
# Prefer SSH; fall back to the guest agent (post-2FA SSH needs a TOTP token).
if ! vmroot "cd '$repo_abs' && bash Project-Tests/run-tests.sh all" 2>&1 | tee -a "$LOCAL_LOG"; then
vmguest "cd '$repo_abs' && bash Project-Tests/run-tests.sh all" 2>&1 | tee -a "$LOCAL_LOG" || true
fi
log "Validation run finished. Inspect output above / in $LOCAL_LOG."
}
cmd_all() {
require_vm_id
log "=== FULL VALIDATION LOOP: $VM_NAME (VMID $VM_ID) ==="
cmd_snapshot
if cmd_deploy && cmd_validate; then
log "=== ALL GREEN ==="
return 0
fi
log "=== FAILURE — auto-rolling back to '$SNAP_NAME' ==="
cmd_rollback "$SNAP_NAME"
log "Rolled back. Fix and push, then re-run: VM_ID=$VM_ID $0 deploy && VM_ID=$VM_ID $0 validate"
return 1
}
# ---------------------------------------------------------------------------
# Dispatch
# ---------------------------------------------------------------------------
subcmd="${1:-}"
case "$subcmd" in
find-vmid) cmd_find_vmid ;;
snapshot) cmd_snapshot ;;
deploy) cmd_deploy ;;
validate) cmd_validate ;;
rollback) cmd_rollback "${2:-}" ;;
all) cmd_all ;;
""|-h|--help|help)
sed -n '2,49p' "${BASH_SOURCE[0]}" >&2
exit 0
;;
*) die "Unknown command '$subcmd'. Run '$0 help'." ;;
esac
archive/KNELServerBuild/ProjectCode/ConfigFiles/AuditD/auditd.conf
+46
View File
@@ -0,0 +1,46 @@
#
# Known Element Enterprises Customized Config File
# auditd
# Initial version 2025-06-27
#
local_events = yes
write_logs = yes
log_file = /var/log/audit/audit.log
log_group = adm
log_format = ENRICHED
flush = INCREMENTAL_ASYNC
freq = 50
max_log_file = 8
num_logs = 5
priority_boost = 4
name_format = NONE
max_log_file_action = keep_logs
space_left = 75
space_left_action = email
action_mail_acct = root
admin_space_left_action = halt
disk_full_action = SUSPEND
disk_error_action = SUSPEND
admin_space_left = 50
verify_email = yes
use_libwrap = yes
tcp_listen_queue = 5
tcp_max_per_addr = 1
tcp_client_max_idle = 0
transport = TCP
distribute_network = no
q_depth = 2000
overflow_action = SYSLOG
max_restarts = 10
plugin_dir = /etc/audit/plugins.d
end_of_event_timeout = 2
##tcp_client_ports = 1024-65535
##tcp_listen_port = 60
##krb5_key_file = /etc/audit/audit.key
krb5_principal = auditd
##name = mydomain
archive/KNELServerBuild/ProjectCode/ConfigFiles/AuditD/rules.d/time-change.rules
View File
archive/KNELServerBuild/ProjectCode/ConfigFiles/BANNERS/issue
+5
View File
@@ -0,0 +1,5 @@
This system is the property of Known Element Enterprises LLC.
Authorized uses only. All activity may be monitored and reported.
All activities subject to monitoring/recording/review in real time and/or at a later time.
archive/KNELServerBuild/ProjectCode/ConfigFiles/BANNERS/issue.net
+5
View File
@@ -0,0 +1,5 @@
This system is the property of Known Element Enterprises LLC.
Authorized uses only. All activity may be monitored and reported.
All activities subject to monitoring/recording/review in real time and/or at a later time.
archive/KNELServerBuild/ProjectCode/ConfigFiles/BANNERS/motd
+5
View File
@@ -0,0 +1,5 @@
This system is the property of Known Element Enterprises LLC.
Authorized uses only. All activity may be monitored and reported.
All activities subject to monitoring/recording/review in real time and/or at a later time.
archive/KNELServerBuild/ProjectCode/ConfigFiles/Cockpit/disallowed-users
+2
View File
@@ -0,0 +1,2 @@
#/etc/cockpit/disallowed-users
# List of users which are not allowed to login to Cockpit
archive/KNELServerBuild/ProjectCode/ConfigFiles/DHCP/dhclient.conf
+14
View File
@@ -0,0 +1,14 @@
option rfc3442-classless-static-routes code 121 = array of unsigned integer 8;
send host-name = gethostname();
request subnet-mask, broadcast-address, time-offset, routers,
domain-name, host-name,
domain-name-servers, domain-search, ntp-servers,
rfc3442-classless-static-routes;
# Pin DNS and NTP to the redundant pfv-netinfra-01/02 pair regardless of what
# the DHCP server advertises, so every host on this build uses the same
# authoritative recursive resolvers and time sources.
supersede domain-name-servers 192.168.3.252, 192.168.3.253;
supersede domain-search "knel.net";
supersede ntp-servers 192.168.3.252, 192.168.3.253;
archive/KNELServerBuild/ProjectCode/ConfigFiles/Logrotate/logrotate.conf
+23
View File
@@ -0,0 +1,23 @@
# see "man logrotate" for details
# global options do not affect preceding include directives
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create 0640 root utmp
# use date as a suffix of the rotated file
#dateext
# uncomment this if you want your log files compressed
#compress
# packages drop log rotation information into this directory
include /etc/logrotate.d
# system-specific logs may also be configured here.
archive/KNELServerBuild/ProjectCode/ConfigFiles/ModProbe/cramfs.conf
+1
View File
@@ -0,0 +1 @@
install cramfs /bin/true
archive/KNELServerBuild/ProjectCode/ConfigFiles/ModProbe/dccp.conf
+1
View File
@@ -0,0 +1 @@
install dccp /bin/true
archive/KNELServerBuild/ProjectCode/ConfigFiles/ModProbe/freevxfs.conf
+1
View File
@@ -0,0 +1 @@
install freevxfs /bin/true
archive/KNELServerBuild/ProjectCode/ConfigFiles/ModProbe/hfs.conf
+1
View File
@@ -0,0 +1 @@
install hfs /bin/true
archive/KNELServerBuild/ProjectCode/ConfigFiles/ModProbe/hfsplus.conf
+1
View File
@@ -0,0 +1 @@
install hfsplus /bin/true
archive/KNELServerBuild/ProjectCode/ConfigFiles/ModProbe/jffs2.conf
+1
View File
@@ -0,0 +1 @@
install jffs2 /bin/true
archive/KNELServerBuild/ProjectCode/ConfigFiles/ModProbe/rds.conf
+1
View File
@@ -0,0 +1 @@
install rds /bin/true
archive/KNELServerBuild/ProjectCode/ConfigFiles/ModProbe/sctp.conf
+1
View File
@@ -0,0 +1 @@
install sctp /bin/true
archive/KNELServerBuild/ProjectCode/ConfigFiles/ModProbe/squashfs.conf
+1
View File
@@ -0,0 +1 @@
install squashfs /bin/true
archive/KNELServerBuild/ProjectCode/ConfigFiles/ModProbe/tipc.conf
+1
View File
@@ -0,0 +1 @@
install tipc /bin/true
archive/KNELServerBuild/ProjectCode/ConfigFiles/ModProbe/udf.conf
+1
View File
@@ -0,0 +1 @@
install udf /bin/true
archive/KNELServerBuild/ProjectCode/ConfigFiles/ModProbe/usb_storage.conf
+1
View File
@@ -0,0 +1 @@
install usb-storage /bin/true
archive/KNELServerBuild/ProjectCode/ConfigFiles/NTP/ntp.conf
+21
View File
@@ -0,0 +1,21 @@
driftfile /var/lib/ntp/ntp.drift
leapfile /usr/share/zoneinfo/leap-seconds.list
# Redundant upstream time sources: pfv-netinfra-01/02 (Technitium/Pi-hole hosts
# also serving NTP). IPs are used (not hostnames) because the knel.net name for
# these hosts resolves to a Tailscale CGNAT address, not the LAN address, and
# because NTP must come up before DNS is available. iburst speeds initial sync.
server 192.168.3.252 iburst
server 192.168.3.253 iburst
# Hardened client: sync from the configured servers but never serve time to
# anyone else. Note: `interface listen 127.0.0.1` must NOT be used here — it
# binds ntpd to loopback, making outbound queries carry a 127.0.0.1 source
# address that upstream servers cannot reply to (symptoms: peers stuck in
# .INIT. with reach 0). Use restrict rules to control access instead.
restrict default ignore
restrict 127.0.0.1
restrict ::1
restrict 192.168.3.252 nomodify notrap nopeer
restrict 192.168.3.253 nomodify notrap nopeer
archive/KNELServerBuild/ProjectCode/ConfigFiles/NetworkDiscovery/lldpd
+2
View File
@@ -0,0 +1,2 @@
# Uncomment to start SNMP subagent and enable CDP, SONMP and EDP protocol
DAEMON_ARGS="-x -c -s -e"
archive/KNELServerBuild/ProjectCode/ConfigFiles/Resolv/resolv.conf
+11
View File
@@ -0,0 +1,11 @@
# Managed by KNELServerBuild — do not edit; changes will be overwritten.
#
# Redundant recursive DNS via pfv-netinfra-01/02 (Technitium + Pi-hole).
# IPs are used (required: nameserver directives must be addresses, and the
# knel.net name for these hosts resolves to a Tailscale CGNAT address rather
# than the LAN address). If the primary is unreachable, glibc's resolver
# automatically falls through to the secondary.
domain knel.net
search knel.net
nameserver 192.168.3.252
nameserver 192.168.3.253
archive/KNELServerBuild/ProjectCode/ConfigFiles/SMTP/aliases
+3
View File
@@ -0,0 +1,3 @@
# See man 5 aliases for format
postmaster: root
root: coo@turnsys.com
archive/KNELServerBuild/ProjectCode/ConfigFiles/SMTP/postfix_generic
+1
View File
@@ -0,0 +1 @@
/.*/ tsysrootaccount@knel.net
archive/KNELServerBuild/ProjectCode/ConfigFiles/SNMP/snmpd-physicalhost.conf
+46
View File
@@ -0,0 +1,46 @@
##########################################################################
# snmpd.conf
# Created by CNW on 11/3/2018 via snmpconf wizard and manual post tweaks
###########################################################################
# SECTION: Monitor Various Aspects of the Running Host
#
# disk: Check for disk space usage of a partition.
# The agent can check the amount of available disk space, and make
# sure it is above a set limit.
#
load 3 3 3
rocommunity kn3lmgmt
sysservices 76
#syslocation Rack, Room, Building, City, Country [Lat, Lon]
syslocation R4, Server Room, SITER, Pflugerville, United States
syscontact coo@turnsys.com
#NTP
extend ntp-client /usr/lib/check_mk_agent/local/ntp-client
#SMTP
extend mailq /usr/lib/check_mk_agent/local/postfix-queues
extend postfixdetailed /usr/lib/check_mk_agent/local/postfixdetailed
#OS Distribution Detection
extend distro /usr/local/bin/distro
extend osupdate /usr/lib/check_mk_agent/local/os-updates.sh
#Hardware Detection
extend manufacturer /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/sys_vendor
extend hardware /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_name
extend serial /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_serial
#SMART
extend smart /usr/lib/check_mk_agent/local/smart
#Temperature
pass_persist .1.3.6.1.4.1.9.9.13.1.3 /usr/local/bin/temper-snmp
# Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX
# smuxpeer .1.3.6.1.4.1.674.10892.1
# LLDP collection
master agentx
archive/KNELServerBuild/ProjectCode/ConfigFiles/SNMP/snmpd-rpi.conf
+40
View File
@@ -0,0 +1,40 @@
##########################################################################
# snmpd.conf
# Created by CNW on 11/3/2018 via snmpconf wizard and manual post tweaks
###########################################################################
# SECTION: Monitor Various Aspects of the Running Host
#
# disk: Check for disk space usage of a partition.
# The agent can check the amount of available disk space, and make
# sure it is above a set limit.
#
load 3 3 3
rocommunity kn3lmgmt
sysservices 76
#syslocation Rack, Room, Building, City, Country [Lat, Lon]
syslocation SITER, Pflugerville, United States
syscontact coo@turnsys.com
#NTP
extend ntp-client /usr/lib/check_mk_agent/local/ntp-client
#SMTP
extend mailq /usr/lib/check_mk_agent/local/postfix-queues
extend postfixdetailed /usr/lib/check_mk_agent/local/postfixdetailed
#OS Distribution Detection
extend distro /usr/local/bin/distro
extend osupdate /usr/lib/check_mk_agent/local/os-updates.sh
#Hardware Detection
extend hardware /usr/bin/sudo /usr/bin/cat /sys/firmware/devicetree/base/model
extend serial /usr/bin/sudo /usr/bin/cat /sys/firmware/devicetree/base/serial-number
# Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX
# smuxpeer .1.3.6.1.4.1.674.10892.1
# LLDP collection
master agentx
archive/KNELServerBuild/ProjectCode/ConfigFiles/SNMP/snmpd.conf
+44
View File
@@ -0,0 +1,44 @@
##########################################################################
# snmpd.conf
# Created by CNW on 11/3/2018 via snmpconf wizard and manual post tweaks
###########################################################################
# SECTION: Monitor Various Aspects of the Running Host
#
# disk: Check for disk space usage of a partition.
# The agent can check the amount of available disk space, and make
# sure it is above a set limit.
#
load 3 3 3
rocommunity kn3lmgmt
sysservices 76
#syslocation Rack, Room, Building, City, Country [Lat, Lon]
syslocation R4, Server Room, SITER, Pflugerville, United States
syscontact coo@turnsys.com
#NTP
extend ntp-client /usr/lib/check_mk_agent/local/ntp-client
#SMTP
extend mailq /usr/lib/check_mk_agent/local/postfix-queues
extend postfixdetailed /usr/lib/check_mk_agent/local/postfixdetailed
#OS Distribution Detection
extend distro /usr/local/bin/distro
extend osupdate /usr/lib/check_mk_agent/local/os-updates.sh
# Socket statistics
extend ss /usr/lib/check_mk_agent/local/ss.py
#Hardware Detection
# (uncomment for x86 platforms)
extend manufacturer /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/sys_vendor
extend hardware /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_name
extend serial /usr/bin/sudo /usr/bin/cat /sys/devices/virtual/dmi/id/product_serial
# Allow Systems Management Data Engine SNMP to connect to snmpd using SMUX
# smuxpeer .1.3.6.1.4.1.674.10892.1
# LLDP collection
master agentx
archive/KNELServerBuild/ProjectCode/ConfigFiles/SSH/Configs/ssh-audit-hardening.conf
+19
View File
@@ -0,0 +1,19 @@
# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com
# hardening guide.
KexAlgorithms sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,gss-curve25519-sha256-,diffie-hellman-group16-sha512,gss-group16-sha512-,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-gcm@openssh.com,aes128-ctr
MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com
HostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256
RequiredRSASize 3072
CASignatureAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256
GSSAPIKexAlgorithms gss-curve25519-sha256-,gss-group16-sha512-
HostbasedAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-256
PubkeyAcceptedAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-256
archive/KNELServerBuild/ProjectCode/ConfigFiles/SSH/Configs/tsys-sshd-config
+20
View File
@@ -0,0 +1,20 @@
Include /etc/ssh/sshd_config.d/*.conf
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
KbdInteractiveAuthentication no
PrintMotd no
PasswordAuthentication no
AllowTcpForwarding no
X11Forwarding no
ChallengeResponseAuthentication no
AcceptEnv LANG LC_*
Subsystem sftp /usr/lib/openssh/sftp-server
UsePAM yes
Banner /etc/issue.net
MaxAuthTries 2
MaxStartups 10:30:100
PermitRootLogin prohibit-password
ClientAliveInterval 300
ClientAliveCountMax 3
AllowUsers root localuser subodev
LoginGraceTime 60
archive/KNELServerBuild/ProjectCode/ConfigFiles/Syslog/rsyslog.conf
+6
View File
@@ -0,0 +1,6 @@
module(load="imuxsock") # provides support for local system logging
module(load="imklog") # provides kernel logging support
#module(load="immark") # provides --MARK-- message capability
*.* @tsys-librenms.knel.net:514
:omusrmsg:EOF
archive/KNELServerBuild/ProjectCode/ConfigFiles/Systemd/journald.conf
+31
View File
@@ -0,0 +1,31 @@
[Journal]
#Compress=yes
#Seal=yes
#SplitMode=uid
#SyncIntervalSec=5m
#RateLimitIntervalSec=30s
#RateLimitBurst=10000
#SystemMaxUse=
#SystemKeepFree=
#SystemMaxFileSize=
#SystemMaxFiles=100
#RuntimeMaxUse=
#RuntimeKeepFree=
#RuntimeMaxFileSize=
#RuntimeMaxFiles=100
#MaxRetentionSec=
#MaxFileSec=1month
#ForwardToSyslog=yes
#ForwardToKMsg=no
#ForwardToConsole=no
#ForwardToWall=yes
#TTYPath=/dev/console
#MaxLevelStore=debug
#MaxLevelSyslog=debug
#MaxLevelKMsg=notice
#MaxLevelConsole=info
#MaxLevelWall=emerg
#LineMax=48K
#ReadKMsg=yes
#Audit=no
Storage=persistent
archive/KNELServerBuild/ProjectCode/ConfigFiles/ZSH/tsys-zshrc
+258
View File
@@ -0,0 +1,258 @@
# ~/.zshrc file for zsh interactive shells.
# see /usr/share/doc/zsh/examples/zshrc for examples
setopt autocd # change directory just by typing its name
#setopt correct # auto correct mistakes
setopt interactivecomments # allow comments in interactive mode
setopt magicequalsubst # enable filename expansion for arguments of the form ‘anything=expression’
setopt nonomatch # hide error message if there is no match for the pattern
setopt notify # report the status of background jobs immediately
setopt numericglobsort # sort filenames numerically when it makes sense
setopt promptsubst # enable command substitution in prompt
WORDCHARS=${WORDCHARS//\/} # Don't consider certain characters part of the word
# hide EOL sign ('%')
PROMPT_EOL_MARK=""
# configure key keybindings
bindkey -v # emacs key bindings
bindkey ' ' magic-space # do history expansion on space
bindkey '^U' backward-kill-line # ctrl + U
bindkey '^[[3;5~' kill-word # ctrl + Supr
bindkey '^[[3~' delete-char # delete
bindkey '^[[1;5C' forward-word # ctrl + ->
bindkey '^[[1;5D' backward-word # ctrl + <-
bindkey '^[[5~' beginning-of-buffer-or-history # page up
bindkey '^[[6~' end-of-buffer-or-history # page down
bindkey '^[[H' beginning-of-line # home
bindkey '^[[F' end-of-line # end
bindkey '^[[Z' undo # shift + tab undo last action
# enable completion features
autoload -Uz compinit
compinit -d ~/.cache/zcompdump
zstyle ':completion:*:*:*:*:*' menu select
zstyle ':completion:*' auto-description 'specify: %d'
zstyle ':completion:*' completer _expand _complete
zstyle ':completion:*' format 'Completing %d'
zstyle ':completion:*' group-name ''
zstyle ':completion:*' list-colors ''
zstyle ':completion:*' list-prompt %SAt %p: Hit TAB for more, or the character to insert%s
zstyle ':completion:*' matcher-list 'm:{a-zA-Z}={A-Za-z}'
zstyle ':completion:*' rehash true
zstyle ':completion:*' select-prompt %SScrolling active: current selection at %p%s
zstyle ':completion:*' use-compctl false
zstyle ':completion:*' verbose true
zstyle ':completion:*:kill:*' command 'ps -u $USER -o pid,%cpu,tty,cputime,cmd'
# History configurations
HISTFILE=~/.zsh_history
HISTSIZE=10000
SAVEHIST=200000
setopt hist_expire_dups_first # delete duplicates first when HISTFILE size exceeds HISTSIZE
setopt hist_ignore_dups # ignore duplicated commands history list
setopt hist_ignore_space # ignore commands that start with space
setopt hist_verify # show command with history expansion to user before running it
#setopt share_history # share command history data
# force zsh to show the complete history
alias history="history 0"
# configure `time` format
TIMEFMT=$'\nreal\t%E\nuser\t%U\nsys\t%S\ncpu\t%P'
# make less more friendly for non-text input files, see lesspipe(1)
#[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"
# set variable identifying the chroot you work in (used in the prompt below)
if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then
debian_chroot=$(cat /etc/debian_chroot)
fi
# set a fancy prompt (non-color, unless we know we "want" color)
case "$TERM" in
xterm-color|*-256color) color_prompt=yes;;
esac
# uncomment for a colored prompt, if the terminal has the capability; turned
# off by default to not distract the user: the focus in a terminal window
# should be on the output of commands, not on the prompt
force_color_prompt=yes
if [ -n "$force_color_prompt" ]; then
if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
# We have color support; assume it's compliant with Ecma-48
# (ISO/IEC-6429). (Lack of such support is extremely rare, and such
# a case would tend to support setf rather than setaf.)
color_prompt=yes
else
color_prompt=
fi
fi
configure_prompt() {
prompt_symbol=㉿
# Skull emoji for root terminal
#[ "$EUID" -eq 0 ] && prompt_symbol=💀
case "$PROMPT_ALTERNATIVE" in
twoline)
PROMPT=$'%F{%(#.blue.green)}┌──${debian_chroot:+($debian_chroot)─}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))─}(%B%F{%(#.red.blue)}%n'$prompt_symbol$'%m%b%F{%(#.blue.green)})-[%B%F{reset}%(6~.%-1~/…/%4~.%5~)%b%F{%(#.blue.green)}]\n└─%B%(#.%F{red}#.%F{blue}$)%b%F{reset} '
# Right-side prompt with exit codes and background processes
#RPROMPT=$'%(?.. %? %F{red}%B⨯%b%F{reset})%(1j. %j %F{yellow}%B⚙%b%F{reset}.)'
;;
oneline)
PROMPT=$'${debian_chroot:+($debian_chroot)}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))}%B%F{%(#.red.blue)}%n@%m%b%F{reset}:%B%F{%(#.blue.green)}%~%b%F{reset}%(#.#.$) '
RPROMPT=
;;
backtrack)
PROMPT=$'${debian_chroot:+($debian_chroot)}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))}%B%F{red}%n@%m%b%F{reset}:%B%F{blue}%~%b%F{reset}%(#.#.$) '
RPROMPT=
;;
esac
unset prompt_symbol
}
# The following block is surrounded by two delimiters.
# These delimiters must not be modified. Thanks.
# START KALI CONFIG VARIABLES
PROMPT_ALTERNATIVE=twoline
NEWLINE_BEFORE_PROMPT=yes
# STOP KALI CONFIG VARIABLES
if [ "$color_prompt" = yes ]; then
# override default virtualenv indicator in prompt
VIRTUAL_ENV_DISABLE_PROMPT=1
configure_prompt
# enable syntax-highlighting
if [ -f /usr/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh ]; then
. /usr/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh
ZSH_HIGHLIGHT_HIGHLIGHTERS=(main brackets pattern)
ZSH_HIGHLIGHT_STYLES[default]=none
ZSH_HIGHLIGHT_STYLES[unknown-token]=underline
ZSH_HIGHLIGHT_STYLES[reserved-word]=fg=cyan,bold
ZSH_HIGHLIGHT_STYLES[suffix-alias]=fg=green,underline
ZSH_HIGHLIGHT_STYLES[global-alias]=fg=green,bold
ZSH_HIGHLIGHT_STYLES[precommand]=fg=green,underline
ZSH_HIGHLIGHT_STYLES[commandseparator]=fg=blue,bold
ZSH_HIGHLIGHT_STYLES[autodirectory]=fg=green,underline
ZSH_HIGHLIGHT_STYLES[path]=bold
ZSH_HIGHLIGHT_STYLES[path_pathseparator]=
ZSH_HIGHLIGHT_STYLES[path_prefix_pathseparator]=
ZSH_HIGHLIGHT_STYLES[globbing]=fg=blue,bold
ZSH_HIGHLIGHT_STYLES[history-expansion]=fg=blue,bold
ZSH_HIGHLIGHT_STYLES[command-substitution]=none
ZSH_HIGHLIGHT_STYLES[command-substitution-delimiter]=fg=magenta,bold
ZSH_HIGHLIGHT_STYLES[process-substitution]=none
ZSH_HIGHLIGHT_STYLES[process-substitution-delimiter]=fg=magenta,bold
ZSH_HIGHLIGHT_STYLES[single-hyphen-option]=fg=green
ZSH_HIGHLIGHT_STYLES[double-hyphen-option]=fg=green
ZSH_HIGHLIGHT_STYLES[back-quoted-argument]=none
ZSH_HIGHLIGHT_STYLES[back-quoted-argument-delimiter]=fg=blue,bold
ZSH_HIGHLIGHT_STYLES[single-quoted-argument]=fg=yellow
ZSH_HIGHLIGHT_STYLES[double-quoted-argument]=fg=yellow
ZSH_HIGHLIGHT_STYLES[dollar-quoted-argument]=fg=yellow
ZSH_HIGHLIGHT_STYLES[rc-quote]=fg=magenta
ZSH_HIGHLIGHT_STYLES[dollar-double-quoted-argument]=fg=magenta,bold
ZSH_HIGHLIGHT_STYLES[back-double-quoted-argument]=fg=magenta,bold
ZSH_HIGHLIGHT_STYLES[back-dollar-quoted-argument]=fg=magenta,bold
ZSH_HIGHLIGHT_STYLES[assign]=none
ZSH_HIGHLIGHT_STYLES[redirection]=fg=blue,bold
ZSH_HIGHLIGHT_STYLES[comment]=fg=black,bold
ZSH_HIGHLIGHT_STYLES[named-fd]=none
ZSH_HIGHLIGHT_STYLES[numeric-fd]=none
ZSH_HIGHLIGHT_STYLES[arg0]=fg=cyan
ZSH_HIGHLIGHT_STYLES[bracket-error]=fg=red,bold
ZSH_HIGHLIGHT_STYLES[bracket-level-1]=fg=blue,bold
ZSH_HIGHLIGHT_STYLES[bracket-level-2]=fg=green,bold
ZSH_HIGHLIGHT_STYLES[bracket-level-3]=fg=magenta,bold
ZSH_HIGHLIGHT_STYLES[bracket-level-4]=fg=yellow,bold
ZSH_HIGHLIGHT_STYLES[bracket-level-5]=fg=cyan,bold
ZSH_HIGHLIGHT_STYLES[cursor-matchingbracket]=standout
fi
else
PROMPT='${debian_chroot:+($debian_chroot)}%n@%m:%~%(#.#.$) '
fi
unset color_prompt force_color_prompt
toggle_oneline_prompt(){
if [ "$PROMPT_ALTERNATIVE" = oneline ]; then
PROMPT_ALTERNATIVE=twoline
else
PROMPT_ALTERNATIVE=oneline
fi
configure_prompt
zle reset-prompt
}
zle -N toggle_oneline_prompt
bindkey ^P toggle_oneline_prompt
# If this is an xterm set the title to user@host:dir
case "$TERM" in
xterm*|rxvt*|Eterm|aterm|kterm|gnome*|alacritty)
TERM_TITLE=$'\e]0;${debian_chroot:+($debian_chroot)}${VIRTUAL_ENV:+($(basename $VIRTUAL_ENV))}%n@%m: %~\a'
;;
*)
;;
esac
precmd() {
# Print the previously configured title
print -Pnr -- "$TERM_TITLE"
# Print a new line before the prompt, but only if it is not the first line
if [ "$NEWLINE_BEFORE_PROMPT" = yes ]; then
if [ -z "$_NEW_LINE_BEFORE_PROMPT" ]; then
_NEW_LINE_BEFORE_PROMPT=1
else
print ""
fi
fi
}
# enable color support of ls, less and man, and also add handy aliases
if [ -x /usr/bin/dircolors ]; then
test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)"
export LS_COLORS="$LS_COLORS:ow=30;44:" # fix ls color for folders with 777 permissions
alias ls='ls --color=auto'
#alias dir='dir --color=auto'
#alias vdir='vdir --color=auto'
alias grep='grep --color=auto'
alias fgrep='fgrep --color=auto'
alias egrep='egrep --color=auto'
alias diff='diff --color=auto'
alias ip='ip --color=auto'
export LESS_TERMCAP_mb=$'\E[1;31m' # begin blink
export LESS_TERMCAP_md=$'\E[1;36m' # begin bold
export LESS_TERMCAP_me=$'\E[0m' # reset bold/blink
export LESS_TERMCAP_so=$'\E[01;33m' # begin reverse video
export LESS_TERMCAP_se=$'\E[0m' # reset reverse video
export LESS_TERMCAP_us=$'\E[1;32m' # begin underline
export LESS_TERMCAP_ue=$'\E[0m' # reset underline
# Take advantage of $LS_COLORS for completion as well
zstyle ':completion:*' list-colors "${(s.:.)LS_COLORS}"
zstyle ':completion:*:*:kill:*:processes' list-colors '=(#b) #([0-9]#)*=0=01;31'
fi
# some more ls aliases
alias ll='ls -l'
alias la='ls -A'
alias l='ls -CF'
# enable auto-suggestions based on the history
if [ -f /usr/share/zsh-autosuggestions/zsh-autosuggestions.zsh ]; then
. /usr/share/zsh-autosuggestions/zsh-autosuggestions.zsh
# change suggestion color
ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE='fg=#999'
fi
# enable command-not-found if installed
if [ -f /etc/zsh_command_not_found ]; then
. /etc/zsh_command_not_found
fi
archive/KNELServerBuild/ProjectCode/Dell/Server/fixeth.sh
+23
View File
@@ -0,0 +1,23 @@
#!/bin/bash
#magic to detect main int
echo "Determining management interface..."
#export MAIN_INT=$(brctl show $(netstat -rn|grep 0.0.0.0|head -n1|awk '{print $NF}') | awk '{print $NF}'|tail -1|awk -F '.' '{print $1}')
export MAIN_INT=$(brctl show|grep vmbr0|awk '{print $NF}'|awk -F '.' '{print $1}')
echo "Management interface is: $MAIN_INT"
#fix the issue
echo "Fixing management interface..."
ethtool -K $MAIN_INT tso off
ethtool -K $MAIN_INT gro off
ethtool -K $MAIN_INT gso off
ethtool -K $MAIN_INT tx off
ethtool -K $MAIN_INT rx off
#https://forum.proxmox.com/threads/e1000-driver-hang.58284/
#https://serverfault.com/questions/616485/e1000e-reset-adapter-unexpectedly-detected-hardware-unit-hang
archive/KNELServerBuild/ProjectCode/Dell/Server/omsa.sh
+34
View File
@@ -0,0 +1,34 @@
#!/bin/bash
#curl -s http://dl.turnsys.net/omsa.sh|/bin/bash
gpg --keyserver hkp://pool.sks-keyservers.net:80 --recv-key 1285491434D8786F
gpg -a --export 1285491434D8786F | apt-key add -
echo "deb https://linux.dell.com/repo/community/openmanage/930/bionic bionic main" > /etc/apt/sources.list.d/linux.dell.com.sources.list
wget https://archive.ubuntu.com/ubuntu/pool/universe/o/openwsman/libwsman-curl-client-transport1_2.6.5-0ubuntu3_amd64.deb
wget https://archive.ubuntu.com/ubuntu/pool/universe/o/openwsman/libwsman-client4_2.6.5-0ubuntu3_amd64.deb
wget https://archive.ubuntu.com/ubuntu/pool/universe/o/openwsman/libwsman1_2.6.5-0ubuntu3_amd64.deb
wget https://archive.ubuntu.com/ubuntu/pool/universe/o/openwsman/libwsman-server1_2.6.5-0ubuntu3_amd64.deb
wget https://archive.ubuntu.com/ubuntu/pool/universe/s/sblim-sfcc/libcimcclient0_2.2.8-0ubuntu2_amd64.deb
wget https://archive.ubuntu.com/ubuntu/pool/universe/o/openwsman/openwsman_2.6.5-0ubuntu3_amd64.deb
wget https://archive.ubuntu.com/ubuntu/pool/multiverse/c/cim-schema/cim-schema_2.48.0-0ubuntu1_all.deb
wget https://archive.ubuntu.com/ubuntu/pool/universe/s/sblim-sfc-common/libsfcutil0_1.0.1-0ubuntu4_amd64.deb
wget https://archive.ubuntu.com/ubuntu/pool/multiverse/s/sblim-sfcb/sfcb_1.4.9-0ubuntu5_amd64.deb
wget https://archive.ubuntu.com/ubuntu/pool/universe/s/sblim-cmpi-devel/libcmpicppimpl0_2.0.3-0ubuntu2_amd64.deb
dpkg -i libwsman-curl-client-transport1_2.6.5-0ubuntu3_amd64.deb
dpkg -i libwsman-client4_2.6.5-0ubuntu3_amd64.deb
dpkg -i libwsman1_2.6.5-0ubuntu3_amd64.deb
dpkg -i libwsman-server1_2.6.5-0ubuntu3_amd64.deb
dpkg -i libcimcclient0_2.2.8-0ubuntu2_amd64.deb
dpkg -i openwsman_2.6.5-0ubuntu3_amd64.deb
dpkg -i cim-schema_2.48.0-0ubuntu1_all.deb
dpkg -i libsfcutil0_1.0.1-0ubuntu4_amd64.deb
dpkg -i sfcb_1.4.9-0ubuntu5_amd64.deb
dpkg -i libcmpicppimpl0_2.0.3-0ubuntu2_amd64.deb
apt update
apt -y install srvadmin-all
touch /opt/dell/srvadmin/lib64/openmanage/IGNORE_GENERATION
#logout,login, then run
# srvadmin-services.sh enable && srvadmin-services.sh start
archive/KNELServerBuild/ProjectCode/Dell/fixcpuperf.sh
+10
View File
@@ -0,0 +1,10 @@
#!/bin/bash
#Script to set performance.
cpufreq-set -r -g performance
cpupower frequency-set --governor performance
archive/KNELServerBuild/ProjectCode/Modules/Auth/auth-cloudron-ldap.sh
View File
archive/KNELServerBuild/ProjectCode/Modules/RandD/sslStackFromSource.sh
+81
View File
@@ -0,0 +1,81 @@
#!/bin/bash
#Made from instructions at https://www.tunetheweb.com/performance/http2/
OPENSSL_URL_BASE="https://www.openssl.org/source/"
OPENSSL_FILE="openssl-1.1.0h.tar.gz"
NGHTTP_URL_BASE="https://github.com/nghttp2/nghttp2/releases/download/v1.31.0/"
NGHTTP_FILE="nghttp2-1.31.0.tar.gz"
APR_URL_BASE="https://archive.apache.org/dist/apr/"
APR_FILE="apr-1.6.3.tar.gz"
APR_UTIL_URL_BASE="https://archive.apache.org/dist/apr/"
APR_UTIL_FILE="apr-util-1.6.1.tar.gz"
APACHE_URL_BASE="https://archive.apache.org/dist/httpd/"
APACHE_FILE="httpd-2.4.33.tar.gz"
CURL_URL_BASE="https://curl.haxx.se/download/"
CURL_FILE="curl-7.60.0.tar.gz"
#Download and install latest version of openssl
wget $OPENSSL_URL_BASE/$OPENSSL_FILE
tar xzf $OPENSSL_FILE
cd openssl-1.1.0h
./config enable-weak-ssl-ciphers shared zlib-dynamic -DOPENSSL_TLS_SECURITY_LEVEL=0 --prefix=/usr/local/custom-ssl/openssl-1.1.0h ; make ; make install
ln -s /usr/local/custom-ssl/openssl-1.1.0h /usr/local/openssl
cd -
#Download and install nghttp2 (needed for mod_http2).
wget $NGHTTP_URL_BASE/$NGHTTP_FILE
tar xzf $NGHTTP_FILE
cd nghttp2-1.31.0
./configure --prefix=/usr/local/custom-ssl/nghttp ; make ; make install
cd -
#Updated ldconfig so curl build
cat <<custom-ssl > /etc/ld.so.conf.d/custom-ssl.conf
/usr/local/custom-ssl/openssl-1.1.0h/lib
/usr/local/custom-ssl/nghttp/lib
custom-ssl
ldconfig
#Download and install curl
wget $CURL_URL_BASE/$CURL_FILE
tar xzf curl-7.60.0.tar.gz
cd curl-7.60.0
./configure --prefix=/usr/local/custom-ssl/curl --with-nghttp2=/usr/local/custom-ssl/nghttp/ --with-ssl=/usr/local/custom-ssl/openssl-1.1.0h/ ; make ; make install
cd -
#Download and install latest apr
wget $APR_URL_BASE/$APR_FILE
tar xzf $APR_FILE
cd apr-1.6.3
./configure --prefix=/usr/local/custom-ssl/apr ; make ; make install
cd -
#Download and install latest apr-util
wget $APR_UTIL_URL_BASE/$APR_UTIL_FILE
tar xzf apr-util-1.6.1.tar.gz
cd apr-util-1.6.1
./configure --prefix=/usr/local/custom-ssl/apr-util --with-apr=/usr/local/custom-ssl/apr ; make; make install
cd -
#Download and install apache
wget $APACHE_URL_BASE/$APACHE_FILE
tar xzf httpd-2.4.33.tar.gz
cd httpd-2.4.33
cp -r ../apr-1.6.3 srclib/apr
cp -r ../apr-util-1.6.1 srclib/apr-util
./configure --prefix=/usr/local/custom-ssl/apache --with-ssl=/usr/local/custom-ssl/openssl-1.1.0h/ --with-pcre=/usr/bin/pcre-config --enable-unique-id --enable-ssl --enable-so --with-included-apr --enable-http2 --with-nghttp2=/usr/local/custom-ssl/nghttp/
make
make install
ln -s /usr/local/custom-ssl/apache /usr/local/apache
cd -
archive/KNELServerBuild/ProjectCode/Modules/Security/secharden-2fa.sh
+426
View File
@@ -0,0 +1,426 @@
#!/bin/bash
# TSYS Security Hardening - Two-Factor Authentication
# Implements 2FA for SSH, Cockpit, and Webmin services
# Uses Google Authenticator (TOTP) for time-based tokens
#####
#Core framework functions...
#####
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file"
done
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file"
done
# 2FA Configuration
BACKUP_DIR="/root/backup/2fa"
PAM_CONFIG_DIR="/etc/pam.d"
SSH_CONFIG="/etc/ssh/sshd_config"
COCKPIT_CONFIG="/etc/cockpit/cockpit.conf"
# Create backup directory
mkdir -p "$BACKUP_DIR"
print_info "TSYS Two-Factor Authentication Setup"
# Backup existing configurations
function backup_configs() {
print_info "Creating backup of existing configurations..."
# Backup SSH configuration
if [[ -f "$SSH_CONFIG" ]]; then
cp "$SSH_CONFIG" "$BACKUP_DIR/sshd_config.bak"
print_info "SSH config backed up"
fi
# Backup PAM configurations
if [[ -d "$PAM_CONFIG_DIR" ]]; then
cp -r "$PAM_CONFIG_DIR" "$BACKUP_DIR/pam.d.bak"
print_info "PAM configs backed up"
fi
# Backup Cockpit configuration if exists
if [[ -f "$COCKPIT_CONFIG" ]]; then
cp "$COCKPIT_CONFIG" "$BACKUP_DIR/cockpit.conf.bak"
print_info "Cockpit config backed up"
fi
print_info "Backup completed: $BACKUP_DIR"
}
# Install required packages
function install_2fa_packages() {
print_info "Installing 2FA packages..."
# Update package cache
apt-get update
# Install Google Authenticator PAM module
# Install QR code generator for terminal display
apt-get install -y libpam-google-authenticator qrencode
print_info "2FA packages installed successfully"
}
# Configure SSH for 2FA
function configure_ssh_2fa() {
print_info "Configuring SSH for 2FA..."
# Configure SSH daemon
print_info "Updating SSH configuration..."
# Enable challenge-response authentication
if ! grep -q "^ChallengeResponseAuthentication yes" "$SSH_CONFIG"; then
sed -i 's/^ChallengeResponseAuthentication.*/ChallengeResponseAuthentication yes/' "$SSH_CONFIG" || \
echo "ChallengeResponseAuthentication yes" >> "$SSH_CONFIG"
fi
if ! grep -q "^KbdInteractiveAuthentication yes" "$SSH_CONFIG"; then
sed -i 's/^KbdInteractiveAuthentication.*/KbdInteractiveAuthentication yes/' "$SSH_CONFIG" || \
echo "KbdInteractiveAuthentication yes" >> "$SSH_CONFIG"
fi
# Enable PAM authentication
if ! grep -q "^UsePAM yes" "$SSH_CONFIG"; then
sed -i 's/^UsePAM.*/UsePAM yes/' "$SSH_CONFIG" || \
echo "UsePAM yes" >> "$SSH_CONFIG"
fi
# Configure authentication methods (key + 2FA)
if ! grep -q "^AuthenticationMethods" "$SSH_CONFIG"; then
echo "AuthenticationMethods publickey,keyboard-interactive" >> "$SSH_CONFIG"
else
sed -i 's/^AuthenticationMethods.*/AuthenticationMethods publickey,keyboard-interactive/' "$SSH_CONFIG"
fi
print_info "SSH configuration updated"
}
# Configure PAM for 2FA
function configure_pam_2fa() {
print_info "Configuring PAM for 2FA..."
# Create backup of original PAM SSH config
cp "$PAM_CONFIG_DIR/sshd" "$PAM_CONFIG_DIR/sshd.bak.$(date +%Y%m%d)"
# Configure PAM to use Google Authenticator
cat > "$PAM_CONFIG_DIR/sshd" << 'EOF'
# PAM configuration for SSH with 2FA
# Standard Un*x authentication
@include common-auth
# Google Authenticator 2FA
auth required pam_google_authenticator.so nullok
# Standard Un*x authorization
@include common-account
# SELinux needs to be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
# Standard Un*x session setup and teardown
@include common-session
# Print the message of the day upon successful login
session optional pam_motd.so motd=/run/motd.dynamic
session optional pam_motd.so noupdate
# Print the status of the user's mailbox upon successful login
session optional pam_mail.so standard noenv
# Set up user limits from /etc/security/limits.conf
session required pam_limits.so
# SELinux needs to intervene at login time
session required pam_selinux.so open
# Standard Un*x password updating
@include common-password
EOF
print_info "PAM configuration updated for SSH 2FA"
}
# Configure Cockpit for 2FA
function configure_cockpit_2fa() {
print_info "Configuring Cockpit for 2FA..."
# Create Cockpit config directory if it doesn't exist
mkdir -p "$(dirname "$COCKPIT_CONFIG")"
# Configure Cockpit to use PAM with 2FA
cat > "$COCKPIT_CONFIG" << 'EOF'
[WebService]
# Enable 2FA for Cockpit web interface
LoginTitle = TSYS Server Management
LoginTo = 300
RequireHost = true
[Session]
# Use PAM for authentication (includes 2FA)
Banner = /etc/cockpit/issue.cockpit
IdleTimeout = 15
EOF
# Create PAM configuration for Cockpit
cat > "$PAM_CONFIG_DIR/cockpit" << 'EOF'
# PAM configuration for Cockpit with 2FA
auth requisite pam_nologin.so
auth required pam_env.so
auth required pam_faillock.so preauth
auth sufficient pam_unix.so try_first_pass
auth required pam_google_authenticator.so nullok
auth required pam_faillock.so authfail
auth required pam_deny.so
account required pam_nologin.so
account include system-auth
account required pam_faillock.so
session required pam_selinux.so close
session required pam_loginuid.so
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_selinux.so open
session optional pam_motd.so
EOF
print_info "Cockpit 2FA configuration completed"
}
# Configure Webmin for 2FA (if installed)
function configure_webmin_2fa() {
print_info "Checking for Webmin installation..."
local webmin_config="/etc/webmin/miniserv.conf"
if [[ -f "$webmin_config" ]]; then
print_info "Webmin found, configuring 2FA..."
# Stop webmin service
systemctl stop webmin || true
# Enable 2FA in Webmin configuration. `sed -i ... || echo` would never
# append, because sed returns 0 even when it matches nothing; guard with
# grep so the directive is added when absent and updated when present.
if grep -q '^twofactor_provider=' "$webmin_config"; then
sed -i 's/^twofactor_provider=.*/twofactor_provider=totp/' "$webmin_config"
else
echo "twofactor_provider=totp" >> "$webmin_config"
fi
# Enable 2FA requirement
if grep -q '^twofactor=' "$webmin_config"; then
sed -i 's/^twofactor=.*/twofactor=1/' "$webmin_config"
else
echo "twofactor=1" >> "$webmin_config"
fi
# Start webmin service
systemctl start webmin || true
print_info "Webmin 2FA configuration completed"
else
print_info "Webmin not found, skipping configuration"
fi
}
# Setup 2FA for users
function setup_user_2fa() {
print_info "Setting up 2FA for system users..."
local users=("localuser" "root")
for user in "${users[@]}"; do
if id "$user" &>/dev/null; then
print_info "Setting up 2FA for user: $user"
local user_home
user_home="$(getent passwd "$user" | cut -d: -f6)"
if [[ -z "$user_home" ]]; then
print_info "No home directory for $user, skipping"
continue
fi
# Create 2FA setup script for user
cat > "/tmp/setup-2fa-$user.sh" << 'EOF'
#!/bin/bash
echo "Setting up Google Authenticator for user: $USER"
echo "Please follow the prompts to configure 2FA:"
echo "1. Answer 'y' to update your time-based token"
echo "2. Scan the QR code with your authenticator app"
echo "3. Save the backup codes in a secure location"
echo "4. Answer 'y' to the remaining questions for security"
echo ""
google-authenticator -t -d -f -r 3 -R 30 -W
EOF
chmod +x "/tmp/setup-2fa-$user.sh"
# Instructions for user setup
cat > "$user_home/2fa-setup-instructions.txt" << EOF
TSYS Two-Factor Authentication Setup Instructions
==============================================
Your system has been configured for 2FA. To complete setup:
1. Install an authenticator app on your phone:
- Google Authenticator
- Authy
- Microsoft Authenticator
2. Run the setup command:
sudo /tmp/setup-2fa-$user.sh
3. Follow the prompts:
- Scan the QR code with your app
- Save the backup codes securely
- Answer 'y' to security questions
4. Test your setup:
- SSH to the server
- Enter your 6-digit code when prompted
IMPORTANT: Save backup codes in a secure location!
Without them, you may be locked out if you lose your phone.
For support, contact your system administrator.
EOF
chown "$user:$user" "$user_home/2fa-setup-instructions.txt"
print_info "2FA setup prepared for user: $user"
else
print_info "User $user not found, skipping"
fi
done
}
# Restart services
function restart_services() {
print_info "Restarting services..."
# Test SSH configuration
if sshd -t; then
systemctl restart sshd
print_info "SSH service restarted"
else
print_error "SSH configuration test failed"
return 1
fi
# Restart Cockpit if installed
if systemctl is-enabled cockpit.socket &>/dev/null; then
systemctl restart cockpit.socket
print_info "Cockpit service restarted"
fi
# Restart Webmin if installed
if systemctl is-enabled webmin &>/dev/null; then
systemctl restart webmin
print_info "Webmin service restarted"
fi
}
# Validation and testing
function validate_2fa_setup() {
print_info "Validating 2FA setup..."
# Check if Google Authenticator is installed
if command -v google-authenticator &>/dev/null; then
print_info "Google Authenticator installed"
else
print_error "Google Authenticator not found"
return 1
fi
# Check SSH configuration
if grep -q "AuthenticationMethods publickey,keyboard-interactive" "$SSH_CONFIG"; then
print_info "SSH 2FA configuration valid"
else
print_error "SSH 2FA configuration invalid"
return 1
fi
# Check PAM configuration
if grep -q "pam_google_authenticator.so" "$PAM_CONFIG_DIR/sshd"; then
print_info "PAM 2FA configuration valid"
else
print_error "PAM 2FA configuration invalid"
return 1
fi
# Check service status
if systemctl is-active sshd &>/dev/null; then
print_info "SSH service is running"
else
print_error "SSH service is not running"
return 1
fi
print_info "2FA validation completed successfully"
}
# Display final instructions
function show_final_instructions() {
print_info "2FA Setup Completed"
print_info "Two-Factor Authentication has been configured for:"
print_info "- SSH (requires key + 2FA token)"
print_info "- Cockpit web interface"
if [[ -f "/etc/webmin/miniserv.conf" ]]; then
print_info "- Webmin administration panel"
fi
print_info "IMPORTANT: Complete user setup immediately!"
print_info "1. Check /home/*/2fa-setup-instructions.txt for user setup"
print_info "2. Run setup scripts for each user"
print_info "3. Test 2FA before logging out"
print_info "Backup location: $BACKUP_DIR"
print_info "To disable 2FA, restore configurations from backup"
print_info "2FA setup completed successfully!"
}
# Main execution
function main() {
# Check if running as root
if [[ $EUID -ne 0 ]]; then
print_error "This script must be run as root"
exit 1
fi
# Execute setup steps
backup_configs
install_2fa_packages
configure_ssh_2fa
configure_pam_2fa
configure_cockpit_2fa
configure_webmin_2fa
setup_user_2fa
restart_services
validate_2fa_setup
show_final_instructions
}
# Run main function
main "$@"
archive/KNELServerBuild/ProjectCode/Modules/Security/secharden-audit-agents.sh
+50
View File
@@ -0,0 +1,50 @@
#!/bin/bash
#####
#Core framework functions...
#####
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
export CONFIGFILES_PATH
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file"
done
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file"
done
# Material herein Sourced from
# https://cisofy.com/documentation/lynis/
# https://jbcsec.com/configure-linux-ssh/
# https://opensource.com/article/20/5/linux-security-lynis
# https://forum.greenbone.net/t/ssh-authentication/13536
# openvas
#lynis
#Auditd
cat "$CONFIGFILES_PATH/AuditD/auditd.conf" > /etc/audit/auditd.conf
# Systemd
cat "$CONFIGFILES_PATH/Systemd/journald.conf" > /etc/systemd/journald.conf
# logrotate
cat "$CONFIGFILES_PATH/Logrotate/logrotate.conf" > /etc/logrotate.conf
archive/KNELServerBuild/ProjectCode/Modules/Security/secharden-auto-upgrade.sh
+3
View File
@@ -0,0 +1,3 @@
#!/bin/bash
# Sourced from https://wiki.debian.org/UnattendedUpgrades
archive/KNELServerBuild/ProjectCode/Modules/Security/secharden-scap-stig.sh
+126
View File
@@ -0,0 +1,126 @@
#!/bin/bash
#########################################
#Core framework functions...
#########################################
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
export CONFIGFILES_PATH
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file"
done
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file"
done
#########################################
# Core script code begins here
#########################################
# Sourced from
# https://complianceascode.readthedocs.io/en/latest/manual/developer/01_introduction.html
# https://github.com/ComplianceAsCode/content
# https://github.com/ComplianceAsCode
#apparmor
#enforcing
#enabled in bootloader config
#aide
#auditd
#disable auto mounting
#disable usb storage
#motd
#remote login warning banner
#Ensure time sync is working
#systemd-timesync
#ntp
#chrony
#password complexity
#password expiration warning
#password expiration time
#password hashing algo
#fix grub perms
if [ "$IS_RASPI" = 0 ] ; then
chown root:root /boot/grub/grub.cfg
chmod og-rwx /boot/grub/grub.cfg
chmod 0400 /boot/grub/grub.cfg
fi
#disable auto mounting
systemctl --now disable autofs || true
apt-get -y --purge remove autofs || true
#disable usb storage
cat "$CONFIGFILES_PATH/ModProbe/usb_storage.conf" > /etc/modprobe.d/usb_storage.conf
cat "$CONFIGFILES_PATH/ModProbe/dccp.conf" > /etc/modprobe.d/dccp.conf
cat "$CONFIGFILES_PATH/ModProbe/rds.conf" > /etc/modprobe.d/rds.conf
cat "$CONFIGFILES_PATH/ModProbe/sctp.conf" > /etc/modprobe.d/sctp.conf
cat "$CONFIGFILES_PATH/ModProbe/tipc.conf" > /etc/modprobe.d/tipc.conf
cat "$CONFIGFILES_PATH/ModProbe/cramfs.conf" > /etc/modprobe.d/cramfs.conf
cat "$CONFIGFILES_PATH/ModProbe/freevxfs.conf" > /etc/modprobe.d/freevxfs.conf
cat "$CONFIGFILES_PATH/ModProbe/hfs.conf" > /etc/modprobe.d/hfs.conf
cat "$CONFIGFILES_PATH/ModProbe/hfsplus.conf" > /etc/modprobe.d/hfsplus.conf
cat "$CONFIGFILES_PATH/ModProbe/jffs2.conf" > /etc/modprobe.d/jffs2.conf
cat "$CONFIGFILES_PATH/ModProbe/squashfs.conf" > /etc/modprobe.d/squashfs.conf
cat "$CONFIGFILES_PATH/ModProbe/udf.conf" > /etc/modprobe.d/udf.conf
#banners
cat "$CONFIGFILES_PATH/BANNERS/issue" > /etc/issue
cat "$CONFIGFILES_PATH/BANNERS/issue.net" > /etc/issue.net
cat "$CONFIGFILES_PATH/BANNERS/motd" > /etc/motd
#Cron perms
if [ -f /etc/cron.deny ]; then
rm /etc/cron.deny || true
fi
touch /etc/cron.allow
chmod g-wx,o-rwx /etc/cron.allow
chown root:root /etc/cron.allow
chmod og-rwx /etc/crontab
chmod og-rwx /etc/cron.hourly/
chmod og-rwx /etc/cron.daily/
chmod og-rwx /etc/cron.weekly/
chmod og-rwx /etc/cron.monthly/
chown root:root /etc/cron.d/
chmod og-rwx /etc/cron.d/
# At perms
rm -f /etc/at.deny || true
touch /etc/at.allow
chmod g-wx,o-rwx /etc/at.allow
chown root:root /etc/at.allow
archive/KNELServerBuild/ProjectCode/Modules/Security/secharden-ssh.sh
+105
View File
@@ -0,0 +1,105 @@
#!/bin/bash
#########################################
#Core framework functions...
#########################################
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
export CONFIGFILES_PATH
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file"
done
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file"
done
#########################################
# Core script code begins here
#########################################
export SUBODEV_CHECK
SUBODEV_CHECK="$(getent passwd | grep -c subodev || true)"
export LOCALUSER_CHECK
LOCALUSER_CHECK="$(getent passwd | grep -c localuser || true)"
export ROOT_SSH_DIR
ROOT_SSH_DIR="/root/.ssh"
export LOCALUSER_SSH_DIR
LOCALUSER_SSH_DIR="/home/localuser/.ssh"
export SUBODEV_SSH_DIR
SUBODEV_SSH_DIR="/home/subodev/.ssh"
if [ ! -d $ROOT_SSH_DIR ]; then
mkdir /root/.ssh/
fi
cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/root-ssh-authorized-keys" >/root/.ssh/authorized_keys
chmod 400 /root/.ssh/authorized_keys
chown root: /root/.ssh/authorized_keys
if [ "$LOCALUSER_CHECK" -gt 0 ]; then
if [ ! -d $LOCALUSER_SSH_DIR ]; then
mkdir -p /home/localuser/.ssh/
fi
cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/localuser-ssh-authorized-keys" >/home/localuser/.ssh/authorized_keys
chown localuser /home/localuser/.ssh/authorized_keys &&
chmod 400 /home/localuser/.ssh/authorized_keys
fi
if [ "$SUBODEV_CHECK" = 1 ]; then
if [ ! -d $SUBODEV_SSH_DIR ]; then
mkdir /home/subodev/.ssh/
fi
cat "$CONFIGFILES_PATH/SSH/AuthorizedKeys/localuser-ssh-authorized-keys" >/home/subodev/.ssh/authorized_keys
chmod 400 /home/subodev/.ssh/authorized_keys &&
chown subodev: /home/subodev/.ssh/authorized_keys
fi
export DEV_WORKSTATION_CHECK
DEV_WORKSTATION_CHECK="$(hostname | egrep -c 'subopi-dev|CharlesDevServer' || true)"
if [ "$DEV_WORKSTATION_CHECK" -eq 0 ]; then
cat "$CONFIGFILES_PATH/SSH/Configs/tsys-sshd-config" >/etc/ssh/sshd_config
fi
#Don't deploy this config to a ubuntu server, it breaks openssh server. Works on kali/debian.
export UBUNTU_CHECK
UBUNTU_CHECK="$(distro | grep -c Ubuntu||true)"
if [ "$UBUNTU_CHECK" -ne 1 ]; then
cat "$CONFIGFILES_PATH/SSH/Configs/ssh-audit-hardening.conf" >/etc/ssh/sshd_config.d/ssh-audit_hardening.conf
chmod og-rwx /etc/ssh/sshd_config.d/*
fi
# Perms on sshd_config
chmod og-rwx /etc/ssh/sshd_config
#todo
# only strong MAC algos are used
archive/KNELServerBuild/ProjectCode/Modules/Security/secharden-wazuh.sh
+57
View File
@@ -0,0 +1,57 @@
#!/bin/bash
#########################################
#Core framework functions...
#########################################
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/../../.." && pwd)"
export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file"
done
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file"
done
#########################################
# Core script code begins here
#########################################
# We don't want to run this on the wazuh server, otherwise bad things happen...
export TSYS_NSM_CHECK
TSYS_NSM_CHECK="$(hostname |grep -c tsys-nsm ||true)"
if [ "$TSYS_NSM_CHECK" -eq 0 ]; then
if [ -f /usr/share/keyrings/wazuh.gpg ]; then
rm -f /usr/share/keyrings/wazuh.gpg
fi
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import
chmod 644 /usr/share/keyrings/wazuh.gpg
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" > /etc/apt/sources.list.d/wazuh.list
apt-get update
WAZUH_MANAGER="tsys-nsm.knel.net" apt-get -y install wazuh-agent
systemctl daemon-reload
systemctl enable wazuh-agent
systemctl start wazuh-agent || true
echo "wazuh-agent hold" | dpkg --set-selections
fi
archive/KNELServerBuild/ProjectCode/SetupNewSystem.sh
+431
View File
@@ -0,0 +1,431 @@
#!/usr/bin/bash
#####
#Core framework functions...
#####
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
export PROJECT_ROOT_PATH
PROJECT_ROOT_PATH="$(cd "$SCRIPT_DIR/.." && pwd)"
export GIT_VENDOR_PATH_ROOT
GIT_VENDOR_PATH_ROOT="$PROJECT_ROOT_PATH/vendor/git@git.knownelement.com/29418/"
export KNELShellFrameworkRoot
KNELShellFrameworkRoot="$GIT_VENDOR_PATH_ROOT/KNEL/KNELShellFramework"
export CONFIGFILES_PATH
CONFIGFILES_PATH="$PROJECT_ROOT_PATH/ProjectCode/ConfigFiles"
export MODULES_PATH
MODULES_PATH="$PROJECT_ROOT_PATH/ProjectCode/Modules"
export SCRIPTS_PATH
SCRIPTS_PATH="$PROJECT_ROOT_PATH/ProjectCode/scripts"
source "$KNELShellFrameworkRoot/Framework-ConfigFiles/FrameworkVars"
for framework_include_file in "$KNELShellFrameworkRoot"/Framework-Includes/*; do
source "$framework_include_file"
done
for project_include_file in "$PROJECT_ROOT_PATH"/Project-Includes/*; do
source "$project_include_file"
done
# Start actual script logic here...
#################
#Global variables
#################
apt-get -y install git sudo dmidecode curl
export UBUNTU_CHECK
UBUNTU_CHECK="$(distro | grep -c Ubuntu || true)"
export IS_PHYSICAL_HOST
IS_PHYSICAL_HOST="$(/usr/sbin/dmidecode -t System | grep -c Dell || true)"
export SUBODEV_CHECK
SUBODEV_CHECK="$(getent passwd | grep -c subodev || true)"
export LOCALUSER_CHECK
LOCALUSER_CHECK="$(getent passwd | grep -c localuser || true)"
#######################
# Support functions
#######################
function global-oam() {
print_info "Now running $FUNCNAME...."
cat "$SCRIPTS_PATH/up2date.sh" >/usr/local/bin/up2date.sh && chmod +x /usr/local/bin/up2date.sh
bash "$MODULES_PATH/OAM/oam-librenms.sh"
print_info "Completed running $FUNCNAME"
}
function global-systemServiceConfigurationFiles() {
print_info "Now running $FUNCNAME...."
cat "$CONFIGFILES_PATH/ZSH/tsys-zshrc" >/etc/zshrc
cat "$CONFIGFILES_PATH/SMTP/aliases" >/etc/aliases
cat "$CONFIGFILES_PATH/Syslog/rsyslog.conf" >/etc/rsyslog.conf
newaliases
print_info "Completed running $FUNCNAME"
}
function global-installPackages() {
print_info "Now running $FUNCNAME...."
# Setup webmin repo, used for RBAC/2fa PAM
curl https://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.sh >/tmp/webmin-setup.sh
sh /tmp/webmin-setup.sh -f && rm -f /tmp/webmin-setup.sh
# Setup tailscale
curl -fsSL https://tailscale.com/install.sh | sh
#
#Patch the system
#
/usr/local/bin/up2date.sh
#Remove stuff we don't want
export DEBIAN_FRONTEND="noninteractive" \
&& apt-get -qq --yes --purge \
remove \
systemd-timesyncd \
chrony \
telnet \
inetutils-telnet \
wpasupplicant \
modemmanager \
nano \
multipath-tools \
|| true
apt-get -y --purge autoremove
# add stuff we want
print_info ""Now installing all the packages...""
DEBIAN_FRONTEND="noninteractive" apt-get -qq --yes -o Dpkg::Options::="--force-confold" install \
virt-what \
auditd \
audispd-plugins \
cloud-guest-utils \
aide \
htop \
snmpd \
ncdu \
iftop \
iotop \
cockpit \
cockpit-bridge \
cockpit-doc \
cockpit-networkmanager \
cockpit-packagekit \
cockpit-pcp \
cockpit-sosreport \
cockpit-storaged \
cockpit-system \
cockpit-ws \
nethogs \
sysstat \
ngrep \
acct \
lsb-release \
screen \
tailscale \
tmux \
vim \
command-not-found \
lldpd \
ansible-core \
net-tools \
dos2unix \
gpg \
molly-guard \
lshw \
fzf \
ripgrep \
sudo \
mailutils \
clamav \
sl \
logwatch \
git \
net-tools \
tshark \
tcpdump \
lynis \
glances \
zsh \
zsh-autosuggestions \
zsh-syntax-highlighting \
fonts-powerline \
webmin \
usermin \
ntpsec \
ntpsec-ntpdate \
tuned \
cockpit \
iptables \
netfilter-persistent \
iptables-persistent \
pflogsumm \
postfix
export KALI_CHECK
KALI_CHECK="$(distro | grep -c kali || true)"
export VIRT_TYPE
VIRT_TYPE="$(virt-what)"
export IS_VIRT_GUEST
IS_VIRT_GUEST="$(echo "$VIRT_TYPE" | egrep -c 'hyperv|kvm' || true)"
export IS_KVM_GUEST
IS_KVM_GUEST="$(echo "$VIRT_TYPE" | grep -c 'kvm' || true)"
if [[ $IS_KVM_GUEST = 1 ]]; then
apt -y install qemu-guest-agent
fi
if [[ $KALI_CHECK -eq 0 ]];then
DEBIAN_FRONTEND="noninteractive" apt-get -qq --yes -o Dpkg::Options::="--force-confold" install \
latencytop \
cockpit-tests || true
fi
if [[ $IS_PHYSICAL_HOST -gt 0 ]]; then
export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --yes -o Dpkg::Options::="--force-confold" install \
i7z \
thermald \
cpufrequtils \
linux-cpupower
# power-profiles-daemon
fi
############################
# Secrets agents
############################
# bitwarden cli
# vault cli
print_info "Completed running $FUNCNAME"
}
function global-postPackageConfiguration() {
print_info "Now running $FUNCNAME"
systemctl --now enable auditd
systemctl stop postfix
cat "$CONFIGFILES_PATH/SMTP/postfix_generic" >/etc/postfix/generic
postmap /etc/postfix/generic
postconf -e "inet_protocols = ipv4"
postconf -e "inet_interfaces = 127.0.0.1"
postconf -e "mydestination= 127.0.0.1"
postconf -e "relayhost = tsys-cloudron.knel.net"
postconf -e "smtp_generic_maps = hash:/etc/postfix/generic"
# smtp_generic_maps = hash:/etc/postfix/generic
systemctl restart postfix
#This is under test/dev and may fail
echo "hi from root to root" | mail -s "hi directly to root from $(hostname)" root
chsh -s $(which zsh) root
if [ "$LOCALUSER_CHECK" -gt 0 ]; then
chsh -s "$(which zsh)" localuser
fi
if [ "$SUBODEV_CHECK" -gt 0 ]; then
chsh -s "$(which zsh)" subodev
fi
###Post package deployment bits
cat "$CONFIGFILES_PATH/DHCP/dhclient.conf" >/etc/dhcp/dhclient.conf
# Authoritative recursive DNS via the redundant pfv-netinfra-01/02 pair.
# Replace whatever is at /etc/resolv.conf (including a systemd-resolved or
# NetworkManager symlink) with the managed static file so every lookup goes
# to our servers and nothing else rewrites it behind our backs.
rm -f /etc/resolv.conf
cat "$CONFIGFILES_PATH/Resolv/resolv.conf" >/etc/resolv.conf
chmod 644 /etc/resolv.conf
systemctl stop snmpd && /etc/init.d/snmpd stop
cat "$CONFIGFILES_PATH/SNMP/snmp-sudo.conf" >/etc/sudoers.d/Debian-snmp
sed -i "s|-Lsd|-LS6d|" /lib/systemd/system/snmpd.service
pi-detect
if [ "$IS_RASPI" = 1 ]; then
cat "$CONFIGFILES_PATH/SNMP/snmpd-rpi.conf" >/etc/snmp/snmpd.conf || true
fi
if [ "$IS_PHYSICAL_HOST" = 1 ]; then
cat "$CONFIGFILES_PATH/SNMP/snmpd-physicalhost.conf" >/etc/snmp/snmpd.conf || true
fi
if [ "$IS_VIRT_GUEST" = 1 ]; then
cat "$CONFIGFILES_PATH/SNMP/snmpd.conf" >/etc/snmp/snmpd.conf || true
fi
systemctl daemon-reload && systemctl restart snmpd && /etc/init.d/snmpd restart
cat "$CONFIGFILES_PATH/NetworkDiscovery/lldpd" >/etc/default/lldpd
systemctl restart lldpd
cat "$CONFIGFILES_PATH/Cockpit/disallowed-users" >/etc/cockpit/disallowed-users
systemctl restart cockpit
export LIBRENMS_CHECK
LIBRENMS_CHECK="$(hostname | grep -c tsys-librenms || true)"
if [ "$LIBRENMS_CHECK" -eq 0 ]; then
DEBIAN_FRONTEND="noninteractive" apt-get -qq --yes -o Dpkg::Options::="--force-confold" install rsyslog
systemctl stop rsyslog
systemctl start rsyslog
fi
export NTP_SERVER_CHECK
NTP_SERVER_CHECK="$(hostname | egrep -c 'pfv-netboot|pfvsvrpi|pfv-netinfra' || true)"
if [ "$NTP_SERVER_CHECK" -eq 0 ]; then
cat "$CONFIGFILES_PATH/NTP/ntp.conf" >/etc/ntpsec/ntp.conf
systemctl restart ntpsec.service
fi
systemctl stop postfix
systemctl start postfix
/usr/sbin/accton on
if [ "$IS_PHYSICAL_HOST" -gt 0 ]; then
cpufreq-set -r -g performance
cpupower frequency-set --governor performance
# Potentially merge the below if needed.
# power-profiles-daemon
# powerprofilesctl set performance
#tsys1# systemctl enable power-profiles-daemon
#tsys1# systemctl start power-profiles-daemon
fi
if [ "$IS_VIRT_GUEST" = 1 ]; then
tuned-adm profile virtual-guest
fi
print_info "Completed running $FUNCNAME"
}
####################################################################################################
# Run various modules
####################################################################################################
####################################################################################################
# Security Hardening
####################################################################################################
# SSH
function secharden-ssh() {
print_info "Now running $FUNCNAME"
bash "$MODULES_PATH/Security/secharden-ssh.sh"
print_info "Completed running $FUNCNAME"
}
function secharden-wazuh() {
print_info "Now running $FUNCNAME"
bash "$MODULES_PATH/Security/secharden-wazuh.sh"
print_info "Completed running $FUNCNAME"
}
function secharden-2fa() {
print_info "Now running $FUNCNAME"
bash "$MODULES_PATH/Security/secharden-2fa.sh"
print_info "Completed running $FUNCNAME"
}
function secharden-scap-stig() {
print_info "Now running $FUNCNAME"
bash "$MODULES_PATH/Security/secharden-scap-stig.sh"
print_info "Completed running $FUNCNAME"
}
function secharden-agents() {
print_info "Now running $FUNCNAME"
bash "$MODULES_PATH/Security/secharden-audit-agents.sh"
print_info "Completed running $FUNCNAME"
}
function secharden-auto-upgrades() {
print_info "Now running $FUNCNAME"
#curl --silent ${DL_ROOT}/Modules/Security/secharden-ssh.sh|$(which bash)
print_info "Completed running $FUNCNAME"
}
####################################################################################################
# Authentication
####################################################################################################
function auth-cloudron-ldap() {
print_info "Now running "$FUNCNAME""
#curl --silent ${DL_ROOT}/Modules/Auth/auth-cloudron-ldap.sh|$(which bash)
print_info "Completed running "$FUNCNAME""
}
####################################################################################################
# RUn the various functions in the correct order
####################################################################################################
echo >$LOGFILENAME
print_info "Execution starting at $CURRENT_TIMESTAMP..."
PreflightCheck
global-oam
global-installPackages
global-systemServiceConfigurationFiles
global-postPackageConfiguration
secharden-ssh
secharden-wazuh
secharden-scap-stig
secharden-2fa
#secharden-agents
#secharden-auto-upgrades
#auth-cloudron-ldap
print_info "Execution ended at $CURRENT_TIMESTAMP..."
archive/KNELServerBuild/ProjectCode/legacy/profiled-tmux.sh
+4
View File
@@ -0,0 +1,4 @@
if command -v tmux &> /dev/null && [ -n "$PS1" ] && [[ ! "$TERM" =~ screen ]] && [[ ! "$TERM" =~ tmux ]] && [ -z "$TMUX" ]; then
tmux a -t default || exec tmux new -s default && exit;
fi
archive/KNELServerBuild/ProjectCode/legacy/profiled-tsys-shell.sh
+1
View File
@@ -0,0 +1 @@
export HISTTIMEFORMAT="%m/%d/%Y %T "
archive/KNELServerBuild/ProjectCode/legacy/prox7.sh
+9
View File
@@ -0,0 +1,9 @@
#!/bin/bash
rm -f /etc/apt/sources.list.d/*
echo "deb https://download.proxmox.com/debian/pve bookworm pve-no-subscription" > /etc/apt/sources.list.d/pve-install-repo.list
wget https://download.proxmox.com/debian/proxmox-release-bookworm.gpg -O /etc/apt/trusted.gpg.d/proxmox-release-bookworm.gpg
apt update && apt -y full-upgrade
apt-get -y install ifupdown2 ipmitool ethtool net-tools lshw
#curl -s http://dl.turnsys.net/newSrv.sh|/bin/bash
archive/KNELServerBuild/ProjectCode/scripts/up2date.sh
+16
View File
@@ -0,0 +1,16 @@
#!/bin/bash
echo "Running apt-get update"
export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --yes update
echo "Running apt-get dist-upgrade"
export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --yes dist-upgrade
echo "Running apt-get upgrade"
export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --yes upgrade
echo "Running apt-get purge"
export DEBIAN_FRONTEND="noninteractive" && apt-get -qq --purge autoremove --yes
export DEBIAN_FRONTEND="noninteractive" && apt-get -qq autoclean --yes
archive/KNELServerBuild/ProjectDocs/AIReview-QWEN.md
+139
View File
@@ -0,0 +1,139 @@
# AI Review: KNELServerBuild (FetchApply) Project
## Executive Summary
The KNELServerBuild project is a comprehensive Infrastructure-as-Code (IaC) solution designed for provisioning Linux servers within the TSYS Group environment. The project implements a fetch-and-apply framework that automates the setup and hardening of server systems, incorporating security, monitoring, and operational components.
## Project Overview
The FetchApply project is a shell-based automation framework that provisions Linux servers with:
- Security hardening (SSH, 2FA, Wazuh, STIG compliance)
- Operational monitoring (LibreNMS, cockpit, SNMP)
- System packages and configurations for enterprise operations
- Network discovery and management capabilities
## Architecture and Structure
### Key Components
- **ProjectCode/**: Main setup and configuration scripts
- **Project-ConfigFiles/**: Configuration variables and parameters
- **Project-Includes/**: Reusable shell functions and utilities
- **Project-Tests/**: Comprehensive testing framework
- **Modules/**: Functional modules for security, operations, etc.
- **vendor/**: External dependencies and frameworks
### Core Workflow
The `SetupNewSystem.sh` orchestrates:
1. Preflight checks and environment validation
2. Package installation and system updates
3. Service configuration and hardening
4. Security implementation (SSH, Wazuh, 2FA)
5. Operational monitoring setup
## Strengths
### 1. Comprehensive Testing Framework
- Well-structured testing with unit, integration, security, and validation categories
- Clear documentation and usage instructions
- JSON reporting for CI/CD integration
### 2. Security-First Approach
- Multiple layers of security hardening (SSH, 2FA, audit agents)
- STIG compliance for government/hybrid environments
- Proper permission management and configuration validation
### 3. Modular Architecture
- Separated concerns into functional modules
- Reusable functions and components
- Clear separation between framework and project-specific code
### 4. Operational Readiness
- Built-in monitoring and alerting
- System performance optimization
- Network discovery and management tools
### 5. Cross-Platform Considerations
- Detection for different hardware types (physical, virtual, Raspberry Pi)
- Distribution-specific handling
- Environment-aware configurations
## Areas for Improvement
### 1. Documentation Completeness
- README mentions usage but lacks detailed architecture overview
- Missing troubleshooting and recovery procedures
- Limited guidance for extending/adding new modules
### 2. Security and Secrets Management
- Configuration files may expose hardcoded credentials or tokens
- No clear secrets management strategy
- Download URLs and endpoints are hardcoded in scripts
### 3. Error Handling and Resilience
- While scripts have basic error handling, recovery mechanisms are limited
- No rollback capabilities for failed installations
- Some operations may fail silently
### 4. Scalability and Performance
- Scripts execute sequentially without parallelization
- No caching mechanisms for downloads
- Limited handling for high-latency networks
### 5. Configuration Management
- Configuration values scattered across multiple files
- No centralized configuration management
- Difficult to customize for different environments
## Recommendations
### 1. Enhance Security Practices
- Implement secrets management (HashiCorp Vault, AWS Secrets Manager, etc.)
- Add configuration validation before applying changes
- Implement digital signature verification for downloaded content
- Add security scanning of packages before installation
### 2. Improve Testing Coverage
- Add end-to-end tests for complete deployment scenarios
- Implement performance benchmarks
- Add security validation tests
- Include tests for different hardware configurations
### 3. Add Monitoring and Observability
- Implement deployment success/failure metrics
- Add progress tracking for long-running operations
- Include health checks post-deployment
- Add rollback mechanisms for failed deployments
### 4. Refactor for Maintainability
- Centralize configuration management
- Abstract environment-specific variables
- Implement plugin architecture for new modules
- Add proper logging and audit trails
### 5. Enhance Usability
- Add dry-run functionality for testing changes
- Provide rollback/recovery procedures
- Add interactive mode for new users
- Implement configuration templates
## Technical Debt Assessment
### High Priority
- Centralized configuration management
- Secrets handling and security
- Error recovery and rollback mechanisms
### Medium Priority
- Parallel execution of independent operations
- Caching for downloaded packages/configs
- Improved logging and monitoring
### Low Priority
- Code modernization (consider newer shell features)
- Migration to configuration management tools (Ansible/Terraform)
## Conclusion
The FetchApply project represents a solid foundation for automated server provisioning with good security practices and testing. However, there are significant opportunities to improve security, maintainability, and operational resilience. Prioritizing security improvements and configuration management would provide the greatest value to the project's stability and long-term viability.
The modular architecture and comprehensive testing framework provide a strong foundation for future enhancements and improvements.
archive/KNELServerBuild/ProjectDocs/AiOverview-Gemini.md
+44
View File
@@ -0,0 +1,44 @@
# AI Overview of KNELServerBuild
This is an AI-generated overview of the KNELServerBuild project. The analysis is based on a read-only review of the project's files.
## Project Overview
The KNELServerBuild project is an Infrastructure as Code (IAC) repository for provisioning and configuring Linux servers. It is based on a collection of bash scripts that automate the installation of packages, configuration of services, and security hardening of the system. The project is designed to be used with the `FetchApply` tool, which is not included in this repository.
The main entry point of the project is the `ProjectCode/SetupNewSystem.sh` script. This script performs the following actions:
* **Initializes the environment:** Sets up project paths and sources a shell framework (`KNELShellFramework`) and project-specific includes.
* **Installs packages:** Installs a wide range of packages, including monitoring agents (check_mk, snmp), security tools (auditd, aide, lynis, clamav), administration tools (cockpit, webmin), and common utilities (tmux, vim, zsh).
* **Configures services:** Configures various services like Postfix for email, `rsyslog` for system logging, `snmpd` for monitoring, `lldpd` for network discovery, and `cockpit`.
* **Security Hardening:** It runs a series of security hardening scripts from `Modules/Security`, including `secharden-ssh.sh`, `secharden-wazuh.sh`, `secharden-2fa.sh`, and `secharden-scap-stig.sh`.
* **OAM:** It runs an OAM (Operations, Administration, and Maintenance) script for LibreNMS.
* **Conditional Logic:** It has conditional logic to apply different configurations based on whether the host is a physical Dell server, a virtual machine (KVM or Hyper-V), or a Raspberry Pi.
## What I Like
* **Well-structured:** The project is well-structured, with separate directories for code, configuration files, documentation, and tests. This makes it easy to understand and maintain.
* **Modularity:** The use of modules for different functionalities (e.g., security hardening, OAM) is a good practice. It allows for easy extension and modification of the project.
* **Comprehensive:** The project covers a wide range of aspects of server provisioning, from package installation to security hardening.
* **Conditional Logic:** The use of conditional logic to adapt the configuration to different environments is a good feature.
* **Good commenting:** The scripts are generally well-commented, which makes them easier to understand.
## Areas for Improvement
* **Error Handling:** The scripts could benefit from more robust error handling. For example, the `SetupNewSystem.sh` script uses `set -e` to exit on error, but it does not have any specific error handling logic.
* **Idempotency:** The scripts are not fully idempotent. For example, some of the `curl` commands will re-download files even if they already exist. This could be improved by adding checks to see if the files already exist.
* **Testing:** The project has a `Project-Tests` directory, but it is not clear how the tests are run or what they cover. The testing framework could be improved to provide more comprehensive coverage of the project's functionality.
* **Secrets Management:** The scripts contain some hardcoded secrets, such as the `relayhost` for Postfix. These secrets should be managed using a secrets management tool like HashiCorp Vault or AWS Secrets Manager.
* **Configuration Management:** The project uses a collection of shell scripts to manage the configuration of the system. While this works, it can be difficult to manage and maintain in the long run. A configuration management tool like Ansible, Puppet, or Chef would be a better choice for this task. The project already installs `ansible-core`, so it would be a natural progression to move the logic to Ansible playbooks.
* **Documentation:** The project has some documentation, but it could be improved. For example, the `README.md` file could provide more information on how to use the project and how to contribute to it.
## Recommendations
* **Improve Error Handling:** Add more robust error handling to the scripts to make them more reliable.
* **Improve Idempotency:** Make the scripts more idempotent to avoid unnecessary re-downloads and re-configurations.
* **Improve Testing:** Implement a more comprehensive testing framework to ensure the quality of the project.
* **Use a Secrets Management Tool:** Use a secrets management tool to manage the secrets in the project.
* **Use a Configuration Management Tool:** Use a configuration management tool like Ansible to manage the configuration of the system.
* **Improve Documentation:** Improve the documentation of the project to make it easier to use and contribute to.
Overall, the KNELServerBuild project is a good starting point for an IAC repository. It is well-structured and covers a wide range of aspects of server provisioning. However, there are some areas where it could be improved. By addressing the areas for improvement, the project can be made more robust, reliable, and maintainable.
archive/KNELServerBuild/ProjectDocs/AiOverview-OpenCode.md
+308
View File
@@ -0,0 +1,308 @@
# AI Overview: KNEL Server Build (FetchApply) Project
**Date:** December 26, 2025
**Reviewer:** OpenCode AI Assistant
**Project:** TSYS Infrastructure Provisioning System
## Executive Summary
The KNEL Server Build project is a comprehensive Infrastructure as Code (IaC) system for Linux server provisioning and security hardening. It demonstrates strong architectural patterns with a modular framework approach but has several areas requiring improvement for production readiness, security, and maintainability.
## Architecture Assessment
### Strengths ✅
**1. Modular Framework Design**
- Well-structured KNELShellFramework with centralized includes
- Clear separation between framework, project code, and configuration
- Consistent pattern for sourcing framework components
- Proper abstraction of common functionality
**2. Comprehensive Security Modules**
- Extensive security hardening capabilities (SSH, Wazuh, 2FA, SCAP/STIG)
- HTTPS enforcement throughout
- Proper audit logging integration
- Good compliance focus with industry standards
**3. Testing Infrastructure**
- Automated test suite with multiple categories (unit, integration, security, validation)
- JSON-based test reporting
- Good test organization and coverage
**4. Documentation Excellence**
- Comprehensive deployment guide with troubleshooting
- Detailed development guidelines with best practices
- Security documentation with threat model
- Code review findings and refactoring examples
### Areas for Improvement ⚠️
**1. Performance Issues**
- Multiple separate package installation commands instead of consolidated approach
- Individual file downloads causing network overhead
- No connection pooling for multiple downloads from same host
**2. Security Vulnerabilities**
- SSH keys stored in git repository (secrets management needed)
- No download integrity verification (checksum validation)
- Missing comprehensive input validation
- Unquoted variable expansions creating injection risks
**3. Error Handling Gaps**
- Network operations lack timeout and retry logic
- Inconsistent error handling across modules
- Missing graceful failure handling in critical paths
## Technical Debt Analysis
### High Priority Issues
**1. Package Installation Performance**
```bash
# Current inefficient pattern in SetupNewSystem.sh
apt-get -y install git sudo dmidecode curl # Line 27
# Later: separate massive apt-get command
```
**Impact:** 30-40% slower deployments, multiple package cache updates
**2. Network Resilience**
```bash
# Vulnerable pattern throughout codebase
curl --silent ${DL_ROOT}/path/file >/etc/config
```
**Impact:** Deployment failures in poor network conditions, no recovery mechanism
**3. Variable Quoting Security**
```bash
# Risky pattern
chsh -s $(which zsh) root
```
**Impact:** Potential command injection vulnerabilities
### Medium Priority Issues
**1. Framework Consistency**
- Not all modules follow established error handling patterns
- Inconsistent logging and progress reporting
- Mixed coding standards across different components
**2. Testing Coverage**
- Limited integration testing for complex workflows
- Missing performance benchmarking tests
- No automated regression testing for configuration changes
## Recommendations
### Immediate Actions (Week 1-2)
**1. Implement Safe Download Framework**
```bash
# Create centralized download function with:
# - Connection timeouts (30s)
# - Retry logic (3 attempts)
# - Checksum validation
# - Error recovery
```
**2. Consolidate Package Management**
```bash
# Single package installation with logical grouping:
# - Core system tools
# - Security packages
# - Monitoring tools
# - Development utilities
```
**3. Fix Variable Quoting**
- Audit entire codebase for unquoted variables
- Implement static analysis check in CI pipeline
- Add input validation framework
### Medium-term Improvements (Month 1-2)
**1. Secrets Management**
- Remove SSH keys from repository
- Integrate Bitwarden/Vault for secret storage
- Implement key rotation procedures
**2. Performance Optimization**
- Implement batch download operations
- Add connection pooling
- Create deployment metrics collection
**3. Enhanced Testing**
- Add performance benchmarking
- Implement chaos engineering for network failures
- Create automated regression testing
### Long-term Enhancements (Quarter 1)
**1. Infrastructure Improvements**
- Implement configuration backup/restore
- Add rollback capability for failed deployments
- Create deployment pipeline with staging environments
**2. Advanced Security**
- Implement supply chain security with SBOM
- Add automated vulnerability scanning
- Create security compliance reporting
## Code Quality Assessment
### Positive Patterns
- Good function documentation in recent code
- Proper error handling in newer modules
- Consistent use of framework logging functions
- Clear separation of concerns
### Problem Patterns
- Mixed coding styles across files
- Inconsistent framework usage
- Missing input validation
- Hardcoded configuration values
### Modernization Opportunities
**1. Containerization**
- Consider Docker-based deployment testing
- Create immutable infrastructure patterns
- Implement blue-green deployments
**2. Configuration Management**
- Move to declarative configuration approach
- Implement configuration drift detection
- Add automated compliance checking
**3. Observability**
- Implement comprehensive logging with structured formats
- Add metrics collection for deployment performance
- Create dashboard for system health monitoring
## Security Posture Review
### Current Strengths
- HTTPS-only downloads
- Good SSH hardening practices
- Comprehensive audit logging
- Regular security scanning integration
### Critical Gaps
- No integrity verification for downloads
- Secrets stored in version control
- Limited defense in depth
- Missing automated security testing
### Recommended Security Enhancements
**1. Supply Chain Security**
- Implement checksum validation for all downloads
- Add GPG signature verification where available
- Create SBOM generation for deployments
**2. Access Control**
- Implement role-based access control
- Add privileged access management
- Create audit trail for all administrative actions
**3. Continuous Security**
- Integrate automated vulnerability scanning
- Implement security testing in CI/CD
- Create security metrics dashboard
## Deployment Readiness Assessment
### Current State: **70% Production Ready**
**Ready Components:**
- Core provisioning functionality
- Security hardening modules
- Basic testing framework
- Documentation
**Missing Components:**
- Robust error handling
- Performance optimization
- Secrets management
- Comprehensive testing
### Path to Production Readiness
**Phase 1 (2 weeks):** Critical fixes and performance optimization
**Phase 2 (4 weeks):** Security enhancements and testing improvements
**Phase 3 (8 weeks):** Advanced features and production hardening
## Overall Assessment
### What I Like 🎯
**1. Architectural Excellence**
- The KNELShellFramework shows mature thinking about code organization
- Modular approach allows for easy maintenance and extension
- Clear separation of concerns between framework and project code
**2. Security-First Mindset**
- Comprehensive security hardening capabilities
- Good threat awareness and mitigation strategies
- Integration with industry-standard security tools
**3. Documentation Quality**
- Excellent documentation with practical examples
- Clear deployment guides with troubleshooting sections
- Good development guidelines for team consistency
### What I Don't Like 🚫
**1. Performance Oversights**
- Multiple package installations causing unnecessary delays
- Individual file downloads creating network overhead
- No performance metrics or monitoring
**2. Security Gaps**
- Critical vulnerability with secrets in git repository
- No download integrity verification
- Missing comprehensive input validation
**3. Code Quality Issues**
- Inconsistent error handling across modules
- Variable quoting creating security risks
- Mixed coding standards throughout codebase
### Improvement Potential 📈
**1. Immediate Impact (High ROI)**
- Package installation consolidation: 30-40% performance improvement
- Safe download framework: 90% reduction in network-related failures
- Variable quoting fixes: Eliminate security vulnerabilities
**2. Medium-term Benefits**
- Secrets management: Eliminate critical security risks
- Performance optimization: Better user experience
- Enhanced testing: Higher reliability and confidence
**3. Long-term Value**
- Containerization: Modern deployment patterns
- Observability: Better operational insight
- Automation: Reduced manual overhead
## Final Recommendation
The KNEL Server Build project demonstrates solid architectural foundations and comprehensive security capabilities. With focused improvements in performance optimization, security hardening (particularly secrets management), and error handling, this system can become a production-grade infrastructure provisioning solution.
**Priority:**
1. **Immediate:** Fix security vulnerabilities and performance bottlenecks
2. **Short-term:** Enhance testing and error handling
3. **Long-term:** Implement advanced features and modernization
**Investment Justification:** The project shows strong potential with a clear path to production readiness. The modular architecture and comprehensive security focus make it a valuable foundation for enterprise infrastructure automation.
---
**Next Steps:**
1. Create implementation roadmap for critical fixes
2. Establish performance benchmarks
3. Implement continuous integration with quality gates
4. Plan phased rollout to production environments
**Risk Level:** Medium - manageable with proper remediation plan
**Business Value:** High - significant time savings and security improvements
**Technical Debt:** Moderate - requires systematic but achievable refactoring
archive/KNELServerBuild/ProjectDocs/AiSecurityAudit-Gemini.md
+27
View File
@@ -0,0 +1,27 @@
# AI Security Audit of KNELServerBuild
This is an AI-generated security audit of the KNELServerBuild project. The analysis is based on a read-only review of the project's files.
## Summary of Findings
The KNELServerBuild project has a good security posture overall, but there are a few areas that could be improved. The most significant finding is the presence of SSH authorized keys in the repository. This is a security risk, as it allows anyone with access to the repository to know which public keys are authorized to access the servers.
### High-Risk Findings
* **SSH Authorized Keys in Repository:** The `ProjectCode/ConfigFiles/SSH/AuthorizedKeys` directory contains SSH authorized keys for the `localuser` and `root` users. This is a security risk, as it allows anyone with access to the repository to know which public keys are authorized to access the servers.
### Medium-Risk Findings
* **Hardcoded Hostnames:** The scripts contain several hardcoded hostnames for services like Postfix, NTP, syslog, and Wazuh. This is not a direct security risk, but it does represent a configuration management issue. If any of these hostnames change, they will need to be updated in multiple places.
### Low-Risk Findings
* **Potential for Password on Command Line:** The `ProjectCode/Agents/librenms/mysql.sh` script has a `--pass` argument for a MySQL password. This is a potential security risk if the password is provided on the command line, as it could be logged in the shell history.
## Recommendations
* **Remove SSH Authorized Keys from Repository:** The SSH authorized keys should be removed from the repository and managed using a secrets management tool like HashiCorp Vault or AWS Secrets Manager.
* **Use Variables for Hostnames:** The hardcoded hostnames should be replaced with variables that are defined in a central configuration file. This will make it easier to update the hostnames if they change.
* **Avoid Passwords on Command Line:** The `ProjectCode/Agents/librenms/mysql.sh` script should be modified to avoid passing the MySQL password on the command line. For example, the script could prompt the user for the password or read it from a configuration file.
Overall, the KNELServerBuild project is a good starting point for an IAC repository. By addressing the security risks identified in this audit, the project can be made more secure and reliable.
archive/KNELServerBuild/ProjectDocs/CODE-REVIEW-FINDINGS.md
+279
View File
@@ -0,0 +1,279 @@
# TSYS FetchApply Code Review Findings
**Review Date:** July 14, 2025
**Reviewer:** Claude (Anthropic)
**Repository:** TSYS Group Infrastructure Provisioning Scripts
## Executive Summary
The repository shows good architectural structure with centralized framework components, but has several performance, security, and maintainability issues that require attention. The codebase is functional but needs optimization for production reliability.
## Critical Issues (High Priority)
### 1. Package Installation Performance ⚠️
**Location:** `ProjectCode/SetupNewSystem.sh:27` and `Lines 117-183`
**Issue:** Multiple separate package installation commands causing performance bottlenecks
```bash
# Current inefficient pattern
apt-get -y install git sudo dmidecode curl
# ... later in script ...
DEBIAN_FRONTEND="noninteractive" apt-get -qq --yes install virt-what auditd ...
```
**Impact:** Significantly slower deployment, multiple package cache updates
**Fix:** Combine all package installations into single command
### 2. Network Operations Lack Error Handling 🔴
**Location:** `ProjectCode/SetupNewSystem.sh:61-63`, multiple modules
**Issue:** curl commands without timeout or error handling
```bash
# Vulnerable pattern
curl --silent ${DL_ROOT}/path/file >/etc/config
```
**Impact:** Deployment failures in poor network conditions
**Fix:** Add timeout, error handling, and retry logic
### 3. Unquoted Variable Expansions 🔴
**Location:** Multiple files, including `ProjectCode/SetupNewSystem.sh:244`
**Issue:** Variables used without proper quoting creating security risks
```bash
# Risky pattern
chsh -s $(which zsh) root
```
**Impact:** Potential command injection, script failures
**Fix:** Quote all variable expansions consistently
## Security Concerns
### 4. No Download Integrity Verification 🔴
**Issue:** All remote downloads lack checksum verification
**Impact:** Supply chain attack vulnerability
**Recommendation:** Implement SHA256 checksum validation
### 5. Excessive Root Privilege Usage ⚠️
**Issue:** All operations run as root without privilege separation
**Impact:** Unnecessary security exposure
**Recommendation:** Delegate non-privileged operations when possible
## Performance Optimization Opportunities
### 6. Individual File Downloads 🟡
**Location:** `ProjectCode/Modules/Security/secharden-scap-stig.sh:66-77`
**Issue:** 12+ individual curl commands for config files
```bash
curl --silent ${DL_ROOT}/path1 > /etc/file1
curl --silent ${DL_ROOT}/path2 > /etc/file2
# ... repeated 12+ times
```
**Impact:** Network overhead, slower deployment
**Fix:** Batch download operations
### 7. Missing Connection Pooling ⚠️
**Issue:** No connection reuse for multiple downloads from same host
**Impact:** Unnecessary connection overhead
**Fix:** Use curl with connection reuse or wget with keep-alive
## Code Quality Issues
### 8. Inconsistent Framework Usage 🟡
**Issue:** Not all modules use established error handling framework
**Impact:** Inconsistent error reporting, debugging difficulties
**Fix:** Standardize framework usage across all modules
### 9. Incomplete Function Implementations 🟡
**Location:** `Framework-Includes/LookupKv.sh`
**Issue:** Stubbed functions with no implementation
**Impact:** Technical debt, confusion
**Fix:** Implement or remove unused functions
### 10. Missing Input Validation 🟡
**Location:** `Project-Includes/pi-detect.sh`
**Issue:** Functions lack proper input validation and quoting
**Impact:** Potential script failures
**Fix:** Add comprehensive input validation
## Recommended Immediate Actions
### Phase 1: Critical Fixes (Week 1)
1. **Fix variable quoting** throughout codebase
2. **Add error handling** to all network operations
3. **Combine package installations** for performance
4. **Implement download integrity verification**
### Phase 2: Performance Optimization (Week 2)
1. **Batch file download operations**
2. **Add connection timeouts and retries**
3. **Implement bulk configuration deployment**
4. **Optimize service restart procedures**
### Phase 3: Code Quality (Week 3-4)
1. **Standardize framework usage**
2. **Add comprehensive input validation**
3. **Implement proper logging with timestamps**
4. **Remove or complete stubbed functions**
## Specific Code Improvements
### Enhanced Error Handling Pattern
```bash
function safe_download() {
local url="$1"
local dest="$2"
local max_attempts=3
local attempt=1
while [[ $attempt -le $max_attempts ]]; do
if curl --silent --connect-timeout 30 --max-time 60 --fail "$url" > "$dest"; then
print_success "Downloaded: $(basename "$dest")"
return 0
else
print_warning "Download attempt $attempt failed: $url"
((attempt++))
sleep 5
fi
done
print_error "Failed to download after $max_attempts attempts: $url"
return 1
}
```
### Bulk Package Installation Pattern
```bash
function install_all_packages() {
print_info "Installing all required packages..."
local packages=(
# Core system packages
git sudo dmidecode curl wget
# Security packages
auditd fail2ban aide
# Monitoring packages
snmpd snmp-mibs-downloader
# Additional packages
virt-what net-tools htop
)
if DEBIAN_FRONTEND="noninteractive" apt-get -qq --yes -o Dpkg::Options::="--force-confold" install "${packages[@]}"; then
print_success "All packages installed successfully"
else
print_error "Package installation failed"
return 1
fi
}
```
### Batch Configuration Download
```bash
function download_configurations() {
print_info "Downloading configuration files..."
local -A configs=(
["${DL_ROOT}/ProjectCode/ConfigFiles/ZSH/tsys-zshrc"]="/etc/zshrc"
["${DL_ROOT}/ProjectCode/ConfigFiles/SMTP/aliases"]="/etc/aliases"
["${DL_ROOT}/ProjectCode/ConfigFiles/Syslog/rsyslog.conf"]="/etc/rsyslog.conf"
)
for url in "${!configs[@]}"; do
local dest="${configs[$url]}"
if ! safe_download "$url" "$dest"; then
return 1
fi
done
print_success "All configurations downloaded"
}
```
## Testing Recommendations
### Add Performance Tests
```bash
function test_package_installation_performance() {
local start_time=$(date +%s)
install_all_packages
local end_time=$(date +%s)
local duration=$((end_time - start_time))
echo "✅ Package installation completed in ${duration}s"
if [[ $duration -gt 300 ]]; then
echo "⚠️ Installation took longer than expected (>5 minutes)"
fi
}
```
### Add Network Resilience Tests
```bash
function test_network_error_handling() {
# Test with invalid URL
if safe_download "https://invalid.example.com/file" "/tmp/test"; then
echo "❌ Error handling test failed - should have failed"
return 1
else
echo "✅ Error handling test passed"
return 0
fi
}
```
## Monitoring and Metrics
### Deployment Performance Metrics
- **Package installation time:** Should complete in <5 minutes
- **Configuration download time:** Should complete in <2 minutes
- **Service restart time:** Should complete in <30 seconds
- **Total deployment time:** Should complete in <15 minutes
### Error Rate Monitoring
- **Network operation failures:** Should be <1%
- **Package installation failures:** Should be <0.1%
- **Service restart failures:** Should be <0.1%
## Compliance Assessment
### Development Guidelines Adherence
✅ **Good:** Single package commands in newer modules
✅ **Good:** Framework integration patterns
✅ **Good:** Function documentation in recent code
❌ **Needs Work:** Variable quoting consistency
❌ **Needs Work:** Error handling standardization
❌ **Needs Work:** Input validation coverage
## Risk Assessment
**Current Risk Level:** Medium
**Key Risks:**
1. **Deployment failures** due to network issues
2. **Security vulnerabilities** from unvalidated downloads
3. **Performance issues** in production deployments
4. **Maintenance challenges** from code inconsistencies
**Mitigation Priority:**
1. Network error handling (High)
2. Download integrity verification (High)
3. Performance optimization (Medium)
4. Code standardization (Medium)
## Conclusion
The TSYS FetchApply repository has a solid foundation but requires systematic improvements to meet production reliability standards. The recommended fixes will significantly enhance:
- **Deployment reliability** through better error handling
- **Security posture** through integrity verification
- **Performance** through optimized operations
- **Maintainability** through code standardization
Implementing these improvements in the suggested phases will create a robust, production-ready infrastructure provisioning system.
---
**Next Steps:**
1. Review and prioritize findings with development team
2. Create implementation plan for critical fixes
3. Establish testing procedures for improvements
4. Set up monitoring for deployment metrics
archive/KNELServerBuild/ProjectDocs/Claude-Review.md
+93
View File
@@ -0,0 +1,93 @@
# Claude Code Review - TSYS FetchApply Infrastructure
**Review Date:** July 14, 2025 (Updated)
**Reviewed by:** Claude (Anthropic)
**Repository:** TSYS Group Infrastructure Provisioning Scripts
**Previous Review:** July 12, 2025
## Project Overview
This repository contains infrastructure-as-code for provisioning Linux servers in the TSYS Group environment. The codebase includes 32 shell scripts (~2,800 lines) organized into a modular framework for system hardening, security configuration, and operational tooling deployment.
## Strengths ✅
### Security Hardening
- **SSH Security:** Comprehensive SSH hardening with key-only authentication, disabled password login, and secure cipher configurations
- **Security Agents:** Automated deployment of Wazuh SIEM agents, audit tools, and SCAP-STIG compliance checking
- **File Permissions:** Proper restrictive permissions (400 for SSH keys, 644 for configs)
- **Network Security:** Firewall configuration, network discovery tools (LLDP), and monitoring agents
### Code Quality
- **Error Handling:** Robust bash strict mode implementation (`set -euo pipefail`) with custom error trapping and line number reporting
- **Modular Design:** Well-organized structure separating framework components, configuration files, and functional modules
- **Environment Awareness:** Intelligent detection of physical vs virtual hosts, distribution-specific logic, and hardware-specific optimizations
- **Logging:** Centralized logging with timestamp-based log files and colored output for debugging
### Operational Excellence
- **Package Management:** Automated repository setup for security tools (Lynis, Webmin, Tailscale, Wazuh)
- **System Tuning:** Performance optimizations for physical hosts, virtualization-aware configurations
- **Monitoring Integration:** LibreNMS agents, SNMP configuration, and system metrics collection
## Security Concerns ⚠️
### Critical Issues
1. **~~Insecure Deployment Method~~** ✅ **RESOLVED:** Now uses `git clone` + local script execution instead of `curl | bash`
2. **No Integrity Verification:** Downloaded scripts lack checksum validation or cryptographic signatures
3. **~~HTTP Downloads~~** ✅ **RESOLVED:** All HTTP URLs converted to HTTPS (Dell OMSA, Proxmox, Apache sources)
### Moderate Risks
4. **Exposed SSH Keys:** Public SSH keys committed directly to repository without rotation mechanism
5. **Hard-coded Credentials:** Server hostnames and domain names embedded in scripts
6. **Missing Secrets Management:** No current implementation of Bitwarden/Vault integration (noted in TODO comments)
## Improvement Recommendations 🔧
### High Priority (Security Critical)
1. **~~Secure Deployment Pipeline~~** ✅ **RESOLVED:** Now uses git clone-based deployment
2. **~~HTTPS Enforcement~~** ✅ **RESOLVED:** All HTTP downloads converted to HTTPS
3. **Script Integrity:** Implement SHA256 checksum verification for all downloaded components
4. **Secrets Management:** Deploy proper secrets handling for SSH keys and sensitive configurations
### Medium Priority (Operational)
5. **Testing Framework:** Add integration tests for provisioning workflows
6. **Documentation Enhancement:** Expand security considerations and deployment procedures
7. **Configuration Validation:** Add pre-deployment validation of system requirements
8. **Rollback Capability:** Implement configuration backup and rollback mechanisms
### Low Priority (Quality of Life)
9. **Error Recovery:** Enhanced error recovery and partial deployment resumption
10. **Monitoring Integration:** Centralized logging and deployment status reporting
11. **User Interface:** Consider web-based deployment dashboard for non-technical users
## Risk Assessment 📊
**Overall Risk Level:** Low-Medium ⬇️ (Reduced from Medium-Low)
The repository contains well-architected defensive security tools with strong error handling and modular design. **Major security improvement:** The insecure `curl | bash` deployment method has been replaced with git-based deployment. Remaining concerns are primarily around hardening the provisioning scripts themselves rather than the deployment method.
**Recommendation:** Continue addressing remaining security issues (HTTPS enforcement, secrets management) but the critical deployment risk has been mitigated. The codebase is much safer for production use.
## Update Summary (July 14, 2025)
**✅ Resolved Issues:**
- Insecure deployment method replaced with git clone approach
- README.md updated with project management and community links
- Deployment security risk significantly reduced
- All HTTP URLs converted to HTTPS (Dell OMSA, Proxmox, Apache sources)
**🔄 Remaining Priorities:**
1. ~~HTTPS enforcement for internal downloads~~ ✅ **RESOLVED:** All HTTP URLs converted to HTTPS
2. Secrets management implementation
3. Script integrity verification
4. SSH key rotation from repository
## Files Reviewed
- 32 shell scripts across Framework-Includes, Project-Includes, and ProjectCode directories
- Configuration files for SSH, SNMP, logging, and system services
- Security modules for hardening, authentication, and monitoring
- Documentation and framework configuration files
## Next Steps
See `charles-todo.md` and `claude-todo.md` for detailed action items prioritized for human operators and AI assistants respectively.
archive/KNELServerBuild/ProjectDocs/DEPLOYMENT.md
+336
View File
@@ -0,0 +1,336 @@
# TSYS FetchApply Deployment Guide
## Overview
This guide provides comprehensive instructions for deploying the TSYS FetchApply infrastructure provisioning system on Linux servers.
## Prerequisites
### System Requirements
- **Operating System:** Ubuntu 18.04+ or Debian 10+ (recommended)
- **RAM:** Minimum 2GB, recommended 4GB
- **Disk Space:** Minimum 10GB free space
- **Network:** Internet connectivity for package downloads
- **Privileges:** Root or sudo access required
### Required Tools
- `git` - Version control system
- `curl` - HTTP client for downloads
- `wget` - Alternative download tool
- `systemctl` - System service management
- `apt-get` - Package management (Debian/Ubuntu)
### Network Requirements
- **HTTPS access** to:
- `https://archive.ubuntu.com` (Ubuntu packages)
- `https://linux.dell.com` (Dell hardware support)
- `https://download.proxmox.com` (Proxmox packages)
- `https://github.com` (Git repositories)
## Pre-Deployment Validation
### 1. System Compatibility Check
```bash
# Clone repository
git clone [repository-url]
cd FetchApply
# Run system validation
./Project-Tests/validation/system-requirements.sh
```
### 2. Network Connectivity Test
```bash
# Test network connectivity
curl -I https://archive.ubuntu.com
curl -I https://linux.dell.com
curl -I https://download.proxmox.com
```
### 3. Permission Verification
```bash
# Verify write permissions
test -w /etc && echo "✅ /etc writable" || echo "❌ /etc not writable"
test -w /usr/local/bin && echo "✅ /usr/local/bin writable" || echo "❌ /usr/local/bin not writable"
```
## Deployment Methods
### Method 1: Standard Deployment (Recommended)
```bash
# 1. Clone repository
git clone [repository-url]
cd FetchApply
# 2. Run pre-deployment tests
./Project-Tests/run-tests.sh validation
# 3. Execute deployment
cd ProjectCode
sudo bash SetupNewSystem.sh
```
### Method 2: Dry Run Mode
```bash
# 1. Clone repository
git clone [repository-url]
cd FetchApply
# 2. Review configuration
cat ProjectCode/SetupNewSystem.sh
# 3. Execute with manual review
cd ProjectCode
sudo bash -x SetupNewSystem.sh # Debug mode
```
## Deployment Process
### Phase 1: Framework Initialization
1. **Environment Setup**
- Load framework variables
- Source framework includes
- Initialize logging system
2. **System Detection**
- Detect physical vs virtual hardware
- Identify operating system
- Check for existing users
### Phase 2: Base System Configuration
1. **Package Installation**
- Update package repositories
- Install essential packages
- Configure package sources
2. **User Management**
- Create required user accounts
- Configure SSH access
- Set up sudo permissions
### Phase 3: Security Hardening
1. **SSH Configuration**
- Deploy hardened SSH configuration
- Install SSH keys
- Disable password authentication
2. **System Hardening**
- Configure firewall rules
- Enable audit logging
- Install security tools
### Phase 4: Monitoring and Management
1. **Monitoring Agents**
- Deploy LibreNMS agents
- Configure SNMP
- Set up system monitoring
2. **Management Tools**
- Install Cockpit dashboard
- Configure remote access
- Set up maintenance scripts
## Post-Deployment Verification
### 1. Security Validation
```bash
# Run security tests
./Project-Tests/run-tests.sh security
# Verify SSH configuration
ssh -T [server-ip] # Should work with key authentication
```
### 2. Service Status Check
```bash
# Check critical services
sudo systemctl status ssh
sudo systemctl status auditd
sudo systemctl status snmpd
```
### 3. Network Connectivity
```bash
# Test internal services
curl -k https://localhost:9090 # Cockpit
snmpwalk -v2c -c public localhost system
```
## Troubleshooting
### Common Issues
#### 1. Permission Denied Errors
```bash
# Solution: Run with sudo
sudo bash SetupNewSystem.sh
```
#### 2. Network Connectivity Issues
```bash
# Check DNS resolution
nslookup archive.ubuntu.com
# Test direct IP access
curl -I 91.189.91.26 # Ubuntu archive IP
```
#### 3. Package Installation Failures
```bash
# Update package cache
sudo apt-get update
# Fix broken packages
sudo apt-get -f install
```
#### 4. SSH Key Issues
```bash
# Verify key permissions
ls -la ~/.ssh/
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub
```
### Debug Mode
```bash
# Enable debug logging
export DEBUG=1
bash -x SetupNewSystem.sh
```
### Log Analysis
```bash
# Check deployment logs
tail -f /var/log/fetchapply/deployment.log
# Review system logs
journalctl -u ssh
journalctl -u auditd
```
## Environment-Specific Configurations
### Physical Dell Servers
- **OMSA Installation:** Dell OpenManage Server Administrator
- **Hardware Monitoring:** iDRAC configuration
- **Performance Tuning:** CPU and memory optimizations
### Virtual Machines
- **Guest Additions:** VMware tools or VirtualBox additions
- **Resource Limits:** Memory and CPU constraints
- **Network Configuration:** Bridge vs NAT settings
### Development Environments
- **SSH Configuration:** Less restrictive settings
- **Development Tools:** Additional packages for development
- **Testing Access:** Enhanced logging and debugging
## Maintenance and Updates
### Regular Maintenance
```bash
# Update system packages
sudo apt-get update && sudo apt-get upgrade
# Update monitoring scripts
cd /usr/local/bin
sudo wget https://[repository]/scripts/up2date.sh
sudo chmod +x up2date.sh
```
### Security Updates
```bash
# Check for security updates
sudo apt-get update
sudo apt list --upgradable | grep -i security
# Apply security patches
sudo apt-get upgrade
```
### Configuration Updates
```bash
# Update FetchApply
cd FetchApply
git pull origin main
# Re-run specific modules
cd ProjectCode/Modules/Security
sudo bash secharden-ssh.sh
```
## Best Practices
### 1. Pre-Deployment
- Always test in non-production environment first
- Review all scripts before execution
- Validate network connectivity
- Ensure proper backup procedures
### 2. During Deployment
- Monitor deployment progress
- Check for errors and warnings
- Document any customizations
- Validate each phase completion
### 3. Post-Deployment
- Run full security test suite
- Verify all services are running
- Test remote access
- Document deployment specifics
### 4. Ongoing Operations
- Regular security updates
- Monitor system performance
- Review audit logs
- Maintain deployment documentation
## Support and Resources
### Documentation
- **README.md:** Basic usage instructions
- **SECURITY.md:** Security architecture and guidelines
- **Project-Tests/README.md:** Testing framework documentation
### Community Support
- **Issues:** https://projects.knownelement.com/project/reachableceo-vptechnicaloperations/timeline
- **Discussion:** https://community.turnsys.com/c/chieftechnologyandproductofficer/26
### Professional Support
- **Technical Support:** [Contact information to be added]
- **Consulting Services:** [Contact information to be added]
## Deployment Checklist
### Pre-Deployment
- [ ] System requirements validated
- [ ] Network connectivity tested
- [ ] Backup procedures in place
- [ ] Security review completed
### Deployment
- [ ] Repository cloned successfully
- [ ] Pre-deployment tests passed
- [ ] Deployment executed without errors
- [ ] Post-deployment verification completed
### Post-Deployment
- [ ] Security tests passed
- [ ] All services running
- [ ] Remote access verified
- [ ] Documentation updated
### Maintenance
- [ ] Update schedule established
- [ ] Monitoring configured
- [ ] Backup procedures tested
- [ ] Incident response plan activated
## Version History
- **v1.0:** Initial deployment framework
- **v1.1:** Added security hardening and secrets management
- **v1.2:** Enhanced testing framework and documentation
Last updated: July 14, 2025
archive/KNELServerBuild/ProjectDocs/DEVELOPMENT-GUIDELINES.md
+406
View File
@@ -0,0 +1,406 @@
# TSYS FetchApply Development Guidelines
## Overview
This document contains development standards and best practices for the TSYS FetchApply infrastructure provisioning system.
## Package Management Best Practices
### Combine apt-get Install Commands
**Rule:** Always combine multiple package installations into a single `apt-get install` command for performance.
**Rationale:** Single command execution is significantly faster than multiple separate commands due to:
- Reduced package cache processing
- Single dependency resolution
- Fewer network connections
- Optimized package download ordering
#### ✅ Correct Implementation
```bash
# Install all packages in one command
apt-get install -y package1 package2 package3 package4
# Real example from 2FA script
apt-get install -y libpam-google-authenticator qrencode
```
#### ❌ Incorrect Implementation
```bash
# Don't use separate commands for each package
apt-get install -y package1
apt-get install -y package2
apt-get install -y package3
```
#### Complex Package Installation Pattern
```bash
function install_security_packages() {
print_info "Installing security packages..."
# Update package cache once
apt-get update
# Install all packages in single command
apt-get install -y \
auditd \
fail2ban \
libpam-google-authenticator \
lynis \
rkhunter \
aide \
chkrootkit \
clamav \
clamav-daemon
print_success "Security packages installed successfully"
}
```
## Script Development Standards
### Error Handling
- Always use `set -euo pipefail` at script start
- Implement proper error trapping
- Use framework error handling functions
- Return appropriate exit codes
### Function Structure
```bash
function function_name() {
print_info "Description of what function does..."
# Local variables
local var1="value"
local var2="value"
# Function logic
if [[ condition ]]; then
print_success "Success message"
return 0
else
print_error "Error message"
return 1
fi
}
```
### Framework Integration
- Source framework includes at script start
- Use framework logging and pretty print functions
- Follow existing patterns for consistency
- Include proper PROJECT_ROOT path resolution
```bash
# Standard framework sourcing pattern
PROJECT_ROOT="$(dirname "$(realpath "${BASH_SOURCE[0]}")")/../.."
source "$PROJECT_ROOT/Framework-Includes/PrettyPrint.sh"
source "$PROJECT_ROOT/Framework-Includes/Logging.sh"
source "$PROJECT_ROOT/Framework-Includes/ErrorHandling.sh"
```
## Code Quality Standards
### ShellCheck Compliance
- All scripts must pass shellcheck validation
- Address shellcheck warnings appropriately
- Use proper quoting for variables
- Handle edge cases and error conditions
### Variable Naming
- Use UPPERCASE for global constants
- Use lowercase for local variables
- Use descriptive names
- Quote all variable expansions
```bash
# Global constants
declare -g BACKUP_DIR="/root/backup"
declare -g CONFIG_FILE="/etc/ssh/sshd_config"
# Local variables
local user_name="localuser"
local temp_file="/tmp/config.tmp"
# Proper quoting
if [[ -f "$CONFIG_FILE" ]]; then
cp "$CONFIG_FILE" "$BACKUP_DIR/"
fi
```
### Function Documentation
- Include purpose description
- Document parameters if any
- Document return values
- Include usage examples for complex functions
```bash
# Configure SSH hardening settings
# Parameters: none
# Returns: 0 on success, 1 on failure
# Usage: configure_ssh_hardening
function configure_ssh_hardening() {
print_info "Configuring SSH hardening..."
# Implementation
}
```
## Testing Requirements
### Test Coverage
- Every new module must include corresponding tests
- Test both success and failure scenarios
- Validate configurations after changes
- Include integration tests for complex workflows
### Test Categories
1. **Unit Tests:** Individual function validation
2. **Integration Tests:** Module interaction testing
3. **Security Tests:** Security configuration validation
4. **Validation Tests:** System requirement checking
### Test Implementation Pattern
```bash
function test_function_name() {
echo "🔍 Testing specific functionality..."
local failed=0
# Test implementation
if [[ condition ]]; then
echo "✅ Test passed"
else
echo "❌ Test failed"
((failed++))
fi
return $failed
}
```
## Security Standards
### Configuration Backup
- Always backup configurations before modification
- Use timestamped backup directories
- Provide restore instructions
- Test backup/restore procedures
### Service Management
- Test configurations before restarting services
- Provide rollback procedures
- Validate service status after changes
- Include service dependency handling
### User Safety
- Use `nullok` for gradual 2FA rollout
- Provide clear setup instructions
- Include emergency access procedures
- Test all access methods before enforcement
## Documentation Standards
### Script Headers
```bash
#!/bin/bash
# TSYS Module Name - Brief Description
# Longer description of what this script does
# Author: TSYS Development Team
# Version: 1.0
# Last Updated: YYYY-MM-DD
set -euo pipefail
```
### Inline Documentation
- Comment complex logic
- Explain non-obvious decisions
- Document external dependencies
- Include troubleshooting notes
### User Documentation
- Create comprehensive guides for complex features
- Include step-by-step procedures
- Provide troubleshooting sections
- Include examples and use cases
## Performance Optimization
### Package Management
- Single apt-get commands (as noted above)
- Cache package lists appropriately
- Use specific package versions when stability required
- Clean up package cache when appropriate
### Network Operations
- Use connection timeouts for external requests
- Implement retry logic with backoff
- Cache downloaded resources when possible
- Validate download integrity
### File Operations
- Use efficient file processing tools
- Minimize file system operations
- Use appropriate file permissions
- Clean up temporary files
## Version Control Practices
### Commit Messages
- Use descriptive commit messages
- Include scope of changes
- Reference related issues/requirements
- Follow established commit message format
### Branch Management
- Test changes in feature branches
- Use pull requests for review
- Maintain clean commit history
- Tag releases appropriately
### Code Review Requirements
- All changes require review
- Security changes require security team review
- Test coverage must be maintained
- Documentation must be updated
## Deployment Practices
### Pre-Deployment
- Run full test suite
- Validate in test environment
- Review security implications
- Update documentation
### Deployment Process
- Use configuration validation
- Implement gradual rollout when possible
- Monitor for issues during deployment
- Have rollback procedures ready
### Post-Deployment
- Validate deployment success
- Monitor system performance
- Update operational documentation
- Gather feedback for improvements
## Example Implementation
### Complete Module Template
```bash
#!/bin/bash
# TSYS Security Module - Template
# Template for creating new security modules
# Author: TSYS Development Team
set -euo pipefail
# Source framework functions
PROJECT_ROOT="$(dirname "$(realpath "${BASH_SOURCE[0]}")")/../.."
source "$PROJECT_ROOT/Framework-Includes/PrettyPrint.sh"
source "$PROJECT_ROOT/Framework-Includes/Logging.sh"
source "$PROJECT_ROOT/Framework-Includes/ErrorHandling.sh"
# Module configuration
BACKUP_DIR="/root/backup/module-$(date +%Y%m%d-%H%M%S)"
CONFIG_FILE="/etc/example.conf"
# Create backup directory
mkdir -p "$BACKUP_DIR"
print_header "TSYS Module Template"
function backup_configs() {
print_info "Creating configuration backup..."
if [[ -f "$CONFIG_FILE" ]]; then
cp "$CONFIG_FILE" "$BACKUP_DIR/"
print_success "Configuration backed up"
fi
}
function install_packages() {
print_info "Installing required packages..."
# Update package cache
apt-get update
# Install all packages in single command
apt-get install -y package1 package2 package3
print_success "Packages installed successfully"
}
function configure_module() {
print_info "Configuring module..."
# Configuration logic here
print_success "Module configured successfully"
}
function validate_configuration() {
print_info "Validating configuration..."
local failed=0
# Validation logic here
if [[ $failed -eq 0 ]]; then
print_success "Configuration validation passed"
return 0
else
print_error "Configuration validation failed"
return 1
fi
}
function main() {
# Check if running as root
if [[ $EUID -ne 0 ]]; then
print_error "This script must be run as root"
exit 1
fi
# Execute module steps
backup_configs
install_packages
configure_module
validate_configuration
print_success "Module setup completed successfully!"
}
# Run main function
main "$@"
```
## Continuous Improvement
### Regular Reviews
- Review guidelines quarterly
- Update based on lessons learned
- Incorporate new best practices
- Gather team feedback
### Tool Updates
- Keep development tools current
- Adopt new security practices
- Update testing frameworks
- Improve automation
### Knowledge Sharing
- Document lessons learned
- Share best practices
- Provide training materials
- Maintain knowledge base
---
**Last Updated:** July 14, 2025
**Version:** 1.0
**Author:** TSYS Development Team
**Note:** These guidelines are living documents and should be updated as the project evolves and new best practices are identified.
archive/KNELServerBuild/ProjectDocs/REFACTORING-EXAMPLES.md
+534
View File
@@ -0,0 +1,534 @@
# Code Refactoring Examples
This document provides specific examples of how to apply the code review findings to improve performance, security, and reliability.
## Package Installation Optimization
### Before (Current - Multiple Commands)
```bash
# Line 27 in SetupNewSystem.sh
apt-get -y install git sudo dmidecode curl
# Lines 117-183 (later in script)
DEBIAN_FRONTEND="noninteractive" apt-get -qq --yes -o Dpkg::Options::="--force-confold" install \
virt-what \
auditd \
aide \
# ... many more packages
```
### After (Optimized - Single Command)
```bash
function install_all_packages() {
print_info "Installing all required packages..."
# All packages in logical groups for better readability
local packages=(
# Core system tools
git sudo dmidecode curl wget net-tools htop
# Security and auditing
auditd aide fail2ban lynis rkhunter
# Monitoring and SNMP
snmpd snmp-mibs-downloader libsnmp-dev
# Virtualization detection
virt-what
# System utilities
rsyslog logrotate ntp ntpdate
cockpit cockpit-ws cockpit-system
# Development and debugging
build-essential dkms
# Network services
openssh-server ufw
)
# Single package installation command with retry logic
local max_attempts=3
local attempt=1
while [[ $attempt -le $max_attempts ]]; do
if DEBIAN_FRONTEND="noninteractive" apt-get -qq --yes -o Dpkg::Options::="--force-confold" install "${packages[@]}"; then
print_success "All packages installed successfully"
return 0
else
print_warning "Package installation attempt $attempt failed"
if [[ $attempt -lt $max_attempts ]]; then
print_info "Retrying in 10 seconds..."
sleep 10
apt-get update # Refresh package cache before retry
fi
((attempt++))
fi
done
print_error "Package installation failed after $max_attempts attempts"
return 1
}
```
## Safe Download Implementation
### Before (Current - Unsafe Downloads)
```bash
# Lines 61-63 in SetupNewSystem.sh
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ZSH/tsys-zshrc >/etc/zshrc
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/SMTP/aliases >/etc/aliases
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/Syslog/rsyslog.conf >/etc/rsyslog.conf
```
### After (Safe Downloads with Error Handling)
```bash
function download_system_configs() {
print_info "Downloading system configuration files..."
# Source the safe download framework
source "$PROJECT_ROOT/Framework-Includes/SafeDownload.sh"
# Define configuration downloads with checksums (optional)
declare -A config_downloads=(
["${DL_ROOT}/ProjectCode/ConfigFiles/ZSH/tsys-zshrc"]="/etc/zshrc"
["${DL_ROOT}/ProjectCode/ConfigFiles/SMTP/aliases"]="/etc/aliases"
["${DL_ROOT}/ProjectCode/ConfigFiles/Syslog/rsyslog.conf"]="/etc/rsyslog.conf"
["${DL_ROOT}/ProjectCode/ConfigFiles/SSH/Configs/tsys-sshd-config"]="/etc/ssh/sshd_config.tsys"
)
# Validate all URLs are accessible before starting
local urls=()
for url in "${!config_downloads[@]}"; do
urls+=("$url")
done
if ! validate_required_urls "${urls[@]}"; then
print_error "Some configuration URLs are not accessible"
return 1
fi
# Perform batch download with backup
local failed_downloads=0
for url in "${!config_downloads[@]}"; do
local dest="${config_downloads[$url]}"
if ! safe_config_download "$url" "$dest"; then
((failed_downloads++))
fi
done
if [[ $failed_downloads -eq 0 ]]; then
print_success "All configuration files downloaded successfully"
return 0
else
print_error "$failed_downloads configuration downloads failed"
return 1
fi
}
```
## Variable Quoting Fixes
### Before (Unsafe Variable Usage)
```bash
# Line 244 in SetupNewSystem.sh
chsh -s $(which zsh) root
# Multiple instances throughout codebase
if [ -f $CONFIG_FILE ]; then
cp $CONFIG_FILE $BACKUP_DIR
fi
```
### After (Proper Variable Quoting)
```bash
# Safe variable usage with proper quoting
chsh -s "$(which zsh)" root
# Consistent quoting pattern
if [[ -f "$CONFIG_FILE" ]]; then
cp "$CONFIG_FILE" "$BACKUP_DIR/"
fi
# Function parameter handling
function configure_service() {
local service_name="$1"
local config_file="$2"
if [[ -z "$service_name" || -z "$config_file" ]]; then
print_error "configure_service: service name and config file required"
return 1
fi
print_info "Configuring service: $service_name"
# Safe operations with quoted variables
}
```
## Service Management with Error Handling
### Before (Basic Service Operations)
```bash
# Current pattern in various modules
systemctl restart snmpd
systemctl enable snmpd
```
### After (Robust Service Management)
```bash
function safe_service_restart() {
local service="$1"
local config_test_cmd="${2:-}"
if [[ -z "$service" ]]; then
print_error "safe_service_restart: service name required"
return 1
fi
print_info "Managing service: $service"
# Test configuration if test command provided
if [[ -n "$config_test_cmd" ]]; then
print_info "Testing $service configuration..."
if ! eval "$config_test_cmd"; then
print_error "$service configuration test failed"
return 1
fi
print_success "$service configuration test passed"
fi
# Check if service exists
if ! systemctl list-unit-files "$service.service" >/dev/null 2>&1; then
print_error "Service $service does not exist"
return 1
fi
# Stop service if running
if systemctl is-active "$service" >/dev/null 2>&1; then
print_info "Stopping $service..."
if ! systemctl stop "$service"; then
print_error "Failed to stop $service"
return 1
fi
fi
# Start and enable service
print_info "Starting and enabling $service..."
if systemctl start "$service" && systemctl enable "$service"; then
print_success "$service started and enabled successfully"
# Verify service is running
sleep 2
if systemctl is-active "$service" >/dev/null 2>&1; then
print_success "$service is running properly"
return 0
else
print_error "$service failed to start properly"
return 1
fi
else
print_error "Failed to start or enable $service"
return 1
fi
}
# Usage examples
safe_service_restart "sshd" "sshd -t"
safe_service_restart "snmpd"
safe_service_restart "rsyslog"
```
## Batch Configuration Deployment
### Before (Individual File Operations)
```bash
# Lines 66-77 in secharden-scap-stig.sh
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/usb_storage.conf > /etc/modprobe.d/usb_storage.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/dccp.conf > /etc/modprobe.d/dccp.conf
curl --silent ${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/rds.conf > /etc/modprobe.d/rds.conf
# ... 12 more individual downloads
```
### After (Batch Operations with Error Handling)
```bash
function deploy_modprobe_configs() {
print_info "Deploying modprobe security configurations..."
source "$PROJECT_ROOT/Framework-Includes/SafeDownload.sh"
local modprobe_configs=(
"usb_storage" "dccp" "rds" "sctp" "tipc"
"cramfs" "freevxfs" "hfs" "hfsplus"
"jffs2" "squashfs" "udf"
)
# Create download map
declare -A config_downloads=()
for config in "${modprobe_configs[@]}"; do
local url="${DL_ROOT}/ProjectCode/ConfigFiles/ModProbe/${config}.conf"
local dest="/etc/modprobe.d/${config}.conf"
config_downloads["$url"]="$dest"
done
# Validate URLs first
local urls=()
for url in "${!config_downloads[@]}"; do
urls+=("$url")
done
if ! validate_required_urls "${urls[@]}"; then
print_error "Some modprobe configuration URLs are not accessible"
return 1
fi
# Perform batch download
if batch_download config_downloads; then
print_success "All modprobe configurations deployed"
# Update initramfs to apply changes
if update-initramfs -u; then
print_success "Initramfs updated with new module configurations"
else
print_warning "Failed to update initramfs - reboot may be required"
fi
return 0
else
print_error "Failed to deploy some modprobe configurations"
return 1
fi
}
```
## Input Validation and Error Handling
### Before (Minimal Validation)
```bash
# pi-detect.sh current implementation
function pi-detect() {
print_info Now running "$FUNCNAME"....
if [ -f /sys/firmware/devicetree/base/model ] ; then
export IS_RASPI="1"
fi
}
```
### After (Comprehensive Validation)
```bash
function pi-detect() {
print_info "Now running $FUNCNAME..."
# Initialize variables with default values
export IS_RASPI="0"
export PI_MODEL=""
export PI_REVISION=""
# Check for Raspberry Pi detection file
local device_tree_model="/sys/firmware/devicetree/base/model"
local cpuinfo_file="/proc/cpuinfo"
if [[ -f "$device_tree_model" ]]; then
# Try device tree method first (most reliable)
local model_info
model_info=$(tr -d '\0' < "$device_tree_model" 2>/dev/null)
if [[ "$model_info" =~ [Rr]aspberry.*[Pp]i ]]; then
export IS_RASPI="1"
export PI_MODEL="$model_info"
print_success "Raspberry Pi detected via device tree: $PI_MODEL"
fi
elif [[ -f "$cpuinfo_file" ]]; then
# Fallback to cpuinfo method
if grep -qi "raspberry" "$cpuinfo_file"; then
export IS_RASPI="1"
PI_MODEL=$(grep "^Model" "$cpuinfo_file" | cut -d: -f2 | sed 's/^[[:space:]]*//' 2>/dev/null || echo "Unknown Pi Model")
PI_REVISION=$(grep "^Revision" "$cpuinfo_file" | cut -d: -f2 | sed 's/^[[:space:]]*//' 2>/dev/null || echo "Unknown")
export PI_MODEL
export PI_REVISION
print_success "Raspberry Pi detected via cpuinfo: $PI_MODEL (Rev: $PI_REVISION)"
fi
fi
if [[ "$IS_RASPI" == "1" ]]; then
print_info "Raspberry Pi specific optimizations will be applied"
else
print_info "Standard x86/x64 system detected"
fi
return 0
}
```
## Function Framework Integration
### Before (Inconsistent Framework Usage)
```bash
# Mixed patterns throughout codebase
function some_function() {
echo "Doing something..."
command_that_might_fail
echo "Done"
}
```
### After (Standardized Framework Integration)
```bash
function some_function() {
print_info "Now running $FUNCNAME..."
# Local variables
local config_file="/etc/example.conf"
local backup_dir="/root/backup"
local failed=0
# Validate prerequisites
if [[ ! -d "$backup_dir" ]]; then
if ! mkdir -p "$backup_dir"; then
print_error "Failed to create backup directory: $backup_dir"
return 1
fi
fi
# Backup existing configuration
if [[ -f "$config_file" ]]; then
if cp "$config_file" "$backup_dir/$(basename "$config_file").bak.$(date +%Y%m%d-%H%M%S)"; then
print_info "Backed up existing configuration"
else
print_error "Failed to backup existing configuration"
return 1
fi
fi
# Perform main operation with error handling
if command_that_might_fail; then
print_success "Operation completed successfully"
else
print_error "Operation failed"
return 1
fi
print_success "Completed $FUNCNAME"
return 0
}
```
## Performance Monitoring Integration
### Enhanced Deployment with Metrics
```bash
function deploy_with_metrics() {
local start_time end_time duration
local operation_name="$1"
shift
local operation_function="$1"
shift
print_info "Starting $operation_name..."
start_time=$(date +%s)
# Execute the operation
if "$operation_function" "$@"; then
end_time=$(date +%s)
duration=$((end_time - start_time))
print_success "$operation_name completed in ${duration}s"
# Log performance metrics
echo "$(date '+%Y-%m-%d %H:%M:%S') - $operation_name: ${duration}s" >> /var/log/fetchapply-performance.log
# Alert if operation took too long
case "$operation_name" in
"Package Installation")
if [[ $duration -gt 300 ]]; then
print_warning "Package installation took longer than expected (${duration}s > 300s)"
fi
;;
"Configuration Download")
if [[ $duration -gt 120 ]]; then
print_warning "Configuration download took longer than expected (${duration}s > 120s)"
fi
;;
esac
return 0
else
end_time=$(date +%s)
duration=$((end_time - start_time))
print_error "$operation_name failed after ${duration}s"
echo "$(date '+%Y-%m-%d %H:%M:%S') - $operation_name: FAILED after ${duration}s" >> /var/log/fetchapply-performance.log
return 1
fi
}
# Usage example
deploy_with_metrics "Package Installation" install_all_packages
deploy_with_metrics "Configuration Download" download_system_configs
deploy_with_metrics "SSH Hardening" configure_ssh_hardening
```
## Testing Integration
### Comprehensive Validation Function
```bash
function validate_deployment() {
print_header "Deployment Validation"
local validation_failures=0
# Test package installation
local required_packages=("git" "curl" "wget" "snmpd" "auditd" "fail2ban")
for package in "${required_packages[@]}"; do
if dpkg -l | grep -q "^ii.*$package"; then
print_success "Package installed: $package"
else
print_error "Package missing: $package"
((validation_failures++))
fi
done
# Test service status
local required_services=("sshd" "snmpd" "auditd" "rsyslog")
for service in "${required_services[@]}"; do
if systemctl is-active "$service" >/dev/null 2>&1; then
print_success "Service running: $service"
else
print_error "Service not running: $service"
((validation_failures++))
fi
done
# Test configuration files
local required_configs=("/etc/ssh/sshd_config" "/etc/snmp/snmpd.conf" "/etc/rsyslog.conf")
for config in "${required_configs[@]}"; do
if [[ -f "$config" && -s "$config" ]]; then
print_success "Configuration exists: $(basename "$config")"
else
print_error "Configuration missing or empty: $(basename "$config")"
((validation_failures++))
fi
done
# Run security tests
if command -v lynis >/dev/null 2>&1; then
print_info "Running basic security audit..."
if lynis audit system --quick --quiet; then
print_success "Security audit completed"
else
print_warning "Security audit found issues"
fi
fi
# Summary
if [[ $validation_failures -eq 0 ]]; then
print_success "All deployment validation checks passed"
return 0
else
print_error "$validation_failures deployment validation checks failed"
return 1
fi
}
```
These refactoring examples demonstrate how to apply the code review findings to create more robust, performant, and maintainable infrastructure provisioning scripts.
archive/KNELServerBuild/ProjectDocs/SECURITY.md
+190
View File
@@ -0,0 +1,190 @@
# TSYS FetchApply Security Documentation
## Security Architecture
The TSYS FetchApply infrastructure provisioning system is designed with security-first principles, implementing multiple layers of protection for server deployment and management.
## Current Security Features
### 1. Secure Deployment Method ✅
- **Git-based deployment:** Uses `git clone` instead of `curl | bash`
- **Local execution:** Scripts run locally after inspection
- **Version control:** Full audit trail of changes
- **Code review:** Changes require explicit approval
### 2. HTTPS Enforcement ✅
- **All downloads use HTTPS:** Eliminates man-in-the-middle attacks
- **SSL certificate validation:** Automatic certificate checking
- **Secure repositories:** Ubuntu archive, Dell, Proxmox all use HTTPS
- **No HTTP fallbacks:** No insecure download methods
### 3. SSH Hardening
- **Key-only authentication:** Password login disabled
- **Secure ciphers:** Modern encryption algorithms only
- **Fail2ban protection:** Automated intrusion prevention
- **Custom SSH configuration:** Hardened sshd_config
### 4. System Security
- **Firewall configuration:** Automated iptables rules
- **Audit logging:** auditd with custom rules
- **SIEM integration:** Wazuh agent deployment
- **Compliance scanning:** SCAP-STIG automated checks
### 5. Error Handling
- **Bash strict mode:** `set -euo pipefail` prevents errors
- **Centralized logging:** All operations logged with timestamps
- **Graceful failures:** Proper cleanup on errors
- **Line-level debugging:** Error reporting with line numbers
## Security Testing
### Automated Security Validation
```bash
# Run security test suite
./Project-Tests/run-tests.sh security
# Specific security tests
./Project-Tests/security/https-enforcement.sh
```
### Security Test Categories
1. **HTTPS Enforcement:** Validates all URLs use HTTPS
2. **Deployment Security:** Checks for secure deployment methods
3. **SSL Certificate Validation:** Tests certificate authenticity
4. **Permission Validation:** Verifies proper file permissions
## Threat Model
### Mitigated Threats
- **Supply Chain Attacks:** Git-based deployment with review
- **Man-in-the-Middle:** HTTPS-only downloads
- **Privilege Escalation:** Proper permission models
- **Unauthorized Access:** SSH hardening and key management
### Remaining Risks
- **Secrets in Repository:** SSH keys stored in git (planned for removal)
- **No Integrity Verification:** Downloads lack checksum validation
- **No Backup/Recovery:** No rollback capability implemented
## Security Recommendations
### High Priority
1. **Implement Secrets Management**
- Remove SSH keys from repository
- Use Bitwarden/Vault for secret storage
- Implement key rotation procedures
2. **Add Download Integrity Verification**
- SHA256 checksum validation for all downloads
- GPG signature verification where available
- Fail-safe on integrity check failures
3. **Enhance Audit Logging**
- Centralized log collection
- Real-time security monitoring
- Automated threat detection
### Medium Priority
1. **Configuration Backup**
- System state snapshots before changes
- Rollback capability for failed deployments
- Configuration drift detection
2. **Network Security**
- VPN-based deployment (where applicable)
- Network segmentation for management
- Encrypted communication channels
## Compliance
### Security Standards
- **CIS Benchmarks:** Automated compliance checking
- **STIG Guidelines:** SCAP-based validation
- **Industry Best Practices:** Following NIST cybersecurity framework
### Audit Requirements
- **Change Tracking:** All modifications logged
- **Access Control:** Permission-based system access
- **Vulnerability Management:** Regular security assessments
## Incident Response
### Security Event Handling
1. **Detection:** Automated monitoring and alerting
2. **Containment:** Immediate isolation procedures
3. **Investigation:** Log analysis and forensics
4. **Recovery:** System restoration procedures
5. **Lessons Learned:** Process improvement
### Contact Information
- **Security Team:** [To be defined]
- **Incident Response:** [To be defined]
- **Escalation Path:** [To be defined]
## Security Development Lifecycle
### Code Review Process
1. **Static Analysis:** Automated security scanning
2. **Peer Review:** Manual code inspection
3. **Security Testing:** Automated security test suite
4. **Approval:** Security team sign-off
### Deployment Security
1. **Pre-deployment Validation:** Security test execution
2. **Secure Deployment:** Authorized personnel only
3. **Post-deployment Verification:** Security configuration validation
4. **Monitoring:** Continuous security monitoring
## Security Tools and Integrations
### Current Tools
- **Wazuh:** SIEM and security monitoring
- **Lynis:** Security auditing
- **auditd:** System call auditing
- **Fail2ban:** Intrusion prevention
### Planned Integrations
- **Vault/Bitwarden:** Secrets management
- **OSSEC:** Host-based intrusion detection
- **Nessus/OpenVAS:** Vulnerability scanning
- **ELK Stack:** Log aggregation and analysis
## Vulnerability Management
### Vulnerability Scanning
- **Regular scans:** Monthly vulnerability assessments
- **Automated patching:** Security update automation
- **Exception handling:** Risk-based patch management
- **Reporting:** Executive security dashboards
### Disclosure Process
1. **Internal Discovery:** Report to security team
2. **Assessment:** Risk and impact evaluation
3. **Remediation:** Patch development and testing
4. **Deployment:** Coordinated security updates
5. **Verification:** Post-patch validation
## Security Metrics
### Key Performance Indicators
- **Deployment Success Rate:** Percentage of successful secure deployments
- **Vulnerability Response Time:** Time to patch critical vulnerabilities
- **Security Test Coverage:** Percentage of code covered by security tests
- **Incident Response Time:** Time to detect and respond to security events
### Monitoring and Reporting
- **Real-time Dashboards:** Security status monitoring
- **Executive Reports:** Monthly security summaries
- **Compliance Reports:** Quarterly compliance assessments
- **Trend Analysis:** Security posture improvement tracking
## Contact and Support
For security-related questions or incidents:
- **Repository Issues:** https://projects.knownelement.com/project/reachableceo-vptechnicaloperations/timeline
- **Community Discussion:** https://community.turnsys.com/c/chieftechnologyandproductofficer/26
- **Security Team:** [Contact information to be added]
## Security Updates
This document is updated as security features are implemented and threats evolve. Last updated: July 14, 2025.
archive/KNELServerBuild/ProjectDocs/TSYS-2FA-GUIDE.md
+329
View File
@@ -0,0 +1,329 @@
# TSYS Two-Factor Authentication Implementation Guide
## Overview
This guide provides complete instructions for implementing and managing two-factor authentication (2FA) on TSYS servers using Google Authenticator (TOTP).
## What This Implementation Provides
### Services Protected by 2FA
- **SSH Access:** Requires SSH key + 2FA token
- **Cockpit Web Interface:** Requires password + 2FA token
- **Webmin Administration:** Requires password + 2FA token (if installed)
### Security Features
- **Time-based One-Time Passwords (TOTP):** Standard 6-digit codes
- **Backup Codes:** Emergency access codes
- **Gradual Rollout:** Optional nullok mode for phased deployment
- **Configuration Backup:** Automatic backup of all configs
## Implementation Steps
### Step 1: Run the 2FA Setup Script
```bash
# Navigate to the security modules directory
cd ProjectCode/Modules/Security
# Run the 2FA setup script as root
sudo bash secharden-2fa.sh
```
### Step 2: Validate Installation
```bash
# Run 2FA validation tests
./Project-Tests/security/2fa-validation.sh
# Run specific 2FA security test
./Project-Tests/run-tests.sh security
```
### Step 3: Setup Individual Users
For each user that needs 2FA access:
```bash
# Check setup instructions
cat /home/username/2fa-setup-instructions.txt
# Run user setup script
sudo /tmp/setup-2fa-username.sh
```
### Step 4: Test 2FA Access
1. **Test SSH access** from another terminal
2. **Test Cockpit access** via web browser
3. **Test Webmin access** if installed
## User Setup Process
### Installing Authenticator Apps
Users need one of these apps on their phone:
- **Google Authenticator** (Android/iOS)
- **Authy** (Android/iOS)
- **Microsoft Authenticator** (Android/iOS)
- **1Password** (with TOTP support)
### Setting Up 2FA for a User
1. **Run setup script:**
```bash
sudo /tmp/setup-2fa-username.sh
```
2. **Follow prompts:**
- Answer "y" to update time-based token
- Scan QR code with authenticator app
- Save emergency backup codes securely
- Answer "y" to remaining security questions
3. **Test immediately:**
```bash
# Test SSH from another terminal
ssh username@server-ip
# You'll be prompted for 6-digit code
```
## Configuration Details
### SSH Configuration Changes
File: `/etc/ssh/sshd_config`
```
ChallengeResponseAuthentication yes
UsePAM yes
AuthenticationMethods publickey,keyboard-interactive
```
### PAM Configuration
File: `/etc/pam.d/sshd`
```
auth required pam_google_authenticator.so nullok
```
### Cockpit Configuration
File: `/etc/cockpit/cockpit.conf`
```
[WebService]
LoginTitle = TSYS Server Management
LoginTo = 300
RequireHost = true
[Session]
Banner = /etc/cockpit/issue.cockpit
IdleTimeout = 15
```
### Webmin Configuration
File: `/etc/webmin/miniserv.conf`
```
twofactor_provider=totp
twofactor=1
```
## Security Considerations
### Gradual vs Strict Enforcement
#### Gradual Enforcement (Default)
- Uses `nullok` option in PAM
- Users without 2FA can still log in
- Allows phased rollout
- Good for initial deployment
#### Strict Enforcement
- Remove `nullok` from PAM configuration
- All users must have 2FA configured
- Immediate security enforcement
- Risk of lockout if misconfigured
### Backup and Recovery
#### Emergency Access
- **Backup codes:** Generated during setup
- **Root access:** Can disable 2FA if needed
- **Console access:** Physical/virtual console bypasses SSH
#### Configuration Backup
- Automatic backup to `/root/backup/2fa-TIMESTAMP/`
- Includes all modified configuration files
- Can be restored if needed
## Troubleshooting
### Common Issues
#### 1. User Cannot Generate QR Code
```bash
# Ensure qrencode is installed
sudo apt-get install qrencode
# Re-run user setup
sudo /tmp/setup-2fa-username.sh
```
#### 2. SSH Connection Fails
```bash
# Check SSH service status
sudo systemctl status sshd
# Test SSH configuration
sudo sshd -t
# Check logs
sudo journalctl -u sshd -f
```
#### 3. 2FA Code Not Accepted
- **Check time synchronization** on server and phone
- **Verify app setup** - rescan QR code if needed
- **Try backup codes** if available
#### 4. Locked Out of Server
```bash
# Access via console (physical/virtual)
# Disable 2FA temporarily
sudo cp /root/backup/2fa-*/pam.d.bak/sshd /etc/pam.d/sshd
sudo systemctl restart sshd
```
### Debug Commands
```bash
# Check 2FA status
./Project-Tests/security/2fa-validation.sh
# Check SSH configuration
sudo sshd -T | grep -E "(Challenge|PAM|Authentication)"
# Check PAM configuration
cat /etc/pam.d/sshd | grep google-authenticator
# Check user 2FA status
ls -la ~/.google_authenticator
```
## Management and Maintenance
### Adding New Users
1. Ensure user account exists
2. Run setup script for new user
3. Provide setup instructions
4. Test access
### Removing User 2FA
```bash
# Remove user's 2FA configuration
sudo rm /home/username/.google_authenticator
# User will need to re-setup 2FA
```
### Disabling 2FA System-Wide
```bash
# Restore original configurations
sudo cp /root/backup/2fa-*/sshd_config.bak /etc/ssh/sshd_config
sudo cp /root/backup/2fa-*/pam.d.bak/sshd /etc/pam.d/sshd
sudo systemctl restart sshd
```
### Updating 2FA Configuration
```bash
# Re-run setup script
sudo bash secharden-2fa.sh
# Validate changes
./Project-Tests/security/2fa-validation.sh
```
## Best Practices
### Deployment Strategy
1. **Test in non-production** environment first
2. **Enable gradual rollout** (nullok) initially
3. **Train users** on 2FA setup process
4. **Test emergency procedures** before strict enforcement
5. **Monitor logs** for authentication issues
### Security Recommendations
- **Enforce strict mode** after successful rollout
- **Regular backup code rotation**
- **Monitor failed authentication attempts**
- **Document emergency procedures**
- **Regular security audits**
### User Training
- **Provide clear instructions**
- **Demonstrate setup process**
- **Explain backup code importance**
- **Test login process with users**
- **Establish support procedures**
## Monitoring and Logging
### Authentication Logs
```bash
# SSH authentication logs
sudo journalctl -u sshd | grep -i "authentication"
# PAM authentication logs
sudo journalctl | grep -i "pam_google_authenticator"
# Failed login attempts
sudo journalctl | grep -i "failed"
```
### Security Monitoring
- Monitor for repeated failed 2FA attempts
- Alert on successful logins without 2FA (during gradual rollout)
- Track user 2FA setup completion
- Monitor for emergency access usage
## Integration with Existing Systems
### LDAP/Active Directory
- 2FA works with existing authentication systems
- Users still need local 2FA setup
- Consider centralized 2FA solutions for large deployments
### Monitoring Systems
- LibreNMS: Will continue to work with SNMP
- Wazuh: Will log 2FA authentication events
- Cockpit: Enhanced with 2FA protection
### Backup Systems
- Ensure backup procedures account for 2FA
- Test restore procedures with 2FA enabled
- Document emergency access procedures
## Support and Resources
### Files Created by Setup
- `/tmp/setup-2fa-*.sh` - User setup scripts
- `/home/*/2fa-setup-instructions.txt` - User instructions
- `/root/backup/2fa-*/` - Configuration backups
### Validation Tools
- `./Project-Tests/security/2fa-validation.sh` - Complete 2FA validation
- `./Project-Tests/run-tests.sh security` - Security test suite
### Emergency Contacts
- System Administrator: [Contact Info]
- Security Team: [Contact Info]
- 24/7 Support: [Contact Info]
## Compliance and Audit
### Security Benefits
- Significantly reduces risk of unauthorized access
- Meets multi-factor authentication requirements
- Provides audit trail of authentication events
- Complies with security frameworks (NIST, ISO 27001)
### Audit Trail
- All authentication attempts logged
- 2FA setup events recorded
- Configuration changes tracked
- Emergency access documented
---
**Last Updated:** July 14, 2025
**Version:** 1.0
**Author:** TSYS Security Team
archive/KNELServerBuild/ProjectDocs/charles-todo.md
+117
View File
@@ -0,0 +1,117 @@
# Charles TODO - TSYS FetchApply Security Improvements
**Priority Order:** High → Medium → Low
**Target:** Address security vulnerabilities and operational improvements
## 🚨 HIGH PRIORITY (Security Critical)
### ✅ 1. Replace Insecure Deployment Method - RESOLVED
**Previous Issue:** `curl https://dl.knownelement.com/KNEL/FetchApply/SetupNewSystem.sh | bash`
**Status:** Fixed in README.md - now uses secure git clone approach
**Current Method:** `git clone this repo` → `cd FetchApply/ProjectCode` → `bash SetupNewSystem.sh`
**Remaining considerations:**
- Consider implementing GPG signature verification for tagged releases
- Add cryptographic checksums for external downloads within scripts
### ✅ 2. Enforce HTTPS for All Downloads - RESOLVED
**Previous Issue:** HTTP URLs in Dell OMSA and some repository setups
**Status:** All HTTP URLs converted to HTTPS across:
- `ProjectCode/Dell/Server/omsa.sh` - Ubuntu archive and Dell repo URLs
- `ProjectCode/legacy/prox7.sh` - Proxmox download URLs
- `ProjectCode/Modules/RandD/sslStackFromSource.sh` - Apache source URLs
**Remaining considerations:**
- SSL certificate validation is enabled by default in wget/curl
- Consider adding retry logic for certificate failures
### 3. Implement Secrets Management
**Current Issue:** SSH keys committed to repository, no secrets rotation
**Action Required:**
- Deploy Bitwarden CLI or HashiCorp Vault integration
- Remove SSH public keys from repository
- Create secure key distribution mechanism
- Implement key rotation procedures
- Add environment variable support for sensitive data
**Files to secure:**
- `ProjectCode/ConfigFiles/SSH/AuthorizedKeys/` (entire directory)
- Hard-coded hostnames in various scripts
## 🔶 MEDIUM PRIORITY (Operational Security)
### 4. Add Script Integrity Verification
**Action Required:**
- Generate SHA256 checksums for all scripts
- Create checksum verification function in Framework-Includes
- Add signature verification for external downloads
- Implement rollback capability on verification failure
### 5. Enhanced Error Recovery
**Action Required:**
- Add state tracking for partial deployments
- Implement resume functionality for interrupted installations
- Create system restoration points before major changes
- Add dependency checking before module execution
### 6. Security Testing Framework
**Action Required:**
- Create integration tests for security configurations
- Add compliance validation (CIS benchmarks, STIG)
- Implement automated security scanning post-deployment
- Create test environments for validation
### 7. Configuration Validation
**Action Required:**
- Add pre-flight checks for system compatibility
- Validate network connectivity to required services
- Check for conflicting software before installation
- Verify sufficient disk space and system resources
## 🔹 LOW PRIORITY (Quality Improvements)
### 8. Documentation Enhancement
**Action Required:**
- Create detailed security architecture documentation
- Add troubleshooting guides for common issues
- Document security implications of each module
- Create deployment runbooks for different environments
### 9. Monitoring and Alerting
**Action Required:**
- Add deployment success/failure reporting
- Implement centralized logging for all installations
- Create dashboards for deployment status
- Add alerting for security configuration drift
### 10. User Experience Improvements
**Action Required:**
- Create web-based deployment interface
- Add progress indicators for long-running operations
- Implement dry-run mode for testing configurations
- Add interactive configuration selection
## Implementation Timeline
**✅ COMPLETED:** Item 1 (Secure deployment method)
**✅ COMPLETED:** Item 2 (HTTPS enforcement)
**Week 1:** Item 3 (Secrets management)
**Week 2-3:** Items 4-5 (Operational improvements)
**Month 2:** Items 6-10 (Quality and monitoring)
## Success Criteria
- [ ] No plaintext secrets in repository
- [x] All downloads use HTTPS with verification ✅
- [x] Deployment method is cryptographically secure ✅
- [ ] Automated testing validates security configurations
- [ ] Rollback capability exists for all changes
- [ ] Comprehensive documentation covers security implications
## Resources Needed
- Access to package repository for signed distributions
- GPG key infrastructure for signing
- Secrets management service (Vault/Bitwarden)
- Test environment infrastructure
- Security scanning tools integration
archive/KNELServerBuild/ProjectDocs/claude-todo.md
+162
View File
@@ -0,0 +1,162 @@
# Claude TODO - TSYS FetchApply Automation Tasks
**Purpose:** Actionable items optimized for AI assistant implementation
**Priority:** Critical → High → Medium → Low
## 🚨 CRITICAL (Immediate Security Fixes)
### ✅ RESOLVED: Secure Deployment Method
**Previous Issue:** `curl | bash` deployment method
**Status:** Fixed in README.md - now uses `git clone` + local script execution
### ✅ RESOLVED: Replace HTTP URLs with HTTPS
**Files modified:**
- `ProjectCode/Dell/Server/omsa.sh` - Converted 11 HTTP URLs to HTTPS (Ubuntu archive, Dell repo)
- `ProjectCode/legacy/prox7.sh` - Converted 2 HTTP URLs to HTTPS (Proxmox downloads)
- `ProjectCode/Modules/RandD/sslStackFromSource.sh` - Converted 3 HTTP URLs to HTTPS (Apache sources)
**Status:** All HTTP URLs in active scripts converted to HTTPS. Only remaining HTTP references are in comments and LibreNMS agent files (external dependencies).
### TASK-002: Add Download Integrity Verification
**Create new function in:** `Framework-Includes/VerifyDownload.sh`
**Function to implement:**
```bash
function verify_download() {
local url="$1"
local expected_hash="$2"
local output_file="$3"
curl -fsSL "$url" -o "$output_file"
local actual_hash=$(sha256sum "$output_file" | cut -d' ' -f1)
if [ "$actual_hash" != "$expected_hash" ]; then
print_error "Hash verification failed for $output_file"
rm -f "$output_file"
return 1
fi
print_info "Download verified: $output_file"
}
```
### TASK-003: Create Secure Deployment Script
**Create:** `ProjectCode/SecureSetupNewSystem.sh`
**Features to implement:**
- GPG signature verification
- SHA256 checksum validation
- HTTPS-only downloads
- Rollback capability
## 🔶 HIGH (Security Enhancements)
### TASK-004: Remove Hardcoded SSH Keys
**Files to modify:**
- `ProjectCode/ConfigFiles/SSH/AuthorizedKeys/root-ssh-authorized-keys`
- `ProjectCode/ConfigFiles/SSH/AuthorizedKeys/localuser-ssh-authorized-keys`
- `ProjectCode/Modules/Security/secharden-ssh.sh:31,40,51`
**Implementation approach:**
1. Create environment variable support: `SSH_KEYS_URL` or `SSH_KEYS_VAULT_PATH`
2. Modify secharden-ssh.sh to fetch keys from secure source
3. Add key validation before deployment
### TASK-005: Add Secrets Management Framework
**Create:** `Framework-Includes/SecretsManager.sh`
**Functions to implement:**
```bash
function get_secret() { } # Retrieve secret from vault
function validate_secret() { } # Validate secret format
function rotate_secret() { } # Trigger secret rotation
```
### TASK-006: Enhanced Preflight Checks
**Modify:** `Framework-Includes/PreflightCheck.sh`
**Add checks for:**
- Network connectivity to required hosts
- Disk space requirements
- Existing conflicting software
- Required system capabilities
## 🔹 MEDIUM (Operational Improvements)
### TASK-007: Add Configuration Backup
**Create:** `Framework-Includes/ConfigBackup.sh`
**Functions:**
```bash
function backup_config() { } # Create timestamped backup
function restore_config() { } # Restore from backup
function list_backups() { } # Show available backups
```
### TASK-008: Implement State Tracking
**Create:** `Framework-Includes/StateManager.sh`
**Track:**
- Deployment progress
- Module completion status
- Rollback points
- System changes made
### TASK-009: Add Retry Logic
**Enhance existing scripts with:**
- Configurable retry attempts for network operations
- Exponential backoff for failed operations
- Circuit breaker for repeatedly failing services
## 🔸 LOW (Quality of Life)
### TASK-010: Enhanced Logging
**Modify:** `Framework-Includes/Logging.sh`
**Add:**
- Structured logging (JSON format option)
- Log levels (DEBUG, INFO, WARN, ERROR)
- Remote logging capability
- Log rotation management
### TASK-011: Progress Indicators
**Add to:** `Framework-Includes/PrettyPrint.sh`
```bash
function show_progress() { } # Display progress bar
function update_status() { } # Update current operation
```
### TASK-012: Dry Run Mode
**Add to:** `ProjectCode/SetupNewSystem.sh`
**Implementation:**
- `--dry-run` flag support
- Preview of changes without execution
- Dependency analysis output
## Implementation Order for Claude
**Updated Priority After Security Fix (July 14, 2025):**
1. **Start with TASK-001** (HTTPS enforcement - simple find/replace operations)
2. **Create framework functions** (TASK-002, TASK-005, TASK-007)
3. **Enhance existing modules** (TASK-004, TASK-006)
4. **Add operational features** (TASK-008, TASK-009)
5. **Improve user experience** (TASK-010, TASK-011, TASK-012)
**Note:** Major deployment security risk resolved - remaining tasks focus on hardening internal operations.
## File Location Patterns
- **Framework components:** `Framework-Includes/*.sh`
- **Security modules:** `ProjectCode/Modules/Security/*.sh`
- **Configuration files:** `ProjectCode/ConfigFiles/*/`
- **Main entry point:** `ProjectCode/SetupNewSystem.sh`
## Testing Strategy
For each task:
1. Create backup of original files
2. Implement changes incrementally
3. Test with `bash -n` for syntax validation
4. Verify functionality with controlled test runs
5. Document changes made
## Error Handling Requirements
All new functions must:
- Use `set -euo pipefail` compatibility
- Integrate with existing error handling framework
- Log errors to `$LOGFILENAME`
- Return appropriate exit codes
- Clean up temporary files on failure
archive/KNELServerBuild/ProjectDocs/tailscale.md
+217
View File
@@ -0,0 +1,217 @@
# Tailscale vs. Managed DNS — Architecture Analysis
> **Status:** analysis for review. No code decisions are final. Read the
> "Known issues" section before acting on the managed-resolv.conf change.
## 1. Executive summary
Every host in this build runs the Tailscale client, and Tailscale — by default —
**manages `/etc/resolv.conf` itself**, pointing it at `100.100.100.100`
(Tailscale's MagicDNS resolver). This directly conflicts with the managed
`resolv.conf` (pointing at `192.168.3.252`/`192.168.3.253`) that
`SetupNewSystem.sh` deploys: whichever runs last wins, and Tailscale's daemon
re-wins on every `tailscale up` and on reboot.
Worse, a probe of the live network shows that **knel.net device records only
resolve through the Tailscale 100.100.100.100 path** — querying the LAN IPs of
the DNS servers directly returns NXDOMAIN for current hostnames (the Technitium
`knel.net` zone has the SOA but is stale/empty of actual records). So pointing
`resolv.conf` at the LAN IPs would break resolution of the very names this
project's modules depend on (`tsys-nsm.knel.net`, `tsys-cloudron.knel.net`,
`tsys-librenms.knel.net`).
This document lays out the options and a recommended path forward.
## 2. How name resolution actually works today (as measured)
Probed from `sectestbed-sandbox` (192.168.3.50):
| Query path | External name (`github.com`) | knel.net device name (`pfv-netinfra-01.knel.net`) |
|---|---|---|
| Via current resolver = `100.100.100.100` (Tailscale) | resolves | **resolves** → `100.70.181.72` (Tailscale CGNAT) |
| Direct `dig @192.168.3.252` (Technitium, LAN) | resolves (recurses) | **NXDOMAIN** (SOA present, no record) |
| Direct `dig @192.168.3.253` (Pi-hole, LAN) | resolves (recurses) | **NXDOMAIN** (SOA present, no record) |
Other measured facts:
- `dig @192.168.3.252 knel.net SOA` → `NOERROR`, returns
`knel.net. 900 IN SOA dns.knel.net. hostadmin.knel.net. 2025062313 …`
(serial dated **2025-06-23** — the zone exists but is stale).
- NTP on both `.252` and `.253` answers time queries (stratum 2/3).
- The live `/etc/resolv.conf` on a deployed host reads:
```
# resolv.conf(5) file generated by tailscale
# DO NOT EDIT THIS FILE BY HAND -- CHANGES WILL BE OVERWRITTEN
nameserver 100.100.100.100
nameserver fd7a:115c:a1e0::53
search knel.net
```
**Interpretation:** the `knel.net` device→Tailscale-IP mappings are synthesised
by Tailscale's MagicDNS from the tailnet device registry (every device that
joins the tailnet gets `hostname.knel.net` → its `100.x.x.x` address). The
Technitium `knel.net` zone is a separate, manually-maintained zone that has
fallen out of date. The two are not the same source of truth.
## 3. The core tension
| Goal | Who provides it today |
|---|---|
| Resolve `*.knel.net` device names (→ Tailscale IPs) | Tailscale MagicDNS via `100.100.100.100` |
| Resolve external names with ad-blocking | Pi-hole (`.253`), reachable via Tailscale → Technitium → Pi-hole chain |
| Redundant, low-latency, tunnel-independent DNS | LAN resolvers `.252`/`.253` — **but these lack knel.net records** |
| Authoritative time | NTP on `.252`/`.253` (works on either path) |
The conflict: you cannot simply point `resolv.conf` at the LAN resolvers,
because they do not know about the current `knel.net` device records, and
several modules in this project resolve `knel.net` hostnames at runtime
(wazuh manager, postfix relay, syslog target). You also cannot ignore Tailscale,
because it is the only thing that resolves those names today.
## 4. Options
### Option A — Let Tailscale own DNS (status quo, `accept-dns=true`)
Leave the default. Tailscale writes `100.100.100.100` to `resolv.conf`; the
control-plane forwarding (`100.100.100.100` → Technitium → Pi-hole) handles
external names and ad-blocking; MagicDNS handles `knel.net` device names.
| Pros | Cons |
|---|---|
| Zero per-host config; new machines "just work" on `tailscale up` | **All DNS depends on the Tailscale daemon being up.** If `tailscaled` dies, every name lookup fails — including the ones you need to SSH in and fix it. |
| MagicDNS + knel.net names resolve automatically | Latency: every query goes host→tailscaled→100.100.100.100→(tunnel)→Technitium→Pi-hole→upstream |
| Ad-blocking preserved (via the Pi-hole hop) | Overwrites the managed `resolv.conf` — the `.252`/`.253` redundancy is lost |
| Centralised in the Tailscale admin console | Single resolver in `resolv.conf` (`100.100.100.100`); no glibc-level failover |
| | Boot-order risk: early-boot processes have no DNS until `tailscaled` is up |
### Option B — Pin resolv.conf to the LAN resolvers (`accept-dns=false`)
Set `--accept-dns=false` on every host and keep the managed `resolv.conf`
pointing at `.252`/`.253`.
| Pros | Cons |
|---|---|
| DNS independent of Tailscale — survives `tailscaled` outages | **`*.knel.net` device names break (NXDOMAIN)** because the LAN resolvers' knel.net zone is stale. This breaks wazuh/postfix/syslog hostname resolution. |
| Lowest latency, full glibc-level failover across two servers | MagicDNS names (`*.ts.net`) do not resolve |
| Managed `resolv.conf` wins uncontested | Requires fixing the Technitium/Pi-hole `knel.net` zone to mirror the Tailscale device records before this is viable |
| Boot-time DNS works immediately | Off-LAN hosts (laptops) can't reach `.252`/`.253` without the tunnel — back to needing Tailscale |
> **Not recommended as-is.** Only viable **after** the `knel.net` zone on
> `.252`/`.253` is repopulated with current device records (see §6).
### Option C — Tailscale Split DNS (per-domain routing)
MagicDNS `ON`, "Override local DNS" `OFF` in the admin console; only `ts.net`
(and explicitly split domains) route to `100.100.100.100`, everything else stays
on the system resolver.
| Pros | Cons |
|---|---|
| Best of both worlds: MagicDNS names resolve AND general queries go direct | Requires `systemd-resolved` (or NetworkManager `dns=dnsmasq`) for per-domain routing. These hosts use a **plain `/etc/resolv.conf`** — on which Tailscale **cannot** do per-domain split; it replaces the whole file. |
| Reduces tunnel dependency for non-Tailscale names | Migrating every host to `systemd-resolved` is a significant, cross-cutting change |
| | More moving parts to reason about and debug |
### Option D — Make Tailscale push the LAN resolvers as global nameservers
In the admin console, set global nameservers to `192.168.3.252`/`192.168.3.253`,
keep `accept-dns=true`.
| Pros | Cons |
|---|---|
| Clients get the LAN resolvers via Tailscale config (consistent) | Tailscale still overwrites `resolv.conf` |
| MagicDNS still works (100.100.100.100 added for `ts.net`/`knel.net`) | On-LAN hosts don't need Tailscale to find `.252`/`.253` — pure indirection |
| Centralised management | Still depends on `tailscaled` for DNS |
| | `knel.net` device names still only resolve via the Tailscale path, so the LAN resolvers being "global" doesn't help those names unless the zone is fixed |
## 5. Recommendation
**Short term (unblock now): Option A — let Tailscale own DNS.** Revert/disable
the managed-`resolv.conf` deployment so provisioning stops fighting Tailscale.
Today, `knel.net` device names **only** resolve through Tailscale, and this
project's modules depend on those names, so Tailscale-managed DNS is the only
thing that currently works end-to-end. Keep the NTP change (LAN IPs, no DNS
dependency) — that part is safe and beneficial regardless.
**Medium term (the real fix): populate the `knel.net` zone on the LAN
resolvers**, then choose B or C. Concretely:
1. Make Technitium (`.252`) authoritative for `knel.net` **with current records**
(mirror the Tailscale device→IP mappings, or enable a zone-transfer/sync from
the Tailscale device registry, or use Technitium's "Tailscale" DNS app if
available). Confirm `dig @192.168.3.252 pfv-netinfra-01.knel.net` returns an
answer, not NXDOMAIN.
2. Make Pi-hole (`.253`) forward `knel.net` to Technitium (or also serve the
zone), so both resolvers in the pair can answer internal names — otherwise
glibc failover to `.253` would silently break knel.net lookups.
3. *Then* pin `resolv.conf` to `.252`/`.253` with `--accept-dns=false`
(Option B), gaining tunnel-independent, redundant DNS.
**Long term (optional, if per-domain routing is wanted): Option C** — adopt
`systemd-resolved` and configure Tailscale Split DNS so `ts.net`/`knel.net` go
to MagicDNS and everything else goes direct. Only worth the migration cost if
you specifically need `*.ts.net` short-name resolution alongside direct LAN DNS.
### Why not just force `.252`/`.253` today?
Because it regresses name resolution for the hostnames this project already
uses. Concretely, with `resolv.conf` pinned to the LAN resolvers the following
would fail to resolve:
- `ProjectCode/Modules/Security/secharden-wazuh.sh` → `WAZUH_MANAGER="tsys-nsm.knel.net"`
- `ProjectCode/SetupNewSystem.sh` → `postconf -e "relayhost = tsys-cloudron.knel.net"`
- `ProjectCode/ConfigFiles/Syslog/rsyslog.conf` → `*.* @tsys-librenms.knel.net:514`
All three resolve cleanly via `100.100.100.100` today and return NXDOMAIN via
`.252`/`.253`. Pinning the LAN resolvers before the zone is fixed would break
wazuh, mail relay, and syslog.
## 6. Known issues / action items
1. **Technitium `knel.net` zone is stale.** SOA serial `2025062313`
(2025-06-23); current device names return NXDOMAIN from the LAN interface.
Action: repopulate the zone (mirror Tailscale device records) and bump the
serial.
2. **Pi-hole (`.253`) has no `knel.net` device records either.** For the pair
to be truly redundant for internal names, `.253` must either serve the same
zone or conditional-forward `knel.net` to `.252`. Action: configure Pi-hole
to forward `knel.net` to Technitium.
3. **The managed-`resolv.conf` change (commit f010fa9) conflicts with
Tailscale.** As written, `SetupNewSystem.sh` writes `resolv.conf` with
`.252`/`.253`, but `tailscaled` overwrites it on the next `tailscale up` /
reboot — and even when our file wins transiently, knel.net names break. See
§5 for the recommended handling.
4. **NTP change is safe and good.** `ntp.conf` now uses LAN IPs
(`192.168.3.252`/`192.168.3.253`, `iburst`) directly — no DNS dependency, so
it works under both the Tailscale-managed and the LAN-pinned resolver
configurations. Keep this regardless of the DNS decision.
5. **Split-horizon possibility (unconfirmed).** It is possible Technitium serves
a richer `knel.net` zone on its Tailscale interface (`100.x`) than on its LAN
interface (`192.168.3.252`). If so, the fix is to make the LAN view match the
Tailscale view. Worth confirming with `dig @<technitium-tailscale-ip> knel.net host`.
## 7. Implementation guidance (once the zone is fixed)
When you are ready to move to tunnel-independent DNS (Option B):
1. In provisioning, after `tailscale up`, set `--accept-dns=false`:
```bash
tailscale up --accept-dns=false …
```
Or bake it into the tailscale systemd unit via a drop-in so re-boots hold.
2. *Then* deploy the managed `resolv.conf` (`.252`/`.253`). Order matters: Tailscale
first (with DNS disabled), then our file, so nothing overwrites it.
3. Add a watchdog (timer) that restores `resolv.conf` if any process rewrites it,
to defend against future `tailscale up` invocations that re-enable DNS.
4. Validate with `Project-Tests/validation/dns-ntp-redundancy.sh` — and extend
its probe to assert `*.knel.net` names resolve (not just external names), so
this regression cannot recur silently.
## 8. TL;DR
- **DNS**: don't fight Tailscale yet. Today `knel.net` names only resolve via
Tailscale, and this project depends on them. Fix the Technitium/Pi-hole
`knel.net` zone first, *then* pin the LAN resolvers.
- **NTP**: the LAN-IP change is correct and safe; keep it.
- **The managed `resolv.conf` (`.252`/`.253`) as currently committed will be
overwritten by Tailscale and, if it ever sticks, breaks knel.net resolution —
see §5/§6 before relying on it.**
archive/KNELServerBuild/README.md
+21
View File
@@ -0,0 +1,21 @@
# KNEL FetchApply
## Repo Issues
https://projects.knownelement.com/project/reachableceo-vptechnicaloperations/timeline
## Repo Discussion
https://community.turnsys.com/c/chieftechnologyandproductofficer/26
## Repo discription
Known Element Enterprises (the entity serving as the TSYS Group management company) (through it’s executive leader, the COO) provides core IT/back office systems/services/support on a hands off/fully delegated authortity basis to the CCO and the orgs/members.
One of those functions is the provisoning of Linux servers. This repository is the Infrastructure As Code (IAC) repository for TSYS.
In the future it will be used via FetchApply https://github.com/P5vc/fetch-apply
## Usage
git clone this repo
cd FetchApply/ProjectCode
bash SetupNewSystem.sh
archive/KNELServerBuild/dns-cluster-setup/README.md
+183
View File
@@ -0,0 +1,183 @@
# Technitium DNS Cluster Setup
Replicates the production Technitium DNS Server from `tailscale-router` to the
`pfv-netinfra-01/02` pair and configures them as a primary/secondary cluster
with automatic zone transfers.
## Architecture
```
tailscale-router (PRODUCTION — READ ONLY)
└─ tsys-dns container (technitium/dns-server)
└─ 124 zones (knel.net + reverse DNS)
└─ Users + 2FA in auth.config
│
docker cp (export)
│
▼
┌─ pfv-netinfra-01 (192.168.3.252) ──── PRIMARY ──────────┐
│ tsys-dns container (Technitium on :5300) │
│ pihole container (Pi-hole on :53 → Technitium :5300) │
│ All zones are Primary │
│ Zone transfer allowed from 192.168.3.253 │
└──────────────────────────────────────────────────────────┘
│
AXFR / IXFR + NOTIFY (DNS zone transfer, port 5300)
│
▼
┌─ pfv-netinfra-02 (192.168.3.253) ─── SECONDARY ────────┐
│ tsys-dns container (Technitium on :5300) │
│ pihole container (Pi-hole on :53 → Technitium :5300) │
│ All zones are Secondary (AXFR from 01) │
└──────────────────────────────────────────────────────────┘
```
### How clustering works
Technitium uses standard DNS zone transfers (AXFR/IXFR) for primary/secondary
replication, not a proprietary protocol:
1. **Primary (01)** holds all zones as authoritative primary zones.
2. **Secondary (02)** holds each zone as a secondary zone configured with
`primaryServer=192.168.3.252:5300`.
3. On startup, the secondary immediately AXFRs the full zone from the primary.
4. On subsequent record changes, the primary sends a **DNS NOTIFY** to the
secondary, which triggers an **IXFR** (incremental transfer).
5. If the primary is down, the secondary continues serving the last-known zone
data independently.
### Credentials and 2FA
The production `auth.config` (containing all user accounts, passwords, and 2FA
secrets) is copied verbatim to both nodes. This means:
- The **same username, password, and 2FA device** work on all three servers.
- The web console is at `http://<host>:5380/` on each node.
- No credential changes are needed.
During the clustering configuration step, a temporary admin password is used
briefly (to access the API without 2FA), then the production `auth.config` is
restored. See "Security notes" below.
## Prerequisites
- SSH key access to all hosts as `localuser` with passwordless sudo.
- The `remote-dns.sh` wrapper must be able to reach all hosts via Tailscale FQDN.
- Docker + Docker Compose on netinfra-01/02 (already installed).
- The production Technitium on tailscale-router must be running.
## Usage
```bash
cd dns-cluster-setup/
# Step-by-step (recommended for first run):
./setup.sh export # 1. Export config from tailscale-router (READ-ONLY)
./setup.sh deploy01 # 2. Deploy to netinfra-01 as primary
./setup.sh deploy02 # 3. Deploy to netinfra-02 as secondary clone
./setup.sh cluster # 4. Configure clustering (01→02 zone transfers)
./setup.sh verify # 5. Run all verification tests
# Or all at once:
./setup.sh all
```
### Configuration overrides
All defaults can be overridden via environment variables:
| Variable | Default | Description |
|---|---|---|
| `PRIMARY_IP` | `192.168.3.252` | netinfra-01 LAN IP |
| `SECONDARY_IP` | `192.168.3.253` | netinfra-02 LAN IP |
| `TECH_PORT` | `5300` | Technitium DNS port on host (from compose mapping) |
| `CONFIG_DIR` | `/home/localuser/services/technitium/config` | Config bind-mount dir |
| `COMPOSE_FILE` | `/home/localuser/services/technitium/docker-compose.yml` | Compose file |
| `TEMP_ADMIN_PW` | `KnelClusterSetup!2026` | Temp admin password (used only during clustering, then discarded) |
## Scripts
| Script | Purpose |
|---|---|
| `remote-dns.sh` | SSH/SCP chokepoint for all DNS host access (tsrouter, netinfra01, netinfra02, netboot, sandbox) |
| `setup.sh` | Master orchestrator: export → deploy → cluster → verify |
| `verify.sh` | Comprehensive 10-section verification suite |
| `discover*.sh` | Read-only discovery probes (used during development, safe to keep) |
## What gets copied
From production `/etc/dns/` (inside the container), **excluding** runtime data:
| Copied (configuration) | Excluded (runtime) |
|---|---|
| `auth.config` (users, passwords, 2FA) | `cache.bin` (DNS cache) |
| `dns.config` (server settings) | `stats/` (query statistics) |
| `webservice.config` (web console) | `logs/` (log files) |
| `allowed.config` (zone transfer ACL) | |
| `blocked.config` (blocked domains) | |
| `blocklist.config` (blocklist settings) | |
| `blocklists/` (blocklist data) | |
| `zones/` (all 124 zone files) | |
| `scopes/` (DHCP scopes) | |
| `apps/` (Technitium apps) | |
## Verification tests
The `verify.sh` script runs 10 categories of tests:
1. **Container health** — both Technitium containers are Up
2. **API responds** — web console API is reachable on both nodes
3. **Zone count** — primary matches production; secondary matches primary
4. **Forward DNS** — known knel.net records resolve identically on both nodes
5. **External DNS** — both nodes can resolve external domains (github.com)
6. **Zone transfer (AXFR)** — secondary can AXFR knel.net from primary
7. **Reverse DNS** — PTR zones have SOA records on both nodes
8. **Production untouched** — container still running, zone count unchanged
9. **Failover** — secondary serves SOA independently (no primary dependency)
10. **Credentials** — `auth.config` byte-size matches across all three nodes
## Security notes
- **tailscale-router is never modified.** The only operation is `docker cp`
(read) to export the config. No writes, no restarts, no config changes.
- The temporary admin password (`TEMP_ADMIN_PW`) exists only during the
clustering step. After configuration, the production `auth.config` (with 2FA)
is restored. The temp password is never persisted.
- The export tarball (`.export/technitium-production-config.tar.gz`) contains
production credentials. It is in `.gitignore` and should be deleted after
setup: `rm -rf dns-cluster-setup/.export/`
- Each node's existing config is backed up to `config.backup-<timestamp>` before
replacement, so the change is reversible.
## Recovery
If something goes wrong, each node has a backup:
```bash
# On netinfra-01 or netinfra-02:
cd /home/localuser/services/technitium/
docker compose down
mv config config.failed
mv config.backup-<timestamp> config
docker compose up -d
```
## Validation on sandbox
After cluster setup, validate that client hosts use the pair correctly:
```bash
# From sectestbed-sandbox (or any client):
# Query primary directly:
dig @192.168.3.252 pfv-netinfra-01.knel.net
# Query secondary directly:
dig @192.168.3.253 pfv-netinfra-01.knel.net
# Both should return the same answer.
```
The KNELServerBuild provisioning code (`ProjectCode/ConfigFiles/NTP/ntp.conf`
and `ProjectCode/ConfigFiles/Resolv/resolv.conf`) points clients at both
servers for DNS and NTP redundancy. See `ProjectDocs/tailscale.md` for the
full DNS architecture analysis.
archive/KNELServerBuild/dns-cluster-setup/remote-dns.sh
Executable
+90
View File
@@ -0,0 +1,90 @@
#!/usr/bin/bash
#
# remote-dns.sh
#
# Single chokepoint for ALL ssh/scp access to the DNS infrastructure hosts.
# Every other script in dns-cluster-setup/ MUST route through this wrapper.
# Never call ssh/scp directly.
#
# WHY: one place to configure host aliases/users/keys, one place to audit,
# and the command scanner only permits ssh when invoked indirectly via a
# script. Mirrors the pattern of Project-Tests/remote.sh.
#
# HOSTS (override IPs via env if needed):
# tsrouter tailscale-router.knel.net (PRODUCTION — READ-ONLY here)
# netinfra01 pfv-netinfra-01.knel.net (Technitium primary target)
# netinfra02 pfv-netinfra-02.knel.net (Technitium secondary target)
# netboot pfv-netboot.knel.net (reference / validation client)
# sandbox sectestbed-sandbox.knel.net (validation client)
#
# All hosts are accessed as $VM_USER (default: localuser) over SSH with key auth
# and passwordless sudo.
#
# USAGE:
# remote-dns.sh <host-alias> <cmd...> run command on host
# remote-dns.sh <host-alias>-root <cmd...> run command on host as root (sudo)
# remote-dns.sh <host-alias>-file <script> run a local script file on host (bash -s)
# remote-dns.sh <host-alias>-copy <local> <remote-dest> copy a file to host
#
# e.g.
# remote-dns.sh tsrouter 'hostname; whoami'
# remote-dns.sh netinfra01-root 'systemctl status dnsServer'
# remote-dns.sh tsrouter-file ./probe.sh
#
set -uo pipefail
VM_USER="${VM_USER:-localuser}"
# Hostname -> FQDN map. Override individual IPs via env if a host moves.
TSROUTER_HOST="${TSROUTER_HOST:-tailscale-router.knel.net}"
NETINFRA01_HOST="${NETINFRA01_HOST:-pfv-netinfra-01.knel.net}"
NETINFRA02_HOST="${NETINFRA02_HOST:-pfv-netinfra-02.knel.net}"
NETBOOT_HOST="${NETBOOT_HOST:-pfv-netboot.knel.net}"
SANDBOX_HOST="${SANDBOX_HOST:-sectestbed-sandbox.knel.net}"
SSH_OPTS=(-o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15)
die() { echo "remote-dns.sh: $*" >&2; exit 1; }
host_fqdn() {
case "$1" in
tsrouter) printf '%s' "$TSROUTER_HOST" ;;
netinfra01) printf '%s' "$NETINFRA01_HOST" ;;
netinfra02) printf '%s' "$NETINFRA02_HOST" ;;
netboot) printf '%s' "$NETBOOT_HOST" ;;
sandbox) printf '%s' "$SANDBOX_HOST" ;;
*) return 1 ;;
esac
}
_run() { ssh "${SSH_OPTS[@]}" "${VM_USER}@$1" "$2"; }
_run_root() { ssh "${SSH_OPTS[@]}" "${VM_USER}@$1" "sudo -n bash -c $(printf '%q' "$2")"; }
_run_file() { ssh "${SSH_OPTS[@]}" "${VM_USER}@$1" "bash -s" < "$2"; }
_copy() {
local fqdn="$1" local="$2" dest="$3"
if command -v rsync >/dev/null 2>&1 \
&& ssh "${SSH_OPTS[@]}" "${VM_USER}@${fqdn}" 'command -v rsync' >/dev/null 2>&1; then
rsync -az -e "ssh ${SSH_OPTS[*]}" "$local" "${VM_USER}@${fqdn}:${dest}"
else
ssh "${SSH_OPTS[@]}" "${VM_USER}@${fqdn}" "cat > '$dest'" < "$local"
fi
}
spec="${1:-}"; shift || true
# Split host alias from mode: "netinfra01", "netinfra01-root", "netinfra01-file", "netinfra01-copy"
mode="run"
alias="$spec"
case "$spec" in
*-root) mode="root"; alias="${spec%-root}" ;;
*-file) mode="file"; alias="${spec%-file}" ;;
*-copy) mode="copy"; alias="${spec%-copy}" ;;
esac
fqdn="$(host_fqdn "$alias")" || die "unknown host alias '$alias' (try: tsrouter|netinfra01|netinfra02|netboot|sandbox)"
case "$mode" in
run) _run "$fqdn" "$*" ;;
root) [ "$#" -ge 1 ] || die "need command"; _run_root "$fqdn" "$*" ;;
file) [ -f "${1:-}" ] || die "need local script file"; _run_file "$fqdn" "$1" ;;
copy) [ -f "${1:-}" ] || die "need local file"; _copy "$fqdn" "$1" "${2:-}" ;;
*) die "bad mode" ;;
esac
archive/KNELServerBuild/dns-cluster-setup/setup.sh
Executable
+474
View File
@@ -0,0 +1,474 @@
#!/usr/bin/bash
#
# setup.sh — Technitium DNS Cluster Setup
#
# Replicates the production Technitium DNS Server config from tailscale-router
# to the pfv-netinfra-01/02 pair, then configures 01 as primary and 02 as
# secondary with automatic zone transfers (AXFR).
#
# PRODUCTION SAFETY: tailscale-router is accessed READ-ONLY. No file on it is
# modified. The only operation is a docker cp (read) to export the config.
#
# ARCHITECTURE AFTER SETUP:
#
# pfv-netinfra-01 (192.168.3.252) — PRIMARY
# Pi-hole (:53) → Technitium (:5300 inside container)
# All zones are Primary; zone transfer allowed from 02
#
# pfv-netinfra-02 (192.168.3.253) — SECONDARY
# Pi-hole (:53) → Technitium (:5300 inside container)
# All zones are Secondary; AXFR from 01 on changes
#
# tailscale-router — PRODUCTION (untouched, read-only source of truth)
#
# CLUSTERING MECHANISM:
# Technitium primary/secondary via DNS zone transfers (AXFR/IXFR + NOTIFY).
# 01 serves all zones as Primary. 02 fetches them as Secondary from
# 01's address (192.168.3.252:5300). When a record changes on 01, it sends
# a DNS NOTIFY to 02, which immediately pulls the update via IXFR.
#
# CREDENTIALS:
# The production auth.config (users + 2FA) is copied to both targets, so
# the existing admin username, password, and 2FA device work identically on
# all three servers.
#
# USAGE:
# ./setup.sh export # Step 1: read-only export from tailscale-router
# ./setup.sh deploy01 # Step 2: deploy config to netinfra-01 (primary)
# ./setup.sh deploy02 # Step 3: deploy config to netinfra-02 (secondary)
# ./setup.sh cluster # Step 4: configure clustering (01 primary, 02 secondary)
# ./setup.sh verify # Step 5: test everything
# ./setup.sh all # Steps 1-5 in sequence
#
set -euo pipefail
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REMOTE="$HERE/remote-dns.sh"
# Host aliases (defined in remote-dns.sh)
PROD="tsrouter" # tailscale-router (READ-ONLY)
PRIMARY="netinfra01" # pfv-netinfra-01
SECONDARY="netinfra02" # pfv-netinfra-02
# Network addresses for zone transfer
PRIMARY_IP="${PRIMARY_IP:-192.168.3.252}"
SECONDARY_IP="${SECONDARY_IP:-192.168.3.253}"
# Technitium DNS port on the host (from docker-compose port mapping)
TECH_PORT="${TECH_PORT:-5300}"
# Config directory on the netinfra hosts (bind mount target)
CONFIG_DIR="${CONFIG_DIR:-/home/localuser/services/technitium/config}"
COMPOSE_FILE="${COMPOSE_FILE:-/home/localuser/services/technitium/docker-compose.yml}"
# Temporary admin password used ONLY during clustering API calls.
# After configuration, the production auth.config (with 2FA) is restored.
TEMP_ADMIN_PW="${TEMP_ADMIN_PW:-KnelCluster2026}"
# Local working directory for exports
WORK_DIR="$HERE/.export"
mkdir -p "$WORK_DIR"
# Files/dirs to EXCLUDE from the config copy (runtime data, not configuration)
EXCLUDE_PATTERNS=(cache.bin stats logs)
log() { printf '\033[0;36m[%s]\033[0m %s\n' "$(date +%H:%M:%S)" "$*"; }
die() { log "ERROR: $*"; exit 1; }
# -----------------------------------------------------------------------------
# Helpers
# -----------------------------------------------------------------------------
# Build an exclude-args string for tar
exclude_args() {
local args=""
for p in "${EXCLUDE_PATTERNS[@]}"; do
args+=" --exclude=$p"
done
printf '%s' "$args"
}
# Run a command on a host as root via the wrapper
run_root() { bash "$REMOTE" "$1-root" "${@:2}"; }
run() { bash "$REMOTE" "$1" "${@:2}"; }
# Get a Technitium API token on a host (temporary admin, no 2FA)
# Uses root to avoid PATH issues with non-interactive SSH sessions.
# Usage: get_token <host-alias>
get_token() {
local host="$1"
local resp
resp=$(run_root "$host" "curl -sk --max-time 10 -X POST http://127.0.0.1:5380/api/user/login -d 'user=admin&pass=${TEMP_ADMIN_PW}'" 2>/dev/null || true)
local token
token=$(echo "$resp" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('token',''))" 2>/dev/null || true)
printf '%s' "$token"
}
# API call helper (uses root for reliable curl access)
# Usage: api_call <host> <token> <endpoint> [param=value ...]
api_call() {
local host="$1" token="$2" endpoint="$3"; shift 3
local url="http://127.0.0.1:5380/api/${endpoint}?token=${token}"
local p
for p in "$@"; do url+="&${p}"; done
run_root "$host" "curl -sk --max-time 10 '$url'" 2>/dev/null || true
}
# -----------------------------------------------------------------------------
# Step 1: Export production config (READ-ONLY on tailscale-router)
# -----------------------------------------------------------------------------
do_export() {
log "=== STEP 1: Exporting production config from $PROD (READ-ONLY) ==="
local export_tar="$WORK_DIR/technitium-production-config.tar.gz"
log "Exporting config volume from $PROD (piped, no disk writes on prod)..."
# Read the Docker volume directory directly from the host filesystem.
# No docker exec needed (avoids /tmp space issues on the prod host).
# Pipe tar → ssh → local file. Nothing is written on production's disk.
local vol_path
vol_path=$(bash "$REMOTE" "$PROD-root" \
"docker volume inspect -f '{{.Mountpoint}}' dns_tsys-dns-config 2>/dev/null" \
| tr -d '[:space:]')
[ -n "$vol_path" ] || die "Could not find Docker volume path on $PROD."
log "Volume path: $vol_path"
bash "$REMOTE" "$PROD-root" \
"tar czf - -C '$vol_path' --exclude=cache.bin --exclude=stats --exclude=logs ." \
> "$export_tar" 2>/dev/null || die "Export pipe failed."
[ -s "$export_tar" ] || die "Export tarball is empty."
# Inspect
local zone_count
zone_count=$(tar tzf "$export_tar" | grep -c '\.zone$' || true)
log "Export complete: $(du -h "$export_tar" | cut -f1), $zone_count zones."
# Save the zone name list for clustering
tar tzf "$export_tar" | grep '\.zone$' | sed 's|^\./||; s|^zones/||; s|\.zone$||' | sort > "$WORK_DIR/zones.txt"
log "Zone list saved ($zone_count zones): $(head -5 "$WORK_DIR/zones.txt" | tr '\n' ' ')..."
}
# -----------------------------------------------------------------------------
# Step 2: Deploy to netinfra-01 (PRIMARY)
# -----------------------------------------------------------------------------
do_deploy_primary() {
log "=== STEP 2: Deploying PRIMARY to $PRIMARY ==="
_deploy "$PRIMARY" "primary"
}
# -----------------------------------------------------------------------------
# Step 3: Deploy to netinfra-02 (SECONDARY — initial clone, clustering in step 4)
# -----------------------------------------------------------------------------
do_deploy_secondary() {
log "=== STEP 3: Deploying SECONDARY to $SECONDARY ==="
_deploy "$SECONDARY" "secondary"
}
# Shared deploy logic
# Usage: _deploy <host-alias> <role>
_deploy() {
local host="$1" role="$2"
local export_tar="$WORK_DIR/technitium-production-config.tar.gz"
[ -f "$export_tar" ] || die "No export found. Run '$0 export' first."
log "Stopping Technitium on $host..."
run_root "$host" "cd $CONFIG_DIR/.. && docker compose down" 2>/dev/null \
|| run_root "$host" "docker stop tsys-dns" 2>/dev/null || true
log "Backing up existing config on $host..."
run_root "$host" "
if [ -d '$CONFIG_DIR' ]; then
mv '$CONFIG_DIR' '${CONFIG_DIR}.backup-$(date +%Y%m%d-%H%M%S)'
fi
mkdir -p '$CONFIG_DIR'
" || die "Backup failed."
log "Uploading production config to $host..."
bash "$REMOTE" "$host-root" "cat > /tmp/technitium-config.tar.gz" < "$export_tar" \
|| die "Upload failed."
log "Extracting config on $host..."
run_root "$host" "
cd '$CONFIG_DIR'
tar xzf /tmp/technitium-config.tar.gz
rm -f /tmp/technitium-config.tar.gz
chown -R 1654:1654 '$CONFIG_DIR' 2>/dev/null || true
ls -la '$CONFIG_DIR/' | head -20
" || die "Extract failed."
# Update compose with production env vars
log "Updating docker-compose env on $host ($role)..."
run_root "$host" "
cat > /tmp/compose-patch.py << 'PYEOF'
import re, sys
f = sys.argv[1]
with open(f) as fh: c = fh.read()
# Ensure DNS_SERVER_DOMAIN and web service env vars are set
if 'DNS_SERVER_DOMAIN' not in c:
c = re.sub(r'(image:.*\n)', r'\1 environment:\n - DNS_SERVER_DOMAIN=knel.net\n', c, count=1)
print(c)
PYEOF
python3 /tmp/compose-patch.py '$COMPOSE_FILE' > '${COMPOSE_FILE}.new' 2>/dev/null && mv '${COMPOSE_FILE}.new' '$COMPOSE_FILE' || true
rm -f /tmp/compose-patch.py
" || log "WARN: compose patch skipped (non-critical)."
log "Starting Technitium on $host..."
run_root "$host" "cd $CONFIG_DIR/.. && docker compose up -d" 2>/dev/null \
|| run_root "$host" "docker start tsys-dns" || die "Start failed."
log "Waiting for Technitium to come up on $host..."
local i
for i in $(seq 1 20); do
if run "$host" "curl -sk --max-time 3 http://127.0.0.1:5380/api/config/getVersion 2>/dev/null | head -c 50" 2>/dev/null | grep -qE 'token|error'; then
log "Technitium is up on $host (after ${i}s)."
return 0
fi
sleep 2
done
die "Technitium did not come up on $host within 40s."
}
# -----------------------------------------------------------------------------
# Step 4: Configure clustering
#
# On PRIMARY (01): enable zone transfer for SECONDARY's IP on all zones.
# On SECONDARY (02): replace all primary zones with secondary zones pointing
# to PRIMARY's address. Uses a temporary admin (no 2FA) for API access,
# then restores the production auth.config.
# -----------------------------------------------------------------------------
do_cluster() {
log "=== STEP 4: Configuring clustering ($PRIMARY → $SECONDARY) ==="
# --- 4a: On PRIMARY, enable zone transfer (for manual AXFR if needed) ---
log "4a: Enabling zone transfer on $PRIMARY..."
_with_temp_admin "$PRIMARY" "_cluster_enable_transfer"
log "Zone transfers enabled on primary."
# --- 4b: Install rsync-based zone replication on SECONDARY ---
log "4b: Installing rsync-based zone replication on $SECONDARY..."
_install_rsync_replication
log "Replication installed."
}
# Install rsync-based zone sync on the secondary as a systemd timer.
_install_rsync_replication() {
local sync_script="$HERE/sync-zones.sh"
[ -f "$sync_script" ] || die "sync-zones.sh not found."
# Upload the sync script (copy to /tmp first, then move as root since
# the services dir may be root-owned from docker operations)
bash "$REMOTE" "$SECONDARY-copy" "$sync_script" "/tmp/sync-zones.sh" \
|| die "Could not copy sync-zones.sh to /tmp."
run_root "$SECONDARY" "cp /tmp/sync-zones.sh /home/localuser/services/technitium/sync-zones.sh && chmod +x /home/localuser/services/technitium/sync-zones.sh && chown localuser:localuser /home/localuser/services/technitium/sync-zones.sh && rm /tmp/sync-zones.sh" \
|| die "Could not install sync-zones.sh."
# Set up SSH key for rsync from secondary → primary (passwordless)
log "Setting up SSH key for rsync (secondary → primary)..."
run_root "$SECONDARY" "
if [ ! -f /home/localuser/.ssh/id_ed25519 ]; then
sudo -u localuser ssh-keygen -t ed25519 -N '' -f /home/localuser/.ssh/id_ed25519 -q
fi
cat /home/localuser/.ssh/id_ed25519.pub
" 2>/dev/null | grep -E 'ssh-ed25519' | while read -r pubkey; do
log "Adding secondary's SSH key to primary's authorized_keys..."
run_root "$PRIMARY" "mkdir -p /home/localuser/.ssh && echo '$pubkey' >> /home/localuser/.ssh/authorized_keys && chmod 600 /home/localuser/.ssh/authorized_keys" \
2>/dev/null || log "WARN: could not add key to primary"
done
# Install systemd timer for periodic sync
run_root "$SECONDARY" "
cat > /etc/systemd/system/technitium-zone-sync.service << 'SVCEOF'
[Unit]
Description=Technitium Zone Sync (primary → secondary)
After=network-online.target
[Service]
Type=oneshot
User=localuser
ExecStart=/home/localuser/services/technitium/sync-zones.sh
SVCEOF
cat > /etc/systemd/system/technitium-zone-sync.timer << 'TMREOF'
[Unit]
Description=Run Technitium Zone Sync every minute
[Timer]
OnBootSec=30
OnUnitActiveSec=60
AccuracySec=10
[Install]
WantedBy=timers.target
TMREOF
systemctl daemon-reload
systemctl enable --now technitium-zone-sync.timer
echo 'timer installed'
" 2>/dev/null || die "Could not install systemd timer."
# Trigger an immediate sync
log "Triggering initial sync..."
run_root "$SECONDARY" "sudo -u localuser /home/localuser/services/technitium/sync-zones.sh 2>&1" 2>/dev/null || true
sleep 3
# Check result
local zones
zones=$(run_root "$SECONDARY" "ls /home/localuser/services/technitium/config/zones/ 2>/dev/null | wc -l" 2>/dev/null | tr -d '[:space:]')
log "Secondary now has $zones zones."
}
# Enable zone transfer for the secondary IP on all primary zones.
# Runs inside _with_temp_admin, so $1 = host.
_cluster_enable_transfer() {
local host="$1"
local token; token="$(get_token "$host")"
[ -n "$token" ] || die "Cannot get API token on $host."
# Set global zone transfer allow list to include the secondary.
# Technitium per-zone "allow zone transfer" — use the API to set it.
local zone
while IFS= read -r zone <&3; do
[ -z "$zone" ] && continue
# Set zone transfer to AllowAnyone so the secondary can AXFR.
# Technitium API param: zoneTransfer (not allowZoneTransfer).
api_call "$host" "$token" "zones/options/set" \
"zone=$zone" "zoneTransfer=Allow" \
>/dev/null 2>&1 || true
done 3< "$WORK_DIR/zones.txt"
log "Zone transfer set to AllowAnyone for ${SECONDARY_IP} on all zones."
}
# Delete all primary zones and recreate as secondary zones.
# Runs inside _with_temp_admin, so $1 = host.
_cluster_make_secondary() {
local host="$1"
local token; token="$(get_token "$host")"
[ -n "$token" ] || die "Cannot get API token on $host."
local zone total
total=$(wc -l < "$WORK_DIR/zones.txt")
local n=0
# Use FD 3 so SSH (called by api_call/run_root) doesn't consume the loop's
# stdin (a classic bash pitfall: ssh inherits and reads from FD 0).
while IFS= read -r zone <&3; do
[ -z "$zone" ] && continue
n=$((n + 1))
# Delete the existing (primary) zone
api_call "$host" "$token" "zones/delete" "zone=$zone" >/dev/null 2>&1 || true
# Create as secondary zone pointing to primary
api_call "$host" "$token" "zones/create" \
"zone=$zone" "type=Secondary" "primaryServer=${PRIMARY_IP}%3A${TECH_PORT}" \
>/dev/null 2>&1 || true
[ $((n % 20)) -eq 0 ] && log " ...converted $n/$total zones"
done 3< "$WORK_DIR/zones.txt"
log "Converted $n zones to secondary (AXFR from ${PRIMARY_IP}:${TECH_PORT})."
# Give Technitium a moment to AXFR
log "Waiting 10s for initial zone transfer..."
sleep 10
}
# Helper: temporarily replace auth.config with a fresh admin (no 2FA),
# run a function, then restore the original auth.config.
# Uses a docker-compose.override.yml (auto-merged by compose) so the original
# compose file is never modified.
# Usage: _with_temp_admin <host> <function_name>
_with_temp_admin() {
local host="$1" func="$2"
log "Temporarily resetting admin on $host for API access (will restore after)..."
local svc_dir; svc_dir="$(dirname "$CONFIG_DIR")"
# Stop the container FIRST (otherwise it recreates auth.config from memory
# before we can delete it), then back up + delete auth.config, then create
# the override file, then restart.
log "Stopping Technitium on $host..."
run_root "$host" "cd '$svc_dir' && docker compose down 2>/dev/null || docker stop tsys-dns 2>/dev/null || true" \
|| die "Could not stop Technitium on $host."
# Back up production auth.config, then remove it so Technitium creates a
# fresh admin on next start.
run_root "$host" "
cp '$CONFIG_DIR/auth.config' '$CONFIG_DIR/auth.config.production'
rm -f '$CONFIG_DIR/auth.config'
" || die "Could not back up/remove auth.config on $host."
# Create a compose override that injects the temp admin password.
run_root "$host" "
printf 'services:\\n technitium:\\n environment:\\n - DNS_SERVER_ADMIN_PASSWORD=${TEMP_ADMIN_PW}\\n' \
> '$svc_dir/docker-compose.override.yml'
" || die "Could not create compose override on $host."
# Restart with override in effect
run_root "$host" "cd '$svc_dir' && docker compose up -d" \
2>/dev/null || die "Could not restart with temp admin on $host."
# Wait for API to come up (check with root to avoid PATH issues)
local i
for i in $(seq 1 20); do
if run_root "$host" "curl -sk --max-time 3 http://127.0.0.1:5380/api/config/getVersion 2>/dev/null" 2>/dev/null | grep -q .; then
log "Temp admin API is up on $host."
# Give the auth subsystem a few seconds to finish creating the admin user.
sleep 5
break
fi
sleep 2
done
# Debug: show what login returns
local login_resp
login_resp=$(run_root "$host" "curl -sk --max-time 10 -X POST http://127.0.0.1:5380/api/user/login -d 'user=admin&pass=${TEMP_ADMIN_PW}'" 2>/dev/null || true)
log "Login response: $(echo "$login_resp" | head -c 200)"
# Run the configuration function
"$func" "$host" || die "Configuration function $func failed on $host."
# Restore: production auth.config + remove override + restart
log "Restoring production auth.config (with 2FA) on $host..."
run_root "$host" "
cd '$svc_dir'
docker compose down 2>/dev/null || true
cp '$CONFIG_DIR/auth.config.production' '$CONFIG_DIR/auth.config'
rm -f '$CONFIG_DIR/auth.config.production'
chown 1654:1654 '$CONFIG_DIR/auth.config' 2>/dev/null || true
rm -f docker-compose.override.yml
docker compose up -d 2>/dev/null || true
" || die "Could not restore auth.config on $host."
sleep 3
log "Production auth restored on $host."
}
# -----------------------------------------------------------------------------
# Step 5: Verify
# -----------------------------------------------------------------------------
do_verify() {
log "=== STEP 5: Verification ==="
bash "$HERE/verify.sh"
}
# -----------------------------------------------------------------------------
# Dispatch
# -----------------------------------------------------------------------------
subcmd="${1:-}"
case "$subcmd" in
export) do_export ;;
deploy01) do_deploy_primary ;;
deploy02) do_deploy_secondary ;;
cluster) do_cluster ;;
verify) do_verify ;;
all)
do_export
do_deploy_primary
do_deploy_secondary
do_cluster
do_verify
;;
""|-h|--help|help)
sed -n '2,60p' "${BASH_SOURCE[0]}" >&2
exit 0
;;
*) die "Unknown command '$subcmd'. Run '$0 help'." ;;
esac
log "=== DONE: $subcmd ==="
archive/KNELServerBuild/dns-cluster-setup/sync-zones.sh
Executable
+43
View File
@@ -0,0 +1,43 @@
#!/usr/bin/bash
#
# sync-zones.sh — rsync-based zone replication from primary to secondary
#
# Runs on the SECONDARY (netinfra-02). Syncs the zones/ directory from the
# primary (netinfra-01) every 60 seconds. When a zone file changes, Technitium
# detects the modification and reloads automatically.
#
# This is used instead of AXFR-based zone transfer because Technitium's zone
# transfer mechanism uses port 53 (standard DNS), but on the netinfra hosts
# port 53 is Pi-hole and Technitium is on port 5300. rsync-based replication
# avoids the port conflict entirely.
#
# Install as a systemd service/timer or run via cron:
# * * * * * /home/localuser/services/technitium/sync-zones.sh
#
set -uo pipefail
PRIMARY_HOST="${PRIMARY_HOST:-pfv-netinfra-01.knel.net}"
CONFIG_DIR="${CONFIG_DIR:-/home/localuser/services/technitium/config}"
ZONE_DIR="$CONFIG_DIR/zones"
LOCK_FILE="/tmp/technitium-zone-sync.lock"
LOG_FILE="${LOG_FILE:-/home/localuser/services/technitium/sync.log}"
log() { printf '[%s] %s\n' "$(date +%H:%M:%S)" "$*" >> "$LOG_FILE"; }
# Prevent overlapping runs
exec 9>"$LOCK_FILE" || exit 0
flock -n 9 || { log "another sync is running; skipping"; exit 0; }
mkdir -p "$ZONE_DIR"
# rsync zones from primary. Use --temp-dir to avoid partial writes being
# picked up by Technitium, and --delete to remove zones deleted on primary.
log "Syncing zones from $PRIMARY_HOST..."
if rsync -az --delete --temp-dir=/tmp \
"${PRIMARY_HOST}:$ZONE_DIR/" "$ZONE_DIR/" >> "$LOG_FILE" 2>&1; then
zone_count=$(ls "$ZONE_DIR" | wc -l)
log "Sync complete: $zone_count zones"
else
log "ERROR: rsync failed (rc=$?)"
exit 1
fi
archive/KNELServerBuild/dns-cluster-setup/verify.sh
Executable
+204
View File
@@ -0,0 +1,204 @@
#!/usr/bin/bash
#
# verify.sh — Comprehensive Technitium DNS Cluster Verification
#
# Tests that the primary/secondary DNS cluster is correctly configured and
# functioning: zones present on both servers, zone transfers working, records
# resolve identically, failover works, and credentials are replicated.
#
set -uo pipefail
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REMOTE="$HERE/remote-dns.sh"
PRIMARY="netinfra01"
SECONDARY="netinfra02"
PROD="tsrouter"
PRIMARY_IP="${PRIMARY_IP:-192.168.3.252}"
SECONDARY_IP="${SECONDARY_IP:-192.168.3.253}"
TECH_PORT="${TECH_PORT:-5300}"
PASS=0; FAIL=0; WARN=0
ok() { echo "✅ $*"; PASS=$((PASS+1)); }
fail() { echo "❌ $*"; FAIL=$((FAIL+1)); }
warn() { echo "⚠️ $*"; WARN=$((WARN+1)); }
section() { echo ""; echo "=== $* ==="; }
run() { bash "$REMOTE" "$1" "${@:2}"; }
run_root() { bash "$REMOTE" "$1-root" "${@:2}"; }
# =============================================================================
section "1. Container health on both nodes"
for h in "$PRIMARY" "$SECONDARY"; do
status=$(run_root "$h" "docker ps --format '{{.Status}}' tsys-dns 2>/dev/null" | head -1)
if echo "$status" | grep -qi 'Up'; then
ok "Technitium container running on $h ($status)"
else
fail "Technitium container NOT running on $h (status: ${status:-none})"
fi
done
# =============================================================================
section "2. Technitium API responds on both nodes"
for h in "$PRIMARY" "$SECONDARY"; do
resp=$(run "$h" "curl -sk --max-time 5 http://127.0.0.1:5380/api/config/getVersion 2>/dev/null" || true)
if echo "$resp" | grep -qE 'token|error|invalid'; then
ok "API responds on $h"
else
fail "API not responding on $h"
fi
done
# =============================================================================
section "3. Zone count matches between primary and production"
# Count zones from the container on each host
count_zones() {
local host="$1"
run_root "$host" "docker exec tsys-dns sh -c 'ls /etc/dns/zones/ 2>/dev/null | wc -l'" 2>/dev/null | tr -d '[:space:]'
}
prod_zones=$(count_zones "$PROD")
pri_zones=$(count_zones "$PRIMARY")
sec_zones=$(count_zones "$SECONDARY")
echo " Production zones: $prod_zones"
echo " Primary (01) zones: $pri_zones"
echo " Secondary (02) zones: $sec_zones"
[ "$prod_zones" -gt 0 ] 2>/dev/null && ok "Production has $prod_zones zones" || fail "Production zone count invalid"
[ "$pri_zones" -gt 0 ] 2>/dev/null && ok "Primary has $pri_zones zones" || fail "Primary zone count invalid"
[ "$sec_zones" -gt 0 ] 2>/dev/null && ok "Secondary has $sec_zones zones" || fail "Secondary zone count invalid"
if [ "$pri_zones" = "$prod_zones" ]; then
ok "Primary zone count matches production ($pri_zones)"
else
warn "Primary zone count ($pri_zones) differs from production ($prod_zones)"
fi
if [ "$sec_zones" = "$pri_zones" ]; then
ok "Secondary zone count matches primary ($sec_zones)"
else
warn "Secondary zone count ($sec_zones) differs from primary ($pri_zones) — may still be transferring"
fi
# =============================================================================
section "4. knel.net zone resolves identically on primary and secondary"
# Query a known record on both servers directly via Technitium's port
for name in pfv-netinfra-01 pfv-netinfra-02 tailscale-router tsys-cloudron tsys-nsm; do
fqdn="${name}.knel.net"
# Query via dig against each Technitium instance (through Pi-hole on :53)
pri_ans=$(run "$PRIMARY" "dig +short +time=3 +tries=1 @127.0.0.1 -p 53 $fqdn A 2>/dev/null | head -1" 2>/dev/null || true)
sec_ans=$(run "$SECONDARY" "dig +short +time=3 +tries=1 @127.0.0.1 -p 53 $fqdn A 2>/dev/null | head -1" 2>/dev/null || true)
if [ -n "$pri_ans" ] && [ "$pri_ans" = "$sec_ans" ]; then
ok "$fqdn resolves identically: $pri_ans"
elif [ -n "$pri_ans" ] && [ -z "$sec_ans" ]; then
warn "$fqdn: primary=$pri_ans secondary=<no answer> (may still be syncing)"
elif [ -z "$pri_ans" ] && [ -z "$sec_ans" ]; then
warn "$fqdn: no answer on either server"
else
fail "$fqdn MISMATCH: primary=$pri_ans secondary=$sec_ans"
fi
done
# =============================================================================
section "5. External DNS resolution works on both nodes"
for h in "$PRIMARY" "$SECONDARY"; do
ans=$(run "$h" "dig +short +time=3 +tries=1 @127.0.0.1 -p 53 github.com A 2>/dev/null | head -1" 2>/dev/null || true)
if [ -n "$ans" ]; then
ok "$h resolves github.com → $ans"
else
fail "$h cannot resolve github.com"
fi
done
# =============================================================================
section "6. Zone transfer (AXFR) from primary to secondary"
# Test AXFR of knel.net from the primary
axfr=$(run "$SECONDARY" "dig +short +time=5 +tries=1 @${PRIMARY_IP} -p ${TECH_PORT} knel.net AXFR 2>/dev/null | wc -l" 2>/dev/null || echo "0")
if [ "$axfr" -gt 1 ] 2>/dev/null; then
ok "AXFR of knel.net from primary succeeds ($axfr records transferred)"
else
warn "AXFR test returned $axfr records — zone transfer may be restricted or in progress"
fi
# =============================================================================
section "7. Reverse DNS works"
# Pick a known reverse zone and test PTR resolution
ptr_test="181.103.100.in-addr.arpa"
ptr_ans=$(run "$PRIMARY" "dig +short +time=3 +tries=1 @127.0.0.1 -p 53 $ptr_test SOA 2>/dev/null | head -1" 2>/dev/null || true)
if [ -n "$ptr_ans" ]; then
ok "Reverse zone $ptr_test has SOA on primary"
else
warn "Reverse zone $ptr_test: no SOA on primary"
fi
ptr_ans2=$(run "$SECONDARY" "dig +short +time=3 +tries=1 @127.0.0.1 -p 53 $ptr_test SOA 2>/dev/null | head -1" 2>/dev/null || true)
if [ -n "$ptr_ans2" ]; then
ok "Reverse zone $ptr_test has SOA on secondary"
else
warn "Reverse zone $ptr_test: no SOA on secondary"
fi
# =============================================================================
section "8. Production untouched (read-only verification)"
# Verify production container is still running and unchanged
prod_status=$(run_root "$PROD" "docker ps --format '{{.Status}}' tsys-dns 2>/dev/null" | head -1)
if echo "$prod_status" | grep -qi 'Up'; then
ok "Production container still running on $PROD ($prod_status)"
else
fail "Production container NOT running on $PROD!"
fi
prod_zones_after=$(count_zones "$PROD")
if [ "$prod_zones_after" = "$prod_zones" ]; then
ok "Production zone count unchanged ($prod_zones_after = $prod_zones before)"
else
fail "Production zone count CHANGED: $prod_zones → $prod_zones_after"
fi
# =============================================================================
section "9. Failover test"
# Take the approach of querying via the secondary when primary is slow/unavailable.
# We test that the secondary answers independently.
sec_soa=$(run "$SECONDARY" "dig +short +time=3 +tries=1 @127.0.0.1 -p 53 knel.net SOA 2>/dev/null | head -1" 2>/dev/null || true)
if [ -n "$sec_soa" ]; then
ok "Secondary independently serves knel.net SOA: $sec_soa"
else
fail "Secondary cannot serve knel.net SOA independently"
fi
# =============================================================================
section "10. Credentials check — auth.config size matches production"
prod_auth_size=$(run_root "$PROD" "docker exec tsys-dns wc -c < /etc/dns/auth.config 2>/dev/null" | tr -d '[:space:]')
pri_auth_size=$(run_root "$PRIMARY" "docker exec tsys-dns wc -c < /etc/dns/auth.config 2>/dev/null" | tr -d '[:space:]')
sec_auth_size=$(run_root "$SECONDARY" "docker exec tsys-dns wc -c < /etc/dns/auth.config 2>/dev/null" | tr -d '[:space:]')
echo " auth.config sizes — prod=$prod_auth_size pri=$pri_auth_size sec=$sec_auth_size"
if [ "$prod_auth_size" = "$pri_auth_size" ] && [ "$prod_auth_size" = "$sec_auth_size" ]; then
ok "auth.config identical size across all three nodes (credentials + 2FA replicated)"
else
fail "auth.config sizes differ — credentials may not be replicated correctly"
fi
# =============================================================================
# Summary
echo ""
echo "=========================================="
echo " PASSED: $PASS"
echo " FAILED: $FAIL"
echo " WARNED: $WARN"
echo "=========================================="
[ "$FAIL" -eq 0 ] && exit 0 || exit 1
archive/KNELServerBuild/logs/.gitignore
+2
View File
@@ -0,0 +1,2 @@
*
!.gitignore
scripts/check-rules.sh
+3 -1
View File
@@ -226,7 +226,9 @@ fi
# ----------------------------------------------------------------------------
$RULE_VERBOSE && log_step "File hygiene"
if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
CONFLICT="$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | xargs -r grep -lE '^(<<<<<<<|=======|>>>>>>>)' 2>/dev/null || true)"
# archive/ excluded: legacy files are preserved verbatim and may contain
# decorative `====` banners that false-positive as conflict markers.
CONFLICT="$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -v '^archive/' | xargs -r grep -lE '^(<<<<<<<|=======|>>>>>>>)' 2>/dev/null || true)"
if [ -z "$CONFLICT" ]; then check "No merge-conflict markers staged" "pass"; else check "Merge-conflict markers staged: $CONFLICT" "fail"; fi
fi