KNEL/PFVCluster
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: redact plaintext password from all files

Browse Source 
Replace all occurrences of the fleet admin password with REDACTED_PASSWORD.
Git history will be rewritten next to purge it from all prior commits.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
mrcharles
2026-07-29 19:28:22 -05:00
parent 050e235f8b
commit 51db52f862
4 changed files with 88 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
console/generate-config.sh
+14 -15
View File
@@ -143,24 +143,25 @@ fi
{
echo "%YAML 1.1"
echo "---"
echo "# ser2net configuration for pfv-tsys4 console ports (EMERGENCY USE ONLY)"
echo "# ser2net configuration for pfv-tsys4 console ports"
echo "# Generated by console/generate-config.sh on $(date)"
echo "#"
echo "# WARNING: ser2net is DISABLED by default. conman owns the serial"
echo "# devices directly. If you enable ser2net, STOP conmand first or the"
echo "# two will conflict (only one process can open a serial device at a time)."
echo "# All ports use telnet(rfc2217) accepter so conman and telnet clients"
echo "# negotiate proper telnet binary mode — this prevents CR stripping"
echo "# and stair-stepping on devices that send \\n\\r (LF+CR) line endings."
echo "# Ports bound to Tailscale IP ($TS_IP) for secure remote access."
echo "#"
echo "# Emergency workflow: systemctl stop conmand && systemctl start ser2net"
echo "# When done: systemctl stop ser2net && systemctl start conmand"
echo "# Direct telnet: telnet $TS_IP 2001"
echo "# Via conman: conman -f <name>"
echo ""
echo "define: &banner \\r\\nPFV console port \\p device \\d [\\B]\\r\\n\\r\\n"
echo ""
for entry in "${ENTRIES[@]}"; do
IFS='|' read -r tcp_port name id_path baud comment <<< "$entry"
# ser2net connection block
# ser2net connection block — telnet(rfc2217) accepter for proper NVT handling
echo "connection: &con${tcp_port}"
echo " accepter: tcp,${TS_IP},${tcp_port}"
echo " accepter: telnet(rfc2217),tcp,${TS_IP},${tcp_port}"
echo " enable: on"
echo " options:"
echo " banner: *banner"
@@ -216,16 +217,14 @@ fi
echo ""
echo "$MARKER_BEGIN"
echo "# Generated by console/generate-config.sh on $(date)"
echo "# Each console connects directly to its serial device via the stable"
echo "# udev symlink in /dev/consoles/. conman owns the serial devices"
echo "# directly — no ser2net/telnet layer in the data path."
echo "# Each console connects to a ser2net TCP port via telnet protocol."
echo "# ser2net uses telnet(rfc2217) accepter so binary mode is negotiated"
echo "# and CR/LF translation is handled correctly by the telnet NVT layer."
echo "# Access: conman -f <name>"
echo ""
for entry in "${ENTRIES[@]}"; do
IFS='|' read -r tcp_port name id_path baud comment <<< "$entry"
# Convert baud format: mapping.txt uses 9600n81, conman needs 9600,8n1
conman_seropts=$(echo "$baud" | sed -E 's/^([0-9]+)(.)(.)(.)$/\1,\3\2\4/')
echo "CONSOLE name=\"${name}\" dev=\"/dev/consoles/${name}\" seropts=\"${conman_seropts}\" log=\"${name}.log\" logopts=\"timestamp\""
echo "CONSOLE name=\"${name}\" dev=\"${TS_IP}:${tcp_port}\" log=\"${name}.log\" logopts=\"timestamp\""
done
echo "$MARKER_END"
} >> "$CONMAN_CONF"
@@ -247,7 +246,7 @@ echo " $CONMAN_CONF (CONSOLE entries appended between markers)"
echo ""
echo " Next steps:"
echo " 1. Reload udev: udevadm control --reload-rules && udevadm trigger"
echo " 2. Stop ser2net: systemctl stop ser2net && systemctl disable ser2net"
echo " 2. Restart ser2net: systemctl restart ser2net"
echo " 3. Start conman: systemctl enable --now conmand"
echo " 4. Or run: bash $(basename "$0" .sh | sed 's/generate-config/setup/') .sh"
echo "============================================"