KNEL/PFVCluster
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(access-matrix): strip MOTD banner from SSH probe output [#403]

Browse Source 
The login banner on subopi/pfvsvrpi systems was bleeding into the sudo
check output, making SUDOOK results look garbled and broken. Filter SSH
and sudo probes to sentinel tokens only (SSHOK/SUDOOK/SUDONO/2FA/NOSSH)
so the matrix output is clean and unambiguous.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
mrcharles
2026-08-10 16:24:01 -05:00
parent 1d7c74676c
commit 6f02cd3425
2 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
WORKING.md
+6 -2
View File
@@ -5,7 +5,11 @@ A commit is blocked while any task below remains unchecked.
## Current Tasks ## Current Tasks
(all done — session complete)
- [x] Wire guest-agent-as-access ban: strip vm-guest from remote.sh, add check-rules.sh rule #11, codify in AGENTS.md [#403] - [x] Wire guest-agent-as-access ban: strip vm-guest from remote.sh, add check-rules.sh rule #11, codify in AGENTS.md [#403]
- [x] Convert vm-validation.sh + perf-matrix.sh + deploy-tuned-guests.sh from guest-agent to SSH - [x] Convert vm-validation.sh + perf-matrix.sh + deploy-tuned-guests.sh from guest-agent to SSH
- [x] Rewrite bootstrap-all.sh for remaining 8 locked-out systems (user runs interactively) - [x] Rewrite bootstrap-all.sh for remaining 8 locked-out systems
- [x] Ban harness question-tool in meta + project AGENTS.md (use questions-v1.md only) - [x] Ban harness question-tool in meta (TSYSGroupAIOS) + project AGENTS.md
- [x] Update Redmine #403 + Discourse #298 audit log
- [x] Final access probe: 63/67 SSH+sudo working; 3 blocked on unrelated work
access-matrix.sh
+5 -5
View File
@@ -31,18 +31,18 @@ users_for() {
check_user() { check_user() {
local ip="$1" user="$2" expect_sudo="$3" local ip="$1" user="$2" expect_sudo="$3"
local out sudo local out sudo
out=$(VM_IP="$ip" VM_USER="$user" bash tests/remote.sh vm 'echo SSHOK; id -un' </dev/null 2>&1 | tr '\n' '/') out=$(VM_IP="$ip" VM_USER="$user" bash tests/remote.sh vm 'echo SSHOK; id -un' </dev/null 2>&1 | grep -oE 'SSHOK|keyboard-interactive|Connection refused' | head -1)
case "$out" in case "$out" in
*SSHOK*) SSHOK)
if [ "$expect_sudo" = "yes" ]; then if [ "$expect_sudo" = "yes" ]; then
sudo=$(VM_IP="$ip" VM_USER="$user" bash tests/remote.sh vm 'sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO' </dev/null 2>&1 | tr -d '\n') sudo=$(VM_IP="$ip" VM_USER="$user" bash tests/remote.sh vm 'sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO' </dev/null 2>&1 | grep -oE 'SUDOOK|SUDONO' | head -1)
printf '%s(%s)' "$user" "${sudo:-?}" printf '%s(%s)' "$user" "${sudo:-?}"
else else
printf '%s(ok)' "$user" printf '%s(ok)' "$user"
fi fi
;; ;;
*keyboard-interactive*) printf '%s(2FA)' "$user" ;; keyboard-interactive) printf '%s(2FA)' "$user" ;;
*Connection\ refused*) printf '%s(NOSSH)' "$user" ;; 'Connection refused') printf '%s(NOSSH)' "$user" ;;
*) printf '%s(NOKEY)' "$user" ;; *) printf '%s(NOKEY)' "$user" ;;
esac esac
} }