KNEL/PFVCluster
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(bootstrap): simplify — remove log redirect that broke interactive passwords

Browse Source 
Replace complex log-capture with direct scp+ssh+ssh -t calls so password
prompts work at the terminal. Same sudo/su split per system type.

Refs [#403]

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
mrcharles
2026-08-10 15:10:27 -05:00
parent d648bfeda2
commit 894acd626e
1 changed files with 15 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bootstrap-all.sh
+15 -79
View File
@@ -2,106 +2,49 @@
# bootstrap-all.sh — push agent key + sudo to every remaining NO-KEY system.
#
# Two escalation methods:
# sudo → localuser has sudo, no root password (Ubuntu Server: cloudron, siem)
# su → root has a password (everything else)
# sudo → Ubuntu Server systems (cloudron, siem) — no root password
# su → everything else — root has a password
#
# Captures per-host logs to bootstrap-logs/ for debugging.
# You'll enter passwords interactively. Idempotent: safe to re-run.
set -u
cd "$(dirname "$0")" || exit 1
SCRIPT=agent-bootstrap.sh
SSH_OPTS=(-o StrictHostKeyChecking=accept-new -o ConnectTimeout=10)
LOGDIR="bootstrap-logs"
mkdir -p "$LOGDIR"
ok=0; fail=0; faillist=""
run_with_sudo() {
local name="$1" ip="$2" user="$3"
local logfile="${LOGDIR}/${name}.log"
echo "========================================"
echo " $name ($ip) — $user (sudo)"
echo "========================================"
{
echo "=== $name ($ip) — $user via sudo ==="
echo "Date: $(date)"
echo
if scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" 2>&1; then
if ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "sudo bash /tmp/$SCRIPT" 2>&1; then
echo
echo "RESULT: $name DONE"
else
echo
echo "RESULT: $name FAILED (sudo)"
fi
else
echo "RESULT: $name FAILED (${user} SSH/password)"
fi
} > "$logfile" 2>&1
tail -5 "$logfile"
if grep -q "RESULT: $name DONE" "$logfile"; then
ok=$((ok+1))
else
fail=$((fail+1)); faillist="$faillist $name"
fi
echo " (full log: $logfile)"
scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" \
&& ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "sudo bash /tmp/$SCRIPT" \
&& echo " -> $name DONE" \
|| echo " -> $name FAILED"
echo
}
run_with_su() {
local name="$1" ip="$2" user="$3"
local logfile="${LOGDIR}/${name}.log"
echo "========================================"
echo " $name ($ip) — $user (su)"
echo "========================================"
{
echo "=== $name ($ip) — $user via su ==="
echo "Date: $(date)"
echo
if scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" 2>&1; then
if ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" 'su -c "bash /tmp/'"$SCRIPT"'"' 2>&1; then
echo
echo "RESULT: $name DONE"
else
echo
echo "RESULT: $name FAILED (su)"
fi
else
echo "RESULT: $name FAILED (${user} SSH/password)"
fi
} > "$logfile" 2>&1
tail -5 "$logfile"
if grep -q "RESULT: $name DONE" "$logfile"; then
ok=$((ok+1))
else
fail=$((fail+1)); faillist="$faillist $name"
fi
echo " (full log: $logfile)"
scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" \
&& ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "su -c 'bash /tmp/$SCRIPT'" \
&& echo " -> $name DONE" \
|| echo " -> $name FAILED"
echo
}
# === Group 1: subodev via su ===
echo "########################################"
echo "# Group 1: subodev (subopi*)"
echo "########################################"
echo
# === subodev via su ===
run_with_su subopi3 100.93.17.77 subodev
run_with_su subopi-dev-3 100.64.231.65 subodev
run_with_su subopi-dev-4 100.65.224.85 subodev
# === Group 2: ultixfield via su ===
echo "########################################"
echo "# Group 2: ultixfield"
echo "########################################"
echo
# === ultixfield via su ===
run_with_su ultix-field 100.115.233.124 ultixfield
# === Group 3: localuser + sudo (Ubuntu Server: cloudron, siem — no root password) ===
echo "########################################"
echo "# Group 3: localuser + sudo (cloudron, siem)"
echo "########################################"
echo
# === localuser + sudo (Ubuntu Server: cloudron, siem — no root password) ===
run_with_sudo devbox-cloudron 100.119.72.25 localuser
run_with_sudo preprod-cloudron 100.95.69.89 localuser
run_with_sudo sectestbed-cloudron 100.97.140.105 localuser
@@ -109,20 +52,14 @@ run_with_sudo preprod-siem 100.98.162.14 localuser
run_with_sudo sectestbed-siem 100.108.121.18 localuser
run_with_sudo tsys-siem 100.72.35.113 localuser
# === Group 4: localuser + su (root has password) ===
echo "########################################"
echo "# Group 4: localuser + su (root password)"
echo "########################################"
echo
# === localuser + su (root has password) ===
run_with_su kali-tsys 100.82.30.115 localuser
run_with_su pfv-jetson-nano-1 100.82.230.119 localuser
run_with_su pfvsvrpi 100.91.151.113 localuser
run_with_su preprod-hfnoc-uisp 100.77.14.7 localuser
echo "========================================"
echo "Summary: $ok done, $fail failed"
[ -n "$faillist" ] && echo "Failed:$faillist"
echo "Logs in: $LOGDIR/"
echo "Done. Tell the agent to re-run access-matrix.sh to verify."
echo "========================================"
echo "Blocked — need console work (separate tickets):"
echo " tsys-ucs-01, tsys-ucs-02 — remove 2FA first [#418]"
@@ -131,4 +68,3 @@ echo "========================================"
echo "2FA by design (leave alone):"
echo " sectestbed-sandbox"
echo "========================================"
echo "Tell the agent to re-run access-matrix.sh + check logs to verify."