From 8e0a67fd2043c51d5c1ea03ef2b6b253e0c76ef5 Mon Sep 17 00:00:00 2001 From: reachableceo Date: Mon, 10 Aug 2026 16:36:55 -0500 Subject: [PATCH] fix(bootstrap): target only remaining system (tsys-siem) [#403] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Access validation shows 68/70 non-excluded systems at intended access state. Strip already-bootstrapped systems (devbox-cloudron, subopi3, subopi-dev-3/4, ultix-field, pfvsvrpi, sectestbed-cloudron) from the active list; tsys-siem is the sole remaining actionable target. 💘 Generated with Crush Assisted-by: Crush:glm-5.2 --- WORKING.md | 9 +++------ bootstrap-all.sh | 29 +++++++++++++---------------- 2 files changed, 16 insertions(+), 22 deletions(-) diff --git a/WORKING.md b/WORKING.md index 5c342b5..af35be1 100644 --- a/WORKING.md +++ b/WORKING.md @@ -7,9 +7,6 @@ A commit is blocked while any task below remains unchecked. (all done — session complete) -- [x] Wire guest-agent-as-access ban: strip vm-guest from remote.sh, add check-rules.sh rule #11, codify in AGENTS.md [#403] -- [x] Convert vm-validation.sh + perf-matrix.sh + deploy-tuned-guests.sh from guest-agent to SSH -- [x] Rewrite bootstrap-all.sh for remaining 8 locked-out systems -- [x] Ban harness question-tool in meta (TSYSGroupAIOS) + project AGENTS.md -- [x] Update Redmine #403 + Discourse #298 audit log -- [x] Final access probe: 63/67 SSH+sudo working; 3 blocked on unrelated work +- [x] Add NON-NEGOTIABLE session-start check-for-understanding gate to AGENTS.md +- [x] Run full end-to-end access validation (68/70 non-excluded at intended state) +- [x] Update bootstrap-all.sh to target only remaining system (tsys-siem) [#403] diff --git a/bootstrap-all.sh b/bootstrap-all.sh index ced5ea5..ef0a277 100644 --- a/bootstrap-all.sh +++ b/bootstrap-all.sh @@ -12,6 +12,9 @@ # # Passes AGENT_USER so agent-bootstrap.sh targets the correct unprivileged # user. You enter passwords interactively. Idempotent: safe to re-run. +# +# Verified state (access-matrix.sh, 2026-08-10): 68/70 non-excluded systems +# at intended access state. Only tsys-siem remains below. set -u cd "$(dirname "$0")" || exit 1 @@ -42,33 +45,27 @@ run_with_su() { echo } -# === localuser + sudo (password auth confirmed on) === -echo "### localuser + sudo ###" +# === REMAINING: localuser + sudo (password auth on, key not yet pushed) === +echo "### Remaining system: tsys-siem ###" echo -run_with_sudo tsys-siem 100.72.35.113 localuser -run_with_sudo sectestbed-cloudron 100.97.140.105 localuser - -# === subodev/ultixfield + su (password auth confirmed on) === -echo "### subodev/ultixfield + su ###" -echo -run_with_su subopi-dev-3 100.64.231.65 subodev subodev -run_with_su ultix-field 100.115.233.124 ultixfield ultixfield +run_with_sudo tsys-siem 100.72.35.113 localuser echo "========================================" echo "Done. Re-run access-matrix.sh to verify." echo "========================================" echo -echo "CONSOLE-ONLY — sshd rejects password auth (publickey-only)." -echo "Log in at the physical console (as root, or user then su/sudo)" -echo "and paste this ONE line:" +echo "CONSOLE-ONLY fallback — if tsys-siem rejects password auth" +echo "(publickey-only sshd), log in at the physical console (as root," +echo "or localuser then sudo) and paste this ONE line:" echo cat <<'ONELINER' KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWms/uCXnjjo4KyxHBcYI2TDHe8OZ2wle6W/0hSRQLu reachableceo@ultix-streaming'; for u in root localuser subodev ultixfield; do getent passwd "$u">/dev/null||continue; H=$(getent passwd "$u"|cut -d: -f6); mkdir -p "$H/.ssh"; chmod 700 "$H/.ssh"; AK="$H/.ssh/authorized_keys"; touch "$AK"; chmod 600 "$AK"; grep -qF "$KEY" "$AK"||echo "$KEY">>"$AK"; chown -R "$u": "$H/.ssh"; done; for u in localuser subodev ultixfield; do getent passwd "$u">/dev/null&&[ -d /etc/sudoers.d ]&&{ echo "$u ALL=(ALL) NOPASSWD:ALL">/etc/sudoers.d/010-agent; chmod 440 /etc/sudoers.d/010-agent; }; done; echo DONE ONELINER echo -echo " pfvsvrpi (localuser) — Raspberry Pi" -echo " subopi3 (subodev) — Raspberry Pi" -echo " subopi-dev-4 (subodev) — Raspberry Pi" +echo "========================================" +echo "Already bootstrapped (verified SUDOOK/root-ok via access-matrix):" +echo " devbox-cloudron, sectestbed-cloudron, subopi3, subopi-dev-3," +echo " subopi-dev-4, ultix-field, pfvsvrpi (+ 60 others)" echo "========================================" echo "Deferred (separate ticket):" echo " stlp-3dscanner — rename + bring online first [#417]"