KNEL/PFVCluster
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(access-matrix): use correct user per system type + targeted sudo check

Browse Source 
Replace generic root→localuser fallback with explicit user mapping:
- Proxmox hosts/appliances → root (no sudo check)
- stlpc-* → labuser (no sudo)
- subopi* → subodev (with sudo check)
- everything else → localuser (with sudo check)

Refs [#403]

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
mrcharles
2026-08-10 14:16:19 -05:00
parent b909cd5afb
commit 95ad74a068
1 changed files with 39 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
access-matrix.sh
+39 -23
View File
@@ -1,6 +1,6 @@
#!/usr/bin/bash #!/usr/bin/bash
# access-matrix.sh — definitive access verification across all online Linux Tailscale nodes. # access-matrix.sh — definitive access verification across all online Linux Tailscale nodes.
# For each node: try root SSH, then localuser SSH; report access level. # Uses the correct SSH user per system type, checks sudo where applicable.
# Routes through remote.sh (the only allowed ssh path). # Routes through remote.sh (the only allowed ssh path).
set -u set -u
cd /home/reachableceo/projects/PFVCluster || exit 1 cd /home/reachableceo/projects/PFVCluster || exit 1
@@ -8,31 +8,47 @@ cd /home/reachableceo/projects/PFVCluster || exit 1
# Policy-excluded systems (never attempt access) # Policy-excluded systems (never attempt access)
EXCLUDE=':tsys-cloudron:pfv-bms:tsys-umbrel:stlpc-bizoffice:ultix-highside:' EXCLUDE=':tsys-cloudron:pfv-bms:tsys-umbrel:stlpc-bizoffice:ultix-highside:'
printf '%-28s %-16s %-18s %s\n' "NAME" "TS-IP" "ACCESS" "SUDO" # Determine the SSH user for a given hostname.
printf '%-28s %-16s %-18s %s\n' "----" "-----" "------" "----" # Returns "user:sudo" where sudo is "yes" or "no".
user_for() {
local name="$1"
case "$name" in
pfv-tsys[0-9]) echo "root:no" ;;
*-proxmox-datacenter) echo "root:no" ;;
*-proxmox-pve) echo "root:no" ;;
*-proxmox-pbs) echo "root:no" ;;
*-proxmox-mailgw*) echo "root:no" ;;
*-proxmox-backup*) echo "root:no" ;;
stlpc-*) echo "labuser:no" ;;
subopi*) echo "subodev:yes" ;;
*) echo "localuser:yes" ;;
esac
}
printf '%-32s %-16s %-12s %-8s\n' "NAME" "TS-IP" "ACCESS" "SUDO"
printf '%-32s %-16s %-12s %-8s\n' "----" "-----" "------" "----"
tailscale status 2>/dev/null | awk '$4=="linux" && $0 !~ /offline/ {print $2, $1}' | sort | while read -r name ip; do tailscale status 2>/dev/null | awk '$4=="linux" && $0 !~ /offline/ {print $2, $1}' | sort | while read -r name ip; do
[ -n "$name" ] || continue [ -n "$name" ] || continue
case "$EXCLUDE" in *":$name:"*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "EXCLUDED"; continue;; esac case "$EXCLUDE" in *":$name:"*) printf '%-32s %-16s %-12s\n' "$name" "$ip" "EXCLUDED"; continue;; esac
# Try root map=$(user_for "$name")
rout=$(VM_IP="$ip" VM_USER="root" bash tests/remote.sh vm 'echo OK; id -un' </dev/null 2>&1 | tr '\n' '/') user="${map%%:*}"; expect_sudo="${map##*:}"
case "$rout" in
*OK/root*) sudo=$(VM_IP="$ip" VM_USER="root" bash tests/remote.sh vm 'sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO' </dev/null 2>&1 | tr -d '\n') out=$(VM_IP="$ip" VM_USER="$user" bash tests/remote.sh vm 'echo SSHOK; id -un' </dev/null 2>&1 | tr '\n' '/')
printf '%-28s %-16s %-18s %s\n' "$name" "$ip" "root-SSH" "${sudo:-?}"; continue;; case "$out" in
esac *SSHOK*)
# Try localuser if [ "$expect_sudo" = "yes" ]; then
lout=$(VM_IP="$ip" VM_USER="localuser" bash tests/remote.sh vm 'echo OK; id -un' </dev/null 2>&1 | tr '\n' '/') sudo=$(VM_IP="$ip" VM_USER="$user" bash tests/remote.sh vm 'sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO' </dev/null 2>&1 | tr -d '\n')
case "$lout" in printf '%-32s %-16s %-12s %-8s\n' "$name" "$ip" "${user}-SSH" "${sudo:-?}"
*OK/localuser*) sudo=$(VM_IP="$ip" VM_USER="localuser" bash tests/remote.sh vm 'sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO' </dev/null 2>&1 | tr -d '\n') else
printf '%-28s %-16s %-18s %s\n' "$name" "$ip" "localuser-SSH" "${sudo:-?}"; continue;; printf '%-32s %-16s %-12s %-8s\n' "$name" "$ip" "${user}-SSH" "n/a"
esac fi
# Neither — classify the failure ;;
case "$rout" in *keyboard-interactive*) printf '%-32s %-16s %-12s\n' "$name" "$ip" "2FA-blocked" ;;
*Connection\ refused*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "NO-SSH(port22)";; *Connection\ refused*) printf '%-32s %-16s %-12s\n' "$name" "$ip" "NO-SSH(22)" ;;
*keyboard-interactive*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "2FA-blocked";; *Permission\ denied*) printf '%-32s %-16s %-12s\n' "$name" "$ip" "NO-KEY" ;;
*Permission\ denied*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "NO-KEY";; *No\ route*) printf '%-32s %-16s %-12s\n' "$name" "$ip" "UNREACHABLE" ;;
*No\ route*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "UNREACHABLE";; *) printf '%-32s %-16s %-12s\n' "$name" "$ip" "NO-KEY" ;;
*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "NO-KEY";;
esac esac
done done