From b6f94483e5bb19f0bed69e7fad588f958b65e74d Mon Sep 17 00:00:00 2001 From: reachableceo Date: Tue, 28 Jul 2026 20:07:17 -0500 Subject: [PATCH] fix(console): enable conmand remote access + add conman client script MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit conmand was binding to localhost only (server loopback=on default), so the conman client on workstations couldn't connect. The intended workflow is: conman client (workstation) → conmand (pfv-tsys4:7890 over Tailscale) → ser2net (TCP 2001-2007) → serial device. Without remote conmand access, users had to telnet directly to ser2net, which conflicts with conmand's persistent connections (kickolduser kicks the telnet session immediately). Changes: - generate-config.sh: add server loopback=off to conman.conf so conmand listens on 0.0.0.0:7890 (reachable via Tailscale) - query-remote.sh: new script for workstations — installs conman client, verifies connectivity, lists or connects to consoles - README.md: clarify access model (conman primary, telnet emergency only with conmand stopped). Document the kickolduser conflict. 💘 Generated with Crush Assisted-by: Crush:glm-5.2 --- console/README.md | 30 ++++++++++++------ console/generate-config.sh | 6 ++++ console/query-remote.sh | 62 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 89 insertions(+), 9 deletions(-) create mode 100644 console/query-remote.sh diff --git a/console/README.md b/console/README.md index d73c88f..f0e1f50 100644 --- a/console/README.md +++ b/console/README.md @@ -64,18 +64,30 @@ All ports listen on the Tailscale IP (`100.70.77.93`). ### Connect to a console +**Primary method — conman client (with logging + multiplexing):** + ```bash -# Via conman (with logging + multiplexing): -conman -f pfv-core-sw01 # attach to console -conman -q # query status of all consoles - -# Via telnet (direct, no logging): -telnet 100.70.77.93 2001 # pfv-core-sw01 - -# From any Tailscale-connected device: -telnet pfv-tsys4 2001 +# From any Tailscale-connected workstation: +conman -d pfv-tsys4:7890 -f pfv-core-sw01 # connect to console +conman -d pfv-tsys4:7890 -q # list all consoles ``` +Escape sequence: `&.` to disconnect, `&?` for help. + +**Direct telnet (emergency only — conflicts with conman):** + +```bash +# Direct telnet to ser2net works ONLY when conmand is stopped, because +# conmand maintains persistent connections to all 7 TCP ports. Use: +ssh pfv-tsys4 'systemctl stop conmand' +telnet pfv-tsys4 2001 # pfv-core-sw01 +ssh pfv-tsys4 'systemctl start conmand' # restart when done +``` + +**Do NOT use telnet while conmand is running** — conmand will reconnect +and kick your telnet session immediately ("Connection closed by foreign host"). +The correct workflow is conman client → conmand → ser2net → device. + ### Re-deploy after changing mapping.txt ```bash diff --git a/console/generate-config.sh b/console/generate-config.sh index dee2971..4eb3f14 100644 --- a/console/generate-config.sh +++ b/console/generate-config.sh @@ -193,6 +193,12 @@ if ! grep -qiE '^\s*server\s+logdir\s*=' "$CONMAN_CONF" 2>/dev/null; then echo " Added server logdir = \"$CONMAN_LOGDIR\" to $CONMAN_CONF" fi +# Ensure loopback=off so conmand is reachable over Tailscale (not localhost-only) +if ! grep -qiE '^\s*server\s+loopback\s*=' "$CONMAN_CONF" 2>/dev/null; then + sed -i "/^server logdir/a server loopback=off" "$CONMAN_CONF" + echo " Added server loopback=off to $CONMAN_CONF (enables remote access)" +fi + # Remove any previous auto-generated block (between markers) # Then append the new block MARKER_BEGIN="# BEGIN PFV CONSOLE DEFINITIONS (auto-generated — do not edit between markers)" diff --git a/console/query-remote.sh b/console/query-remote.sh new file mode 100644 index 0000000..cd539e6 --- /dev/null +++ b/console/query-remote.sh @@ -0,0 +1,62 @@ +#!/usr/bin/bash +# +# console/query-remote.sh — install conman client and connect to a console +# on pfv-tsys4 over Tailscale. +# +# Usage: +# bash console/query-remote.sh # list consoles +# bash console/query-remote.sh pfv-core-sw01 # connect to a console +# +set -euo pipefail + +REMOTE_HOST="${REMOTE_HOST:-pfv-tsys4}" +REMOTE_PORT="${REMOTE_PORT:-7890}" + +echo "============================================" +echo " Conman Remote Console Access" +echo " Server: ${REMOTE_HOST}:${REMOTE_PORT} (Tailscale)" +echo "============================================" + +# --- 1. Install conman client if missing --- +if ! command -v conman >/dev/null 2>&1; then + echo "" + echo "--- Installing conman client ---" + if sudo -n true 2>/dev/null; then + sudo apt-get update -qq && sudo apt-get install -y -qq conman + else + echo " Passwordless sudo not available. Please run:" + echo " sudo apt-get update && sudo apt-get install -y conman" + echo " Then re-run this script." + exit 1 + fi +else + echo " conman client already installed." +fi + +# --- 2. Verify connectivity --- +echo "" +echo "--- Connectivity check ---" +if timeout 3 bash -c "echo > /dev/tcp/${REMOTE_HOST}/${REMOTE_PORT}" 2>/dev/null; then + echo " [OK] ${REMOTE_HOST}:${REMOTE_PORT} reachable" +else + echo " [FAIL] Cannot reach ${REMOTE_HOST}:${REMOTE_PORT}" + echo " Is Tailscale up? Is conmand running on ${REMOTE_HOST}?" + exit 1 +fi + +# --- 3. List or connect --- +CONSOLE="${1:-}" +if [ -z "$CONSOLE" ]; then + echo "" + echo "--- Available consoles ---" + conman -d "${REMOTE_HOST}:${REMOTE_PORT}" -q + echo "" + echo "To connect: bash $0 " + echo " e.g: bash $0 pfv-core-sw01" +else + echo "" + echo "--- Connecting to: $CONSOLE ---" + echo " Escape sequence: &. (to disconnect)" + echo "" + conman -d "${REMOTE_HOST}:${REMOTE_PORT}" -f "$CONSOLE" +fi