KNEL/PFVCluster
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(access): full ground-truth sweep + accurate bootstrap targeting

Browse Source 
access-matrix.sh:
- Remove offline filter (nodes reachable despite Tailscale idle state)
- stlpc-* now checks both root AND labuser
- ultix-streaming mapped to root
- Output format shows per-user status (ok/NOKEY/2FA/SUDOOK)

bootstrap-all.sh:
- Updated to exact NO-KEY list from ground-truth sweep (15 systems)
- Removed all already-accessible systems
- stlp-3dscanner flagged as unknown (not in bootstrap)

Refs [#403]

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
mrcharles
2026-08-10 14:22:25 -05:00
parent 95ad74a068
commit d4cbdf5ef4
2 changed files with 42 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bootstrap-all.sh
+8 -5
View File
@@ -2,9 +2,9 @@
# bootstrap-all.sh — push agent key + sudo to every remaining NO-KEY system.
#
# Groups (user determined by system type):
# 1. labuser → stlpc-* systems
# 2. subodev → subopi* systems
# 3. localuser → everything else (kali, cloudron, siem, ubuntu server, etc.)
# 1. labuser+root → stlpc-* systems (key to both, no sudo for labuser)
# 2. subodev → subopi* systems
# 3. localuser → everything else (cloudron, siem, ubuntu server, kali, etc.)
#
# You'll enter passwords interactively. Idempotent: safe to re-run.
set -u
@@ -32,7 +32,7 @@ run_as_user() {
echo
}
# === Group 1: labuser (stlpc-*) ===
# === Group 1: labuser (stlpc-* — agent-bootstrap pushes keys to root+labuser) ===
echo "########################################"
echo "# Group 1: labuser (stlpc-*)"
echo "########################################"
@@ -53,8 +53,8 @@ echo "########################################"
echo "# Group 3: localuser (standard systems)"
echo "########################################"
echo
run_as_user kali-tsys 100.82.30.115 localuser
run_as_user devbox-cloudron 100.119.72.25 localuser
run_as_user kali-tsys 100.82.30.115 localuser
run_as_user pfv-jetson-nano-1 100.82.230.119 localuser
run_as_user pfvsvrpi 100.91.151.113 localuser
run_as_user preprod-cloudron 100.95.69.89 localuser
@@ -72,4 +72,7 @@ echo "========================================"
echo "Still 2FA-blocked (need policy decision):"
echo " sectestbed-sandbox, tsys-ucs-01, tsys-ucs-02"
echo "========================================"
echo "Unknown user (not in bootstrap):"
echo " stlp-3dscanner (100.125.14.37) — need user clarification"
echo "========================================"
echo "Tell the agent to re-run access-matrix.sh to verify."