fix(bootstrap): sudo path for cloudron/siem + per-host log capture
- Split into sudo vs su escalation methods: sudo: cloudron + siem (Ubuntu Server, no root password) su: everything else (root has password) - Capture full output to bootstrap-logs/<name>.log for debugging - Show last 5 lines on screen, full log for agent review Refs [#403] 💘 Generated with Crush Assisted-by: Crush:glm-5.2
This commit is contained in:
+86
-30
@@ -1,72 +1,128 @@
|
||||
#!/usr/bin/bash
|
||||
# bootstrap-all.sh — push agent key + sudo to every remaining NO-KEY system.
|
||||
#
|
||||
# Groups (user determined by system type):
|
||||
# 1. subodev → subopi* systems
|
||||
# 2. ultixfield → ultix-field
|
||||
# 3. localuser → everything else (cloudron, siem, ubuntu server, kali, etc.)
|
||||
# Two escalation methods:
|
||||
# sudo → localuser has sudo, no root password (Ubuntu Server: cloudron, siem)
|
||||
# su → root has a password (everything else)
|
||||
#
|
||||
# Captures per-host logs to bootstrap-logs/ for debugging.
|
||||
# You'll enter passwords interactively. Idempotent: safe to re-run.
|
||||
set -u
|
||||
cd "$(dirname "$0")" || exit 1
|
||||
|
||||
SCRIPT=agent-bootstrap.sh
|
||||
SSH_OPTS=(-o StrictHostKeyChecking=accept-new -o ConnectTimeout=10)
|
||||
LOGDIR="bootstrap-logs"
|
||||
mkdir -p "$LOGDIR"
|
||||
|
||||
ok=0; fail=0; faillist=""
|
||||
|
||||
run_as_user() {
|
||||
run_with_sudo() {
|
||||
local name="$1" ip="$2" user="$3"
|
||||
local logfile="${LOGDIR}/${name}.log"
|
||||
echo "========================================"
|
||||
echo " $name ($ip) — $user"
|
||||
echo " $name ($ip) — $user (sudo)"
|
||||
echo "========================================"
|
||||
if scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" 2>/dev/null; then
|
||||
if ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" 'su -c "bash /tmp/'"$SCRIPT"'"'; then
|
||||
echo " -> $name DONE"; ok=$((ok+1))
|
||||
{
|
||||
echo "=== $name ($ip) — $user via sudo ==="
|
||||
echo "Date: $(date)"
|
||||
echo
|
||||
if scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" 2>&1; then
|
||||
if ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "sudo bash /tmp/$SCRIPT" 2>&1; then
|
||||
echo
|
||||
echo "RESULT: $name DONE"
|
||||
else
|
||||
echo " -> $name FAILED (su to root)"; fail=$((fail+1)); faillist="$faillist $name"
|
||||
echo
|
||||
echo "RESULT: $name FAILED (sudo)"
|
||||
fi
|
||||
else
|
||||
echo " -> $name FAILED (${user} SSH/password)"; fail=$((fail+1)); faillist="$faillist $name"
|
||||
echo "RESULT: $name FAILED (${user} SSH/password)"
|
||||
fi
|
||||
} > "$logfile" 2>&1
|
||||
tail -5 "$logfile"
|
||||
if grep -q "RESULT: $name DONE" "$logfile"; then
|
||||
ok=$((ok+1))
|
||||
else
|
||||
fail=$((fail+1)); faillist="$faillist $name"
|
||||
fi
|
||||
echo " (full log: $logfile)"
|
||||
echo
|
||||
}
|
||||
|
||||
# === Group 1: subodev (subopi*) ===
|
||||
run_with_su() {
|
||||
local name="$1" ip="$2" user="$3"
|
||||
local logfile="${LOGDIR}/${name}.log"
|
||||
echo "========================================"
|
||||
echo " $name ($ip) — $user (su)"
|
||||
echo "========================================"
|
||||
{
|
||||
echo "=== $name ($ip) — $user via su ==="
|
||||
echo "Date: $(date)"
|
||||
echo
|
||||
if scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" 2>&1; then
|
||||
if ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" 'su -c "bash /tmp/'"$SCRIPT"'"' 2>&1; then
|
||||
echo
|
||||
echo "RESULT: $name DONE"
|
||||
else
|
||||
echo
|
||||
echo "RESULT: $name FAILED (su)"
|
||||
fi
|
||||
else
|
||||
echo "RESULT: $name FAILED (${user} SSH/password)"
|
||||
fi
|
||||
} > "$logfile" 2>&1
|
||||
tail -5 "$logfile"
|
||||
if grep -q "RESULT: $name DONE" "$logfile"; then
|
||||
ok=$((ok+1))
|
||||
else
|
||||
fail=$((fail+1)); faillist="$faillist $name"
|
||||
fi
|
||||
echo " (full log: $logfile)"
|
||||
echo
|
||||
}
|
||||
|
||||
# === Group 1: subodev via su ===
|
||||
echo "########################################"
|
||||
echo "# Group 1: subodev (subopi*)"
|
||||
echo "########################################"
|
||||
echo
|
||||
run_as_user subopi3 100.93.17.77 subodev
|
||||
run_as_user subopi-dev-3 100.64.231.65 subodev
|
||||
run_as_user subopi-dev-4 100.65.224.85 subodev
|
||||
run_with_su subopi3 100.93.17.77 subodev
|
||||
run_with_su subopi-dev-3 100.64.231.65 subodev
|
||||
run_with_su subopi-dev-4 100.65.224.85 subodev
|
||||
|
||||
# === Group 2: ultixfield ===
|
||||
# === Group 2: ultixfield via su ===
|
||||
echo "########################################"
|
||||
echo "# Group 2: ultixfield"
|
||||
echo "########################################"
|
||||
echo
|
||||
run_as_user ultix-field 100.115.233.124 ultixfield
|
||||
run_with_su ultix-field 100.115.233.124 ultixfield
|
||||
|
||||
# === Group 3: localuser (everything else) ===
|
||||
# === Group 3: localuser + sudo (Ubuntu Server: cloudron, siem — no root password) ===
|
||||
echo "########################################"
|
||||
echo "# Group 3: localuser (standard systems)"
|
||||
echo "# Group 3: localuser + sudo (cloudron, siem)"
|
||||
echo "########################################"
|
||||
echo
|
||||
run_as_user devbox-cloudron 100.119.72.25 localuser
|
||||
run_as_user kali-tsys 100.82.30.115 localuser
|
||||
run_as_user pfv-jetson-nano-1 100.82.230.119 localuser
|
||||
run_as_user pfvsvrpi 100.91.151.113 localuser
|
||||
run_as_user preprod-cloudron 100.95.69.89 localuser
|
||||
run_as_user preprod-hfnoc-uisp 100.77.14.7 localuser
|
||||
run_as_user preprod-siem 100.98.162.14 localuser
|
||||
run_as_user sectestbed-cloudron 100.97.140.105 localuser
|
||||
run_as_user sectestbed-siem 100.108.121.18 localuser
|
||||
run_as_user tsys-siem 100.72.35.113 localuser
|
||||
run_with_sudo devbox-cloudron 100.119.72.25 localuser
|
||||
run_with_sudo preprod-cloudron 100.95.69.89 localuser
|
||||
run_with_sudo sectestbed-cloudron 100.97.140.105 localuser
|
||||
run_with_sudo preprod-siem 100.98.162.14 localuser
|
||||
run_with_sudo sectestbed-siem 100.108.121.18 localuser
|
||||
run_with_sudo tsys-siem 100.72.35.113 localuser
|
||||
|
||||
# === Group 4: localuser + su (root has password) ===
|
||||
echo "########################################"
|
||||
echo "# Group 4: localuser + su (root password)"
|
||||
echo "########################################"
|
||||
echo
|
||||
run_with_su kali-tsys 100.82.30.115 localuser
|
||||
run_with_su pfv-jetson-nano-1 100.82.230.119 localuser
|
||||
run_with_su pfvsvrpi 100.91.151.113 localuser
|
||||
run_with_su preprod-hfnoc-uisp 100.77.14.7 localuser
|
||||
|
||||
echo "========================================"
|
||||
echo "Summary: $ok done, $fail failed"
|
||||
[ -n "$faillist" ] && echo "Failed:$faillist"
|
||||
echo "Logs in: $LOGDIR/"
|
||||
echo "========================================"
|
||||
echo "Blocked — need console work (separate tickets):"
|
||||
echo " tsys-ucs-01, tsys-ucs-02 — remove 2FA first [#418]"
|
||||
@@ -75,4 +131,4 @@ echo "========================================"
|
||||
echo "2FA by design (leave alone):"
|
||||
echo " sectestbed-sandbox"
|
||||
echo "========================================"
|
||||
echo "Tell the agent to re-run access-matrix.sh to verify."
|
||||
echo "Tell the agent to re-run access-matrix.sh + check logs to verify."
|
||||
|
||||
Reference in New Issue
Block a user