mrcharles
8e0a67fd20
Access validation shows 68/70 non-excluded systems at intended access
state. Strip already-bootstrapped systems (devbox-cloudron, subopi3,
subopi-dev-3/4, ultix-field, pfvsvrpi, sectestbed-cloudron) from the
active list; tsys-siem is the sole remaining actionable target.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
80 lines
3.8 KiB
Bash
80 lines
3.8 KiB
Bash
#!/usr/bin/bash
|
|
# bootstrap-all.sh — push agent SSH key + passwordless sudo to remaining systems.
|
|
#
|
|
# SSH is the ONLY approved access channel (see AGENTS.md "Access-channel
|
|
# policy: SSH only"). This script reaches systems that still allow password
|
|
# auth over sshd. Systems that reject password auth (publickey-only) cannot
|
|
# be reached this way — see the CONSOLE-ONLY section printed at the end.
|
|
#
|
|
# Two escalation methods:
|
|
# sudo → Ubuntu-style systems (no root pw; localuser has sudo)
|
|
# su → Debian-style systems (root has a password)
|
|
#
|
|
# Passes AGENT_USER so agent-bootstrap.sh targets the correct unprivileged
|
|
# user. You enter passwords interactively. Idempotent: safe to re-run.
|
|
#
|
|
# Verified state (access-matrix.sh, 2026-08-10): 68/70 non-excluded systems
|
|
# at intended access state. Only tsys-siem remains below.
|
|
set -u
|
|
cd "$(dirname "$0")" || exit 1
|
|
|
|
SCRIPT=agent-bootstrap.sh
|
|
SSH_OPTS=(-o StrictHostKeyChecking=accept-new -o ConnectTimeout=10)
|
|
|
|
run_with_sudo() {
|
|
local name="$1" ip="$2" user="$3" agent_user="${4:-localuser}"
|
|
echo "========================================"
|
|
echo " $name ($ip) — $user (sudo, agent=${agent_user})"
|
|
echo "========================================"
|
|
scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" \
|
|
&& ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "sudo AGENT_USER=${agent_user} bash /tmp/$SCRIPT" \
|
|
&& echo " -> $name DONE" \
|
|
|| echo " -> $name FAILED"
|
|
echo
|
|
}
|
|
|
|
run_with_su() {
|
|
local name="$1" ip="$2" user="$3" agent_user="${4:-localuser}"
|
|
echo "========================================"
|
|
echo " $name ($ip) — $user (su, agent=${agent_user})"
|
|
echo "========================================"
|
|
scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" \
|
|
&& ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "su -c 'AGENT_USER=${agent_user} bash /tmp/$SCRIPT'" \
|
|
&& echo " -> $name DONE" \
|
|
|| echo " -> $name FAILED"
|
|
echo
|
|
}
|
|
|
|
# === REMAINING: localuser + sudo (password auth on, key not yet pushed) ===
|
|
echo "### Remaining system: tsys-siem ###"
|
|
echo
|
|
run_with_sudo tsys-siem 100.72.35.113 localuser
|
|
|
|
echo "========================================"
|
|
echo "Done. Re-run access-matrix.sh to verify."
|
|
echo "========================================"
|
|
echo
|
|
echo "CONSOLE-ONLY fallback — if tsys-siem rejects password auth"
|
|
echo "(publickey-only sshd), log in at the physical console (as root,"
|
|
echo "or localuser then sudo) and paste this ONE line:"
|
|
echo
|
|
cat <<'ONELINER'
|
|
KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWms/uCXnjjo4KyxHBcYI2TDHe8OZ2wle6W/0hSRQLu reachableceo@ultix-streaming'; for u in root localuser subodev ultixfield; do getent passwd "$u">/dev/null||continue; H=$(getent passwd "$u"|cut -d: -f6); mkdir -p "$H/.ssh"; chmod 700 "$H/.ssh"; AK="$H/.ssh/authorized_keys"; touch "$AK"; chmod 600 "$AK"; grep -qF "$KEY" "$AK"||echo "$KEY">>"$AK"; chown -R "$u": "$H/.ssh"; done; for u in localuser subodev ultixfield; do getent passwd "$u">/dev/null&&[ -d /etc/sudoers.d ]&&{ echo "$u ALL=(ALL) NOPASSWD:ALL">/etc/sudoers.d/010-agent; chmod 440 /etc/sudoers.d/010-agent; }; done; echo DONE
|
|
ONELINER
|
|
echo
|
|
echo "========================================"
|
|
echo "Already bootstrapped (verified SUDOOK/root-ok via access-matrix):"
|
|
echo " devbox-cloudron, sectestbed-cloudron, subopi3, subopi-dev-3,"
|
|
echo " subopi-dev-4, ultix-field, pfvsvrpi (+ 60 others)"
|
|
echo "========================================"
|
|
echo "Deferred (separate ticket):"
|
|
echo " stlp-3dscanner — rename + bring online first [#417]"
|
|
echo "========================================"
|
|
echo "By design (leave alone):"
|
|
echo " sectestbed-sandbox — 2FA enforced"
|
|
echo "========================================"
|
|
echo "Excluded by policy (no SSH access):"
|
|
echo " pfv-bms (API), tsys-cloudron (prod revenue),"
|
|
echo " tsys-ucs-01/02 (API-managed), tsys-umbrel (treasury)"
|
|
echo "========================================"
|