Files

T

mrcharles 66e7843f27 refactor: reorganize merged repo into clean directory structure

Reorganize the merged KNELServerBuild + PFVCluster repo:

  provisioning/    server provisioning (was ProjectCode/ +
                   Project-Includes/ + Project-ConfigFiles/)
  tests/           test suite (was Project-Tests/)
  perf/            Proxmox perf scripts (was top-level *.sh + scripts/)
  docs/            all documentation (was ProjectDocs/ + PROJECT.md +
                   K8S.md + TODO.md)
  dns-cluster-setup/  Technitium DNS cluster (unchanged)
  netinfra/        netinfra audit scripts (unchanged)
  switches/        switch configs (unchanged)
  vendor/          vendored KNELShellFramework (unchanged)

Update all internal path references from old directory names
(ProjectCode/, Project-Includes/, Project-Tests/) to the new ones
(provisioning/, tests/) across all scripts.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

2026-07-28 11:24:39 -05:00

2.3 KiB

Raw Blame History

AI Security Audit of KNELServerBuild

This is an AI-generated security audit of the KNELServerBuild project. The analysis is based on a read-only review of the project's files.

Summary of Findings

The KNELServerBuild project has a good security posture overall, but there are a few areas that could be improved. The most significant finding is the presence of SSH authorized keys in the repository. This is a security risk, as it allows anyone with access to the repository to know which public keys are authorized to access the servers.

High-Risk Findings

SSH Authorized Keys in Repository: The ProjectCode/ConfigFiles/SSH/AuthorizedKeys directory contains SSH authorized keys for the localuser and root users. This is a security risk, as it allows anyone with access to the repository to know which public keys are authorized to access the servers.

Medium-Risk Findings

Hardcoded Hostnames: The scripts contain several hardcoded hostnames for services like Postfix, NTP, syslog, and Wazuh. This is not a direct security risk, but it does represent a configuration management issue. If any of these hostnames change, they will need to be updated in multiple places.

Low-Risk Findings

Potential for Password on Command Line: The ProjectCode/Agents/librenms/mysql.sh script has a --pass argument for a MySQL password. This is a potential security risk if the password is provided on the command line, as it could be logged in the shell history.

Recommendations

Remove SSH Authorized Keys from Repository: The SSH authorized keys should be removed from the repository and managed using a secrets management tool like HashiCorp Vault or AWS Secrets Manager.
Use Variables for Hostnames: The hardcoded hostnames should be replaced with variables that are defined in a central configuration file. This will make it easier to update the hostnames if they change.
Avoid Passwords on Command Line: The ProjectCode/Agents/librenms/mysql.sh script should be modified to avoid passing the MySQL password on the command line. For example, the script could prompt the user for the password or read it from a configuration file.

Overall, the KNELServerBuild project is a good starting point for an IAC repository. By addressing the security risks identified in this audit, the project can be made more secure and reliable.

2.3 KiB Raw Blame History