mrcharles
95ad74a068
Replace generic root→localuser fallback with explicit user mapping: - Proxmox hosts/appliances → root (no sudo check) - stlpc-* → labuser (no sudo) - subopi* → subodev (with sudo check) - everything else → localuser (with sudo check) Refs [#403] 💘 Generated with Crush Assisted-by: Crush:glm-5.2
55 lines
2.5 KiB
Bash
55 lines
2.5 KiB
Bash
#!/usr/bin/bash
|
|
# access-matrix.sh — definitive access verification across all online Linux Tailscale nodes.
|
|
# Uses the correct SSH user per system type, checks sudo where applicable.
|
|
# Routes through remote.sh (the only allowed ssh path).
|
|
set -u
|
|
cd /home/reachableceo/projects/PFVCluster || exit 1
|
|
|
|
# Policy-excluded systems (never attempt access)
|
|
EXCLUDE=':tsys-cloudron:pfv-bms:tsys-umbrel:stlpc-bizoffice:ultix-highside:'
|
|
|
|
# Determine the SSH user for a given hostname.
|
|
# Returns "user:sudo" where sudo is "yes" or "no".
|
|
user_for() {
|
|
local name="$1"
|
|
case "$name" in
|
|
pfv-tsys[0-9]) echo "root:no" ;;
|
|
*-proxmox-datacenter) echo "root:no" ;;
|
|
*-proxmox-pve) echo "root:no" ;;
|
|
*-proxmox-pbs) echo "root:no" ;;
|
|
*-proxmox-mailgw*) echo "root:no" ;;
|
|
*-proxmox-backup*) echo "root:no" ;;
|
|
stlpc-*) echo "labuser:no" ;;
|
|
subopi*) echo "subodev:yes" ;;
|
|
*) echo "localuser:yes" ;;
|
|
esac
|
|
}
|
|
|
|
printf '%-32s %-16s %-12s %-8s\n' "NAME" "TS-IP" "ACCESS" "SUDO"
|
|
printf '%-32s %-16s %-12s %-8s\n' "----" "-----" "------" "----"
|
|
|
|
tailscale status 2>/dev/null | awk '$4=="linux" && $0 !~ /offline/ {print $2, $1}' | sort | while read -r name ip; do
|
|
[ -n "$name" ] || continue
|
|
case "$EXCLUDE" in *":$name:"*) printf '%-32s %-16s %-12s\n' "$name" "$ip" "EXCLUDED"; continue;; esac
|
|
|
|
map=$(user_for "$name")
|
|
user="${map%%:*}"; expect_sudo="${map##*:}"
|
|
|
|
out=$(VM_IP="$ip" VM_USER="$user" bash tests/remote.sh vm 'echo SSHOK; id -un' </dev/null 2>&1 | tr '\n' '/')
|
|
case "$out" in
|
|
*SSHOK*)
|
|
if [ "$expect_sudo" = "yes" ]; then
|
|
sudo=$(VM_IP="$ip" VM_USER="$user" bash tests/remote.sh vm 'sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO' </dev/null 2>&1 | tr -d '\n')
|
|
printf '%-32s %-16s %-12s %-8s\n' "$name" "$ip" "${user}-SSH" "${sudo:-?}"
|
|
else
|
|
printf '%-32s %-16s %-12s %-8s\n' "$name" "$ip" "${user}-SSH" "n/a"
|
|
fi
|
|
;;
|
|
*keyboard-interactive*) printf '%-32s %-16s %-12s\n' "$name" "$ip" "2FA-blocked" ;;
|
|
*Connection\ refused*) printf '%-32s %-16s %-12s\n' "$name" "$ip" "NO-SSH(22)" ;;
|
|
*Permission\ denied*) printf '%-32s %-16s %-12s\n' "$name" "$ip" "NO-KEY" ;;
|
|
*No\ route*) printf '%-32s %-16s %-12s\n' "$name" "$ip" "UNREACHABLE" ;;
|
|
*) printf '%-32s %-16s %-12s\n' "$name" "$ip" "NO-KEY" ;;
|
|
esac
|
|
done
|