mrcharles
b909cd5afb
bootstrap-all.sh: - kali-tsys: root → localuser - subopi*: localuser → subodev - devbox-cloudron: added to scope (localuser) - Remove already-accessible: preprod/sectestbed-proxmox-mailgw, stlpc-artroom access-matrix.sh: - Remove devbox-cloudron from exclude list (now in scope) Refs [#403] 💘 Generated with Crush Assisted-by: Crush:glm-5.2
39 lines
2.1 KiB
Bash
39 lines
2.1 KiB
Bash
#!/usr/bin/bash
|
|
# access-matrix.sh — definitive access verification across all online Linux Tailscale nodes.
|
|
# For each node: try root SSH, then localuser SSH; report access level.
|
|
# Routes through remote.sh (the only allowed ssh path).
|
|
set -u
|
|
cd /home/reachableceo/projects/PFVCluster || exit 1
|
|
|
|
# Policy-excluded systems (never attempt access)
|
|
EXCLUDE=':tsys-cloudron:pfv-bms:tsys-umbrel:stlpc-bizoffice:ultix-highside:'
|
|
|
|
printf '%-28s %-16s %-18s %s\n' "NAME" "TS-IP" "ACCESS" "SUDO"
|
|
printf '%-28s %-16s %-18s %s\n' "----" "-----" "------" "----"
|
|
|
|
tailscale status 2>/dev/null | awk '$4=="linux" && $0 !~ /offline/ {print $2, $1}' | sort | while read -r name ip; do
|
|
[ -n "$name" ] || continue
|
|
case "$EXCLUDE" in *":$name:"*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "EXCLUDED"; continue;; esac
|
|
|
|
# Try root
|
|
rout=$(VM_IP="$ip" VM_USER="root" bash tests/remote.sh vm 'echo OK; id -un' </dev/null 2>&1 | tr '\n' '/')
|
|
case "$rout" in
|
|
*OK/root*) sudo=$(VM_IP="$ip" VM_USER="root" bash tests/remote.sh vm 'sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO' </dev/null 2>&1 | tr -d '\n')
|
|
printf '%-28s %-16s %-18s %s\n' "$name" "$ip" "root-SSH" "${sudo:-?}"; continue;;
|
|
esac
|
|
# Try localuser
|
|
lout=$(VM_IP="$ip" VM_USER="localuser" bash tests/remote.sh vm 'echo OK; id -un' </dev/null 2>&1 | tr '\n' '/')
|
|
case "$lout" in
|
|
*OK/localuser*) sudo=$(VM_IP="$ip" VM_USER="localuser" bash tests/remote.sh vm 'sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO' </dev/null 2>&1 | tr -d '\n')
|
|
printf '%-28s %-16s %-18s %s\n' "$name" "$ip" "localuser-SSH" "${sudo:-?}"; continue;;
|
|
esac
|
|
# Neither — classify the failure
|
|
case "$rout" in
|
|
*Connection\ refused*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "NO-SSH(port22)";;
|
|
*keyboard-interactive*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "2FA-blocked";;
|
|
*Permission\ denied*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "NO-KEY";;
|
|
*No\ route*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "UNREACHABLE";;
|
|
*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "NO-KEY";;
|
|
esac
|
|
done
|