mrcharles
db6c7829ee
Add non-negotiable "Agent Authority" section to AGENTS.md codifying that no system work is permissible without an approved Redmine ticket, and that security/access changes are policy decisions owned by the user — never autonomously implemented by the agent. Also add the access bootstrap toolkit: - agent-bootstrap.sh: in-guest key + sudo setup (localuser sudo only per policy) - bootstrap-all.sh: workstation-side push to remaining NO-KEY systems - access-matrix.sh: full fleet SSH/sudo probe - probe-ssh.sh, probe-ssh-localuser.sh, probe-ga.sh, pivot-probe.sh, ga-push-key.sh: diagnostic scripts used during access audit Refs [#403] 💘 Generated with Crush Assisted-by: Crush:glm-5.2
60 lines
2.6 KiB
Bash
60 lines
2.6 KiB
Bash
#!/bin/sh
|
|
# agent-bootstrap.sh
|
|
#
|
|
# Run INSIDE a guest (via noVNC console login, or any root shell) to bring the
|
|
# system fully under agent management in one shot:
|
|
# 1. install + enable qemu-guest-agent (so Proxmox can reach the guest)
|
|
# 2. push the agent SSH key to root + localuser
|
|
# 3. grant localuser passwordless sudo
|
|
#
|
|
# After this runs once, the agent has SSH+sudo immediately. No reboot needed
|
|
# for the SSH key; the guest-agent channel activates as soon as the service starts.
|
|
#
|
|
# Usage (from a root shell in the guest):
|
|
# bash agent-bootstrap.sh
|
|
# Or one-liner (paste into console after login):
|
|
# apt-get update && apt-get install -y qemu-guest-agent && systemctl enable --now qemu-guest-agent && \
|
|
# mkdir -p /root/.ssh /home/localuser/.ssh && chmod 700 /root/.ssh /home/localuser/.ssh && \
|
|
# KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWms/uCXnjjo4KyxHBcYI2TDHe8OZ2wle6W/0hSRQLu reachableceo@ultix-streaming' && \
|
|
# for u in root localuser; do AK=$(getent passwd "$u"|cut -d: -f6)/.ssh/authorized_keys; touch "$AK"; chmod 600 "$AK"; grep -qF "$KEY" "$AK" || echo "$KEY" >> "$AK"; chown "$u": "$AK"; done && \
|
|
# id localuser >/dev/null 2>&1 && { echo 'localuser ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/010-agent; chmod 440 /etc/sudoers.d/010-agent; }; \
|
|
# echo BOOTSTRAP-DONE
|
|
|
|
set -eu
|
|
|
|
KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIWms/uCXnjjo4KyxHBcYI2TDHe8OZ2wle6W/0hSRQLu reachableceo@ultix-streaming'
|
|
|
|
# 1. guest-agent
|
|
if ! command -v qemu-ga >/dev/null 2>&1; then
|
|
if command -v apt-get >/dev/null 2>&1; then
|
|
apt-get update
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y qemu-guest-agent
|
|
elif command -v dnf >/dev/null 2>&1; then
|
|
dnf install -y qemu-guest-agent
|
|
elif command -v yum >/dev/null 2>&1; then
|
|
yum install -y qemu-guest-agent
|
|
else
|
|
echo "WARN: no supported package manager; skipping agent install" >&2
|
|
fi
|
|
fi
|
|
systemctl enable --now qemu-guest-agent 2>/dev/null || \
|
|
systemctl enable --now qemu-ga 2>/dev/null || true
|
|
|
|
# 2. SSH key for root + all unprivileged agents (localuser, labuser)
|
|
for u in root localuser labuser; do
|
|
if ! getent passwd "$u" >/dev/null 2>&1; then continue; fi
|
|
H=$(getent passwd "$u" | cut -d: -f6)
|
|
mkdir -p "$H/.ssh"; chmod 700 "$H/.ssh"
|
|
AK="$H/.ssh/authorized_keys"; touch "$AK"; chmod 600 "$AK"
|
|
grep -qF "$KEY" "$AK" || echo "$KEY" >> "$AK"
|
|
chown -R "$u": "$H/.ssh"
|
|
done
|
|
|
|
# 3. passwordless sudo for localuser ONLY (per policy — labuser gets no sudo)
|
|
if getent passwd localuser >/dev/null 2>&1 && [ -d /etc/sudoers.d ]; then
|
|
echo 'localuser ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/010-agent
|
|
chmod 440 /etc/sudoers.d/010-agent
|
|
fi
|
|
|
|
echo BOOTSTRAP-DONE
|