mrcharles
db6c7829ee
Add non-negotiable "Agent Authority" section to AGENTS.md codifying that no system work is permissible without an approved Redmine ticket, and that security/access changes are policy decisions owned by the user — never autonomously implemented by the agent. Also add the access bootstrap toolkit: - agent-bootstrap.sh: in-guest key + sudo setup (localuser sudo only per policy) - bootstrap-all.sh: workstation-side push to remaining NO-KEY systems - access-matrix.sh: full fleet SSH/sudo probe - probe-ssh.sh, probe-ssh-localuser.sh, probe-ga.sh, pivot-probe.sh, ga-push-key.sh: diagnostic scripts used during access audit Refs [#403] 💘 Generated with Crush Assisted-by: Crush:glm-5.2
95 lines
3.5 KiB
Bash
95 lines
3.5 KiB
Bash
#!/usr/bin/bash
|
|
# bootstrap-all.sh — push agent key + sudo to every remaining NO-KEY system.
|
|
#
|
|
# Three groups (user determined by system type):
|
|
# 1. Proxmox appliances (mailgw) + Kali → root
|
|
# 2. stlpc-* systems → labuser
|
|
# 3. Everything else → localuser
|
|
#
|
|
# You'll enter passwords interactively. Idempotent: safe to re-run.
|
|
set -u
|
|
cd "$(dirname "$0")" || exit 1
|
|
|
|
SCRIPT=agent-bootstrap.sh
|
|
SSH_OPTS=(-o StrictHostKeyChecking=accept-new -o ConnectTimeout=10)
|
|
|
|
ok=0; fail=0; faillist=""
|
|
|
|
run_as_root() {
|
|
local name="$1" ip="$2"
|
|
echo "========================================"
|
|
echo " $name ($ip) — root"
|
|
echo "========================================"
|
|
if scp "${SSH_OPTS[@]}" "$SCRIPT" "root@${ip}:/tmp/" 2>/dev/null; then
|
|
if ssh "${SSH_OPTS[@]}" "root@${ip}" "bash /tmp/$SCRIPT"; then
|
|
echo " -> $name DONE"; ok=$((ok+1))
|
|
else
|
|
echo " -> $name FAILED (script error)"; fail=$((fail+1)); faillist="$faillist $name"
|
|
fi
|
|
else
|
|
echo " -> $name FAILED (root SSH/password)"; fail=$((fail+1)); faillist="$faillist $name"
|
|
fi
|
|
echo
|
|
}
|
|
|
|
run_as_user() {
|
|
local name="$1" ip="$2" user="$3"
|
|
echo "========================================"
|
|
echo " $name ($ip) — $user"
|
|
echo "========================================"
|
|
if scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" 2>/dev/null; then
|
|
if ssh "${SSH_OPTS[@]}" "${user}@${ip}" 'su -c "bash /tmp/'"$SCRIPT"'"'; then
|
|
echo " -> $name DONE"; ok=$((ok+1))
|
|
else
|
|
echo " -> $name FAILED (su to root)"; fail=$((fail+1)); faillist="$faillist $name"
|
|
fi
|
|
else
|
|
echo " -> $name FAILED (${user} SSH/password)"; fail=$((fail+1)); faillist="$faillist $name"
|
|
fi
|
|
echo
|
|
}
|
|
|
|
# === Group 1: root (Proxmox appliances + Kali) ===
|
|
echo "########################################"
|
|
echo "# Group 1: root (Proxmox appliances + Kali)"
|
|
echo "########################################"
|
|
echo
|
|
run_as_root kali-tsys 100.82.30.115
|
|
run_as_root preprod-proxmox-mailgw 100.114.9.49
|
|
run_as_root sectestbed-proxmox-mailgw 100.117.24.21
|
|
|
|
# === Group 2: labuser (stlpc-*) ===
|
|
echo "########################################"
|
|
echo "# Group 2: labuser (stlpc-*)"
|
|
echo "########################################"
|
|
echo
|
|
run_as_user stlpc-artroom 100.120.77.113 labuser
|
|
run_as_user stlpc-garage 100.72.192.22 labuser
|
|
|
|
# === Group 3: localuser (everything else) ===
|
|
echo "########################################"
|
|
echo "# Group 3: localuser (standard systems)"
|
|
echo "########################################"
|
|
echo
|
|
run_as_user pfv-jetson-nano-1 100.82.230.119 localuser
|
|
run_as_user pfvsvrpi 100.91.151.113 localuser
|
|
run_as_user preprod-cloudron 100.95.69.89 localuser
|
|
run_as_user preprod-hfnoc-uisp 100.77.14.7 localuser
|
|
run_as_user preprod-siem 100.98.162.14 localuser
|
|
run_as_user sectestbed-cloudron 100.97.140.105 localuser
|
|
run_as_user sectestbed-siem 100.108.121.18 localuser
|
|
run_as_user subopi3 100.93.17.77 localuser
|
|
run_as_user subopi-dev-3 100.64.231.65 localuser
|
|
run_as_user subopi-dev-4 100.65.224.85 localuser
|
|
run_as_user tsys-siem 100.72.35.113 localuser
|
|
run_as_user ultix-field 100.115.233.124 localuser
|
|
|
|
echo "========================================"
|
|
echo "Summary: $ok done, $fail failed"
|
|
[ -n "$faillist" ] && echo "Failed:$faillist"
|
|
echo "========================================"
|
|
echo "Still 2FA-blocked (need policy decision):"
|
|
echo " sectestbed-sandbox, tsys-ucs-01, tsys-ucs-02"
|
|
echo "========================================"
|
|
echo "Tell the agent to re-run access-matrix.sh to verify."
|