mrcharles
d4cbdf5ef4
access-matrix.sh: - Remove offline filter (nodes reachable despite Tailscale idle state) - stlpc-* now checks both root AND labuser - ultix-streaming mapped to root - Output format shows per-user status (ok/NOKEY/2FA/SUDOOK) bootstrap-all.sh: - Updated to exact NO-KEY list from ground-truth sweep (15 systems) - Removed all already-accessible systems - stlp-3dscanner flagged as unknown (not in bootstrap) Refs [#403] 💘 Generated with Crush Assisted-by: Crush:glm-5.2
66 lines
2.5 KiB
Bash
66 lines
2.5 KiB
Bash
#!/usr/bin/bash
|
|
# access-matrix.sh — definitive access verification across all Linux Tailscale nodes.
|
|
# Uses the correct SSH user(s) per system type, checks sudo where applicable.
|
|
# Routes through remote.sh (the only allowed ssh path).
|
|
set -u
|
|
cd /home/reachableceo/projects/PFVCluster || exit 1
|
|
|
|
# Policy-excluded systems (never attempt access)
|
|
EXCLUDE=':tsys-cloudron:pfv-bms:tsys-umbrel:stlpc-bizoffice:ultix-highside:'
|
|
|
|
# Determine the SSH user(s) for a given hostname and whether sudo is expected.
|
|
# Returns "user1:user2:...:sudoflag" where sudoflag is "yes" or "no".
|
|
users_for() {
|
|
local name="$1"
|
|
case "$name" in
|
|
pfv-tsys[0-9]) echo "root:no" ;;
|
|
*-proxmox-datacenter) echo "root:no" ;;
|
|
*-proxmox-pve) echo "root:no" ;;
|
|
*-proxmox-pbs) echo "root:no" ;;
|
|
*-proxmox-mailgw*) echo "root:no" ;;
|
|
*-proxmox-backup*) echo "root:no" ;;
|
|
ultix-streaming) echo "root:no" ;;
|
|
stlpc-*) echo "root:labuser:no" ;;
|
|
subopi*) echo "subodev:yes" ;;
|
|
*) echo "localuser:yes" ;;
|
|
esac
|
|
}
|
|
|
|
check_user() {
|
|
local ip="$1" user="$2" expect_sudo="$3"
|
|
local out sudo
|
|
out=$(VM_IP="$ip" VM_USER="$user" bash tests/remote.sh vm 'echo SSHOK; id -un' </dev/null 2>&1 | tr '\n' '/')
|
|
case "$out" in
|
|
*SSHOK*)
|
|
if [ "$expect_sudo" = "yes" ]; then
|
|
sudo=$(VM_IP="$ip" VM_USER="$user" bash tests/remote.sh vm 'sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO' </dev/null 2>&1 | tr -d '\n')
|
|
printf '%s(%s)' "$user" "${sudo:-?}"
|
|
else
|
|
printf '%s(ok)' "$user"
|
|
fi
|
|
;;
|
|
*keyboard-interactive*) printf '%s(2FA)' "$user" ;;
|
|
*Connection\ refused*) printf '%s(NOSSH)' "$user" ;;
|
|
*) printf '%s(NOKEY)' "$user" ;;
|
|
esac
|
|
}
|
|
|
|
printf '%-32s %-16s %s\n' "NAME" "TS-IP" "ACCESS"
|
|
printf '%-32s %-16s %s\n' "----" "-----" "------"
|
|
|
|
tailscale status 2>/dev/null | awk '$4=="linux" {print $2, $1}' | sort | while read -r name ip; do
|
|
[ -n "$name" ] || continue
|
|
case "$EXCLUDE" in *":$name:"*) printf '%-32s %-16s %s\n' "$name" "$ip" "EXCLUDED"; continue;; esac
|
|
|
|
map=$(users_for "$name")
|
|
expect_sudo="${map##*:}"
|
|
users="${map%:*}"
|
|
result=""
|
|
IFS=':' read -ra user_list <<< "$users"
|
|
for u in "${user_list[@]}"; do
|
|
r=$(check_user "$ip" "$u" "$expect_sudo")
|
|
[ -z "$result" ] && result="$r" || result="$result $r"
|
|
done
|
|
printf '%-32s %-16s %s\n' "$name" "$ip" "$result"
|
|
done
|