mrcharles
db6c7829ee
Add non-negotiable "Agent Authority" section to AGENTS.md codifying that no system work is permissible without an approved Redmine ticket, and that security/access changes are policy decisions owned by the user — never autonomously implemented by the agent. Also add the access bootstrap toolkit: - agent-bootstrap.sh: in-guest key + sudo setup (localuser sudo only per policy) - bootstrap-all.sh: workstation-side push to remaining NO-KEY systems - access-matrix.sh: full fleet SSH/sudo probe - probe-ssh.sh, probe-ssh-localuser.sh, probe-ga.sh, pivot-probe.sh, ga-push-key.sh: diagnostic scripts used during access audit Refs [#403] 💘 Generated with Crush Assisted-by: Crush:glm-5.2
39 lines
2.1 KiB
Bash
39 lines
2.1 KiB
Bash
#!/usr/bin/bash
|
|
# access-matrix.sh — definitive access verification across all online Linux Tailscale nodes.
|
|
# For each node: try root SSH, then localuser SSH; report access level.
|
|
# Routes through remote.sh (the only allowed ssh path).
|
|
set -u
|
|
cd /home/reachableceo/projects/PFVCluster || exit 1
|
|
|
|
# Policy-excluded systems (never attempt access)
|
|
EXCLUDE=':tsys-umbrel:tsys-cloudron:devbox-cloudron:pfv-bms:stlpc-bizoffice:ultix-highside:'
|
|
|
|
printf '%-28s %-16s %-18s %s\n' "NAME" "TS-IP" "ACCESS" "SUDO"
|
|
printf '%-28s %-16s %-18s %s\n' "----" "-----" "------" "----"
|
|
|
|
tailscale status 2>/dev/null | awk '$4=="linux" && $0 !~ /offline/ {print $2, $1}' | sort | while read -r name ip; do
|
|
[ -n "$name" ] || continue
|
|
case "$EXCLUDE" in *":$name:"*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "EXCLUDED"; continue;; esac
|
|
|
|
# Try root
|
|
rout=$(VM_IP="$ip" VM_USER="root" bash tests/remote.sh vm 'echo OK; id -un' </dev/null 2>&1 | tr '\n' '/')
|
|
case "$rout" in
|
|
*OK/root*) sudo=$(VM_IP="$ip" VM_USER="root" bash tests/remote.sh vm 'sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO' </dev/null 2>&1 | tr -d '\n')
|
|
printf '%-28s %-16s %-18s %s\n' "$name" "$ip" "root-SSH" "${sudo:-?}"; continue;;
|
|
esac
|
|
# Try localuser
|
|
lout=$(VM_IP="$ip" VM_USER="localuser" bash tests/remote.sh vm 'echo OK; id -un' </dev/null 2>&1 | tr '\n' '/')
|
|
case "$lout" in
|
|
*OK/localuser*) sudo=$(VM_IP="$ip" VM_USER="localuser" bash tests/remote.sh vm 'sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO' </dev/null 2>&1 | tr -d '\n')
|
|
printf '%-28s %-16s %-18s %s\n' "$name" "$ip" "localuser-SSH" "${sudo:-?}"; continue;;
|
|
esac
|
|
# Neither — classify the failure
|
|
case "$rout" in
|
|
*Connection\ refused*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "NO-SSH(port22)";;
|
|
*keyboard-interactive*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "2FA-blocked";;
|
|
*Permission\ denied*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "NO-KEY";;
|
|
*No\ route*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "UNREACHABLE";;
|
|
*) printf '%-28s %-16s %-18s\n' "$name" "$ip" "NO-KEY";;
|
|
esac
|
|
done
|