mrcharles
db6c7829ee
Add non-negotiable "Agent Authority" section to AGENTS.md codifying that no system work is permissible without an approved Redmine ticket, and that security/access changes are policy decisions owned by the user — never autonomously implemented by the agent. Also add the access bootstrap toolkit: - agent-bootstrap.sh: in-guest key + sudo setup (localuser sudo only per policy) - bootstrap-all.sh: workstation-side push to remaining NO-KEY systems - access-matrix.sh: full fleet SSH/sudo probe - probe-ssh.sh, probe-ssh-localuser.sh, probe-ga.sh, pivot-probe.sh, ga-push-key.sh: diagnostic scripts used during access audit Refs [#403] 💘 Generated with Crush Assisted-by: Crush:glm-5.2
39 lines
1.6 KiB
Bash
39 lines
1.6 KiB
Bash
#!/bin/sh
|
|
# pivot-probe.sh — runs ON a Proxmox host (tsys5).
|
|
# Tests whether THIS host's root key grants SSH (root/localuser) into the
|
|
# GA-NO / no-SSH VMs over Tailscale. Output: "ip name user PIVOT-OK|FAIL reason"
|
|
IPS="
|
|
100.125.183.68:tsys-proxmox-datacenter:105
|
|
100.109.13.110:tsys-ucs-01:108
|
|
100.114.81.107:pfv-proxmox-backup-server:400
|
|
100.77.14.7:preprod-hfnoc-uisp:515
|
|
100.108.121.18:sectestbed-siem:5101
|
|
100.80.72.71:sectestbed-proxmox-pve:5102
|
|
100.94.1.34:sectestbed-proxmox-datacenter:5103
|
|
100.127.238.29:sectestbed-proxmox-pbs:5104
|
|
100.97.140.105:sectestbed-cloudron:51011
|
|
100.117.24.21:sectestbed-proxmox-mailgw:51014
|
|
100.113.245.124:sectestbed-ca:51015
|
|
100.86.176.105:sectestbed-voip:51016
|
|
100.98.162.14:preprod-siem:53101
|
|
100.114.9.49:preprod-proxmox-mailgw:53103
|
|
100.94.119.5:preprod-ca:53104
|
|
100.101.250.10:preprod-proxmox-datacenter:53105
|
|
100.79.52.34:preprod-librenms:53106
|
|
100.109.99.109:preprod-voip:53107
|
|
100.95.69.89:preprod-cloudron:53108
|
|
100.94.188.89:hfnoc-uisp:702
|
|
100.72.35.113:tsys-siem:707
|
|
100.82.30.115:kali-tsys:708
|
|
"
|
|
for line in $IPS; do
|
|
ip="${line%%:*}"; rest="${line#*:}"; name="${rest%%:*}"; vmid="${rest##*:}"
|
|
if ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=6 "root@${ip}" 'true' >/dev/null 2>&1; then
|
|
printf '%s\t%s\t%s\troot\tPIVOT-OK\n' "$ip" "$name" "$vmid"
|
|
elif ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=6 "localuser@${ip}" 'true' >/dev/null 2>&1; then
|
|
printf '%s\t%s\t%s\tlocaluser\tPIVOT-OK\n' "$ip" "$name" "$vmid"
|
|
else
|
|
printf '%s\t%s\t%s\t-\tPIVOT-FAIL\n' "$ip" "$name" "$vmid"
|
|
fi
|
|
done
|