mrcharles
db6c7829ee
Add non-negotiable "Agent Authority" section to AGENTS.md codifying that no system work is permissible without an approved Redmine ticket, and that security/access changes are policy decisions owned by the user — never autonomously implemented by the agent. Also add the access bootstrap toolkit: - agent-bootstrap.sh: in-guest key + sudo setup (localuser sudo only per policy) - bootstrap-all.sh: workstation-side push to remaining NO-KEY systems - access-matrix.sh: full fleet SSH/sudo probe - probe-ssh.sh, probe-ssh-localuser.sh, probe-ga.sh, pivot-probe.sh, ga-push-key.sh: diagnostic scripts used during access audit Refs [#403] 💘 Generated with Crush Assisted-by: Crush:glm-5.2
55 lines
1.8 KiB
Bash
55 lines
1.8 KiB
Bash
#!/usr/bin/bash
|
|
# Test SSH (localuser) over Tailscale for the ROOT-FAIL nodes.
|
|
# Format: "tsname tailscale_ip"
|
|
set -u
|
|
cd /home/reachableceo/projects/PFVCluster || exit 1
|
|
# ROOT-FAIL linux nodes (from probe-ssh pass 1), excluding policy-excluded:
|
|
# tsys-umbrel, tsys-cloudron, devbox-cloudron, pfv-bms (api-only)
|
|
nodes="
|
|
hfnoc-uisp 100.94.188.89
|
|
netbird 100.123.45.23
|
|
pfv-jetson-nano-1 100.82.230.119
|
|
pfv-netinfra-01 100.70.181.72
|
|
pfv-netinfra-02 100.71.171.20
|
|
pfv-proxmox-backup-server 100.114.81.107
|
|
pfvsvrpi 100.91.151.113
|
|
preprod-ca 100.94.119.5
|
|
preprod-cloudron 100.95.69.89
|
|
preprod-hfnoc-uisp 100.77.14.7
|
|
preprod-librenms 100.79.52.34
|
|
preprod-proxmox-datacenter 100.101.250.10
|
|
preprod-proxmox-mailgw 100.114.9.49
|
|
preprod-siem 100.98.162.14
|
|
preprod-voip 100.109.99.109
|
|
sectestbed-ca 100.113.245.124
|
|
sectestbed-cloudron 100.97.140.105
|
|
sectestbed-proxmox-datacenter 100.94.1.34
|
|
sectestbed-proxmox-mailgw 100.117.24.21
|
|
sectestbed-proxmox-pbs 100.127.238.29
|
|
sectestbed-proxmox-pve 100.80.72.71
|
|
sectestbed-sandbox 100.64.20.60
|
|
sectestbed-siem 100.108.121.18
|
|
sectestbed-voip 100.86.176.105
|
|
stlpc-artroom 100.120.77.113
|
|
stlpc-garage 100.72.192.22
|
|
subopi-dev-3 100.64.231.65
|
|
subopi-dev-4 100.65.224.85
|
|
subopi3 100.93.17.77
|
|
tsys-proxmox-datacenter 100.125.183.68
|
|
tsys-siem 100.72.35.113
|
|
tsys-ucs-01 100.109.13.110
|
|
tsys-ucs-02 100.68.10.17
|
|
tsys-voip 100.83.126.67
|
|
ultix-field 100.115.233.124
|
|
"
|
|
echo "$nodes" | while read -r name ip; do
|
|
[ -n "$name" ] || continue
|
|
res=$(VM_IP="$ip" VM_USER="localuser" bash tests/remote.sh vm \
|
|
'echo SSHOK; id -un; (sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO)' </dev/null 2>&1 \
|
|
| tr '\n' '/' )
|
|
case "$res" in
|
|
*SSHOK*) printf '%-28s %-16s LOCALUSER-OK %s\n' "$name" "$ip" "$res" ;;
|
|
*) printf '%-28s %-16s LOCALUSER-FAIL %s\n' "$name" "$ip" "${res##*/}" ;;
|
|
esac
|
|
done
|