mrcharles
db6c7829ee
Add non-negotiable "Agent Authority" section to AGENTS.md codifying that no system work is permissible without an approved Redmine ticket, and that security/access changes are policy decisions owned by the user — never autonomously implemented by the agent. Also add the access bootstrap toolkit: - agent-bootstrap.sh: in-guest key + sudo setup (localuser sudo only per policy) - bootstrap-all.sh: workstation-side push to remaining NO-KEY systems - access-matrix.sh: full fleet SSH/sudo probe - probe-ssh.sh, probe-ssh-localuser.sh, probe-ga.sh, pivot-probe.sh, ga-push-key.sh: diagnostic scripts used during access audit Refs [#403] 💘 Generated with Crush Assisted-by: Crush:glm-5.2
16 lines
725 B
Bash
16 lines
725 B
Bash
#!/usr/bin/bash
|
|
# Test SSH (root) over Tailscale to every online Linux node.
|
|
# Routes through remote.sh (the only allowed ssh path). Concise one-line output.
|
|
set -u
|
|
cd /home/reachableceo/projects/PFVCluster || exit 1
|
|
tailscale status 2>/dev/null | awk '$4=="linux" && $0 !~ /offline/ {print $1, $2}' | while read -r ip name; do
|
|
[ -n "$ip" ] || continue
|
|
res=$(VM_IP="$ip" VM_USER="root" bash tests/remote.sh vm \
|
|
'echo SSHOK; id -un; (sudo -n true 2>/dev/null && echo SUDOOK || echo SUDONO)' </dev/null 2>&1 \
|
|
| tr '\n' '/' )
|
|
case "$res" in
|
|
*SSHOK*) printf '%-28s %-16s ROOT-OK %s\n' "$name" "$ip" "$res" ;;
|
|
*) printf '%-28s %-16s ROOT-FAIL %s\n' "$name" "$ip" "${res#/}" ;;
|
|
esac
|
|
done
|