mrcharles
dbecf87806
agent-bootstrap.sh: - Accept AGENT_USER env var (defaults to localuser) - Push SSH key to root + $AGENT_USER + labuser (if present) - Grant NOPASSWD sudo to $AGENT_USER (not hardcoded localuser) - Skip qemu-guest-agent on bare metal (systemd-detect-virt) [#419] bootstrap-all.sh: - Pass AGENT_USER per system group: subopi* → subodev, ultix-field → ultixfield - All 8 remaining NO-KEY systems covered with correct user + escalation This closes the gap where subodev/ultixfield systems would get the key pushed to localuser (which doesn't exist) instead of the real agent user. Refs [#403], [#419] 💘 Generated with Crush Assisted-by: Crush:glm-5.2
72 lines
2.6 KiB
Bash
72 lines
2.6 KiB
Bash
#!/usr/bin/bash
|
|
# bootstrap-all.sh — push agent key + sudo to every remaining NO-KEY system.
|
|
#
|
|
# Two escalation methods:
|
|
# sudo → Ubuntu systems (no root password, localuser has sudo)
|
|
# su → Debian systems (root has a password)
|
|
#
|
|
# Passes AGENT_USER so agent-bootstrap.sh pushes the key + sudo to the
|
|
# correct unprivileged user per system type.
|
|
#
|
|
# You'll enter passwords interactively. Idempotent: safe to re-run.
|
|
set -u
|
|
cd "$(dirname "$0")" || exit 1
|
|
|
|
SCRIPT=agent-bootstrap.sh
|
|
SSH_OPTS=(-o StrictHostKeyChecking=accept-new -o ConnectTimeout=10)
|
|
|
|
run_with_sudo() {
|
|
local name="$1" ip="$2" user="$3" agent_user="${4:-localuser}"
|
|
echo "========================================"
|
|
echo " $name ($ip) — $user (sudo, agent=${agent_user})"
|
|
echo "========================================"
|
|
scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" \
|
|
&& ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "sudo AGENT_USER=${agent_user} bash /tmp/$SCRIPT" \
|
|
&& echo " -> $name DONE" \
|
|
|| echo " -> $name FAILED"
|
|
echo
|
|
}
|
|
|
|
run_with_su() {
|
|
local name="$1" ip="$2" user="$3" agent_user="${4:-localuser}"
|
|
echo "========================================"
|
|
echo " $name ($ip) — $user (su, agent=${agent_user})"
|
|
echo "========================================"
|
|
scp "${SSH_OPTS[@]}" "$SCRIPT" "${user}@${ip}:/tmp/" \
|
|
&& ssh -t "${SSH_OPTS[@]}" "${user}@${ip}" "su -c 'AGENT_USER=${agent_user} bash /tmp/$SCRIPT'" \
|
|
&& echo " -> $name DONE" \
|
|
|| echo " -> $name FAILED"
|
|
echo
|
|
}
|
|
|
|
# === Ubuntu: localuser + sudo ===
|
|
echo "### Ubuntu (localuser + sudo) ###"
|
|
echo
|
|
run_with_sudo tsys-siem 100.72.35.113 localuser
|
|
run_with_sudo sectestbed-cloudron 100.97.140.105 localuser
|
|
run_with_sudo kali-tsys 100.82.30.115 localuser
|
|
run_with_sudo pfvsvrpi 100.91.151.113 localuser
|
|
|
|
# === Debian: subodev + su ===
|
|
echo "### Debian: subodev + su ###"
|
|
echo
|
|
run_with_su subopi3 100.93.17.77 subodev subodev
|
|
run_with_su subopi-dev-3 100.64.231.65 subodev subodev
|
|
run_with_su subopi-dev-4 100.65.224.85 subodev subodev
|
|
|
|
# === Debian: ultixfield + su ===
|
|
echo "### Debian: ultixfield + su ###"
|
|
echo
|
|
run_with_su ultix-field 100.115.233.124 ultixfield ultixfield
|
|
|
|
echo "========================================"
|
|
echo "Done. Tell the agent to re-run access-matrix.sh to verify."
|
|
echo "========================================"
|
|
echo "Blocked — need console work (separate tickets):"
|
|
echo " tsys-ucs-01, tsys-ucs-02 — remove 2FA first [#418]"
|
|
echo " stlpc-3dscanner — bring online + rename [#417]"
|
|
echo "========================================"
|
|
echo "2FA by design (leave alone):"
|
|
echo " sectestbed-sandbox"
|
|
echo "========================================"
|