vh
30a7220b2c
Prime's ruling 2026-10-13. esh-nas (10.0.50.50) had no infra-ops user, so key login was refused. The same steps as bootstrap-infra-ops-user.yaml (uid/gid 850, fleet key, NOPASSWD sudoers with log_output and the BULK_DATA carve-out, visudo-validated) ran inside the container from its host. Verified with a direct ssh infra-ops@10.0.50.50 and sudo -n whoami = root.
28 lines
1.7 KiB
Bash
28 lines
1.7 KiB
Bash
#!/bin/bash
|
|
# Run INSIDE esh-nas (CT 103 on esh-pve-nas) as root, via `pct exec 103`. The same steps as
|
|
# playbooks/bootstrap-infra-ops-user.yaml, for a container infra-ops cannot log into yet (Prime 2026-10-13: "set it up").
|
|
set -euo pipefail
|
|
U=infra-ops; ID=850
|
|
KEY='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN+1HBwfXrkfTYWdcnWCjLJ6VLAGC87gxH5h5vKaaA3c infra-ops@pfi-fleet'
|
|
if ! id "$U" >/dev/null 2>&1; then
|
|
if ! getent passwd "$ID" >/dev/null && ! getent group "$ID" >/dev/null; then
|
|
groupadd -g "$ID" "$U"; useradd -m -s /bin/bash -u "$ID" -g "$ID" "$U"
|
|
else
|
|
echo "uid/gid $ID taken; letting the OS allocate"; useradd -m -s /bin/bash "$U"
|
|
fi
|
|
echo "created $U"
|
|
fi
|
|
chmod 0700 /home/$U
|
|
getent group docker >/dev/null && usermod -aG docker "$U" || echo "no docker group, skipped"
|
|
install -d -m 700 -o "$U" -g "$U" /home/$U/.ssh
|
|
printf '%s\n' "$KEY" > /home/$U/.ssh/authorized_keys
|
|
chown "$U:$U" /home/$U/.ssh/authorized_keys; chmod 600 /home/$U/.ssh/authorized_keys
|
|
f=/etc/sudoers.d/$U
|
|
printf 'Defaults:%s log_output\n%s ALL=(ALL) NOPASSWD:ALL\n' "$U" "$U" > "$f.tmp"
|
|
printf '%s\n' '# Bulk data movers: keep the audit line, do not record the bytes (eshpfi playbooks/sudoers-infra-ops-bulk-no-log-output.yaml)' \
|
|
'Cmnd_Alias BULK_DATA = /usr/bin/rsync, /usr/bin/tar, /usr/bin/cat, /usr/bin/dd, /usr/bin/zstd, /usr/bin/zcat, /usr/bin/gzip, /usr/bin/pv, /usr/bin/docker save *, /usr/bin/docker export *, /usr/bin/docker cp *' \
|
|
'Defaults!BULK_DATA !log_output' >> "$f.tmp"
|
|
chmod 440 "$f.tmp"
|
|
if visudo -cf "$f.tmp"; then mv "$f.tmp" "$f"; else rm -f "$f.tmp"; echo "VISUDO VALIDATION FAILED"; exit 1; fi
|
|
id "$U"; stat -c '%a %U %n' /home/$U /home/$U/.ssh /home/$U/.ssh/authorized_keys "$f"
|