tegwick
1ab5d53bd7
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
41 lines
2.3 KiB
Bash
41 lines
2.3 KiB
Bash
#!/usr/bin/env bash
|
|
# Owner-run native audit/token-material checks. Never pass a private key in argv.
|
|
set +x
|
|
set -euo pipefail
|
|
ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
cd -- "$ROOT"
|
|
umask 077
|
|
[[ $# == 1 ]] || { printf '%s\n' 'Usage: run-isolated-privacyidea.sh VERIFIED_TRANSFER_RECEIPT'; exit 1; }
|
|
[[ -f "$1" && ! -L "$1" ]] || { printf '%s\n' 'ERROR: provide the existing verified transfer receipt.'; exit 1; }
|
|
[[ -t 0 && -t 1 && -t 2 ]] || { printf '%s\n' 'ERROR: run in your own interactive terminal.'; exit 1; }
|
|
for tool in python3 age age-keygen openssl docker; do
|
|
command -v "$tool" >/dev/null || { printf 'ERROR: required tool unavailable: %s\n' "$tool"; exit 1; }
|
|
done
|
|
python3 - <<'PY'
|
|
import importlib.util
|
|
from pathlib import Path
|
|
p=Path('tools/bootstrap-recovery/isolated-privacyidea.py')
|
|
spec=importlib.util.spec_from_file_location('isolated',p)
|
|
m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
|
|
try:
|
|
m.preflight()
|
|
except Exception:
|
|
raise SystemExit('ERROR: exact local Docker target, pinned images or tmpfs preflight failed; no key requested.')
|
|
print('OK: exact bnt-lap001 recovery engine, pinned images and tmpfs available.')
|
|
PY
|
|
NK49_PI_RUN="$(mktemp -d /tmp/nk49-isolated-privacyidea-XXXXXXXX)"
|
|
printf 'Safe evidence directory: %s\n' "$NK49_PI_RUN"
|
|
printf '%s\n' 'This restores the linked database and original keys only into disposable network-isolated containers.'
|
|
printf '%s\n' 'It decrypts retained token material internally, checks every stored audit row, and creates one new isolated audit entry.'
|
|
printf '%s\n' 'No MFA code is consumed. Invalid or unsigned history is reported, not repaired. Enter only the backup age key at the hidden prompt.'
|
|
if bash sso-mfa/bootstrap/sops-custody-unlock.sh \
|
|
--expected-recipient age1zvryunvjhvpkmasskauga2heeg0ztnte9ymgppvjge36ekumk50syr3tsz \
|
|
--prompt -- python3 tools/bootstrap-recovery/isolated-privacyidea.py \
|
|
--transfer-receipt "$1" --receipt "$NK49_PI_RUN/recovery.json"; then
|
|
printf 'Safe receipt: %s/recovery.json\n' "$NK49_PI_RUN"
|
|
else
|
|
NK49_PI_EXIT=$?
|
|
printf 'Check stopped or needs review. Safe receipt: %s/recovery.json\n' "$NK49_PI_RUN"
|
|
exit "$NK49_PI_EXIT"
|
|
fi
|
|
printf '%s\n' 'Return only the outcome and evidence directory. Existing-token MFA, Authelia and KeyCape remain separate.'
|