tegwick
006dc23fdf
isolated-authelia.py runs restored LLDAP as the network-none anchor with Authelia joining its namespace. Checks the original config, storage key, issuer key, KeyCape's client secret and existing-user first factor, with wrong-password and wrong-client-secret refusal. Confinement rewrites: LDAP to loopback, file notifier, NTP check off, healthcheck file off. Imports isolated-lldap.py unedited; the T38-pinned KeyCape sources are untouched. Native fixture tests on the pinned images pass (9). T17 now awaits the founder-attended run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
37 lines
2.3 KiB
Bash
Executable file
37 lines
2.3 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Owner-run existing-user check. No private key/password belongs in arguments.
|
|
set +x
|
|
set -euo pipefail
|
|
ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
cd -- "$ROOT"
|
|
umask 077
|
|
[[ $# == 2 ]] || { printf '%s\n' 'Usage: run-isolated-authelia.sh USER VERIFIED_TRANSFER_RECEIPT'; exit 1; }
|
|
[[ "$1" =~ ^[A-Za-z0-9_.-]{1,128}$ ]] || { printf '%s\n' 'ERROR: invalid username.'; exit 1; }
|
|
[[ -f "$2" && ! -L "$2" ]] || { printf '%s\n' 'ERROR: provide the existing verified transfer receipt.'; exit 1; }
|
|
[[ -t 0 && -t 1 && -t 2 ]] || { printf '%s\n' 'ERROR: run in your own interactive terminal.'; exit 1; }
|
|
for tool in python3 age age-keygen openssl docker; do
|
|
command -v "$tool" >/dev/null || { printf 'ERROR: required tool unavailable: %s\n' "$tool"; exit 1; }
|
|
done
|
|
python3 - <<'PY'
|
|
import importlib.util
|
|
from pathlib import Path
|
|
p=Path('tools/bootstrap-recovery/isolated-authelia.py')
|
|
spec=importlib.util.spec_from_file_location('isolated',p)
|
|
m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
|
|
try:
|
|
m.preflight()
|
|
except Exception:
|
|
raise SystemExit('ERROR: exact local Docker target, pinned images or tmpfs preflight failed; no key requested.')
|
|
print('OK: exact bnt-lap001 recovery engine, pinned images and tmpfs available.')
|
|
PY
|
|
NK49_AUTHELIA_RUN="$(mktemp -d /tmp/nk49-isolated-authelia-XXXXXXXX)"
|
|
printf 'Safe evidence directory: %s\n' "$NK49_AUTHELIA_RUN"
|
|
printf '%s\n' 'This restores LLDAP and Authelia into disposable containers sharing one network-free namespace: no external network, ports or host mounts.'
|
|
printf '%s\n' 'Enter the railiance-backup age key, then the existing account password that was valid at backup capture.'
|
|
printf '%s\n' 'Checks: original config, storage key, issuer key, KeyCape client verifier, first factor; wrong password and client secret refused. Notifications go to a tmpfs file. No production change.'
|
|
bash sso-mfa/bootstrap/sops-custody-unlock.sh \
|
|
--expected-recipient age1zvryunvjhvpkmasskauga2heeg0ztnte9ymgppvjge36ekumk50syr3tsz \
|
|
--prompt -- python3 tools/bootstrap-recovery/isolated-authelia.py \
|
|
--user "$1" --transfer-receipt "$2" --receipt "$NK49_AUTHELIA_RUN/recovery.json"
|
|
printf 'Safe receipt: %s/recovery.json\n' "$NK49_AUTHELIA_RUN"
|
|
printf '%s\n' 'Return only the outcome and evidence directory. KeyCape consumer, MFA and audit acceptance remain separate.'
|