tegwick
d5484bb90a
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
37 lines
2.2 KiB
Bash
37 lines
2.2 KiB
Bash
#!/usr/bin/env bash
|
|
# Owner-run existing-user check. No private key/password belongs in arguments.
|
|
set +x
|
|
set -euo pipefail
|
|
ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
cd -- "$ROOT"
|
|
umask 077
|
|
[[ $# == 2 ]] || { printf '%s\n' 'Usage: run-isolated-lldap.sh USER VERIFIED_TRANSFER_RECEIPT'; exit 1; }
|
|
[[ "$1" =~ ^[A-Za-z0-9_.-]{1,128}$ ]] || { printf '%s\n' 'ERROR: invalid username.'; exit 1; }
|
|
[[ -f "$2" && ! -L "$2" ]] || { printf '%s\n' 'ERROR: provide the existing verified transfer receipt.'; exit 1; }
|
|
[[ -t 0 && -t 1 && -t 2 ]] || { printf '%s\n' 'ERROR: run in your own interactive terminal.'; exit 1; }
|
|
for tool in python3 age age-keygen openssl docker; do
|
|
command -v "$tool" >/dev/null || { printf 'ERROR: required tool unavailable: %s\n' "$tool"; exit 1; }
|
|
done
|
|
python3 - <<'PY'
|
|
import importlib.util
|
|
from pathlib import Path
|
|
p=Path('tools/bootstrap-recovery/isolated-lldap.py')
|
|
spec=importlib.util.spec_from_file_location('isolated',p)
|
|
m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
|
|
try:
|
|
m.preflight()
|
|
except Exception:
|
|
raise SystemExit('ERROR: exact local Docker target, pinned images or tmpfs preflight failed; no key requested.')
|
|
print('OK: exact bnt-lap001 recovery engine, pinned images and tmpfs available.')
|
|
PY
|
|
NK49_LLDAP_RUN="$(mktemp -d /tmp/nk49-isolated-lldap-XXXXXXXX)"
|
|
printf 'Safe evidence directory: %s\n' "$NK49_LLDAP_RUN"
|
|
printf '%s\n' 'This restores only LLDAP into disposable containers with no external network, ports or host mounts.'
|
|
printf '%s\n' 'Enter the railiance-backup age key, then the existing account password that was valid at backup capture.'
|
|
printf '%s\n' 'The check rejects wrong passwords and preserves original users, groups and memberships. It changes no production service.'
|
|
bash sso-mfa/bootstrap/sops-custody-unlock.sh \
|
|
--expected-recipient age1zvryunvjhvpkmasskauga2heeg0ztnte9ymgppvjge36ekumk50syr3tsz \
|
|
--prompt -- python3 tools/bootstrap-recovery/isolated-lldap.py \
|
|
--user "$1" --transfer-receipt "$2" --receipt "$NK49_LLDAP_RUN/recovery.json"
|
|
printf 'Safe receipt: %s/recovery.json\n' "$NK49_LLDAP_RUN"
|
|
printf '%s\n' 'Return only the outcome and evidence directory. Authelia/KeyCape/MFA/audit acceptance remains separate.'
|