37ed8b012b
The account task set groups: [] with append: false, so the next run would have removed custodian-agt from gated-executor's exchange group. Allowed groups are now an explicit per-account inventory list, refused if forbidden, and asserted as the exact set by goss; container test covers an unlisted group. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 605711@bnt-lap001 Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
50 lines
3.1 KiB
Bash
Executable file
50 lines
3.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Offline container check for the restricted agent account (RAIL-HO-WP-0014).
|
|
# Runs inside a throwaway ubuntu:24.04 container; never contacts a managed host.
|
|
# /in must contain the rendered 05-restricted-agents.conf and restricted-agent.yaml.
|
|
set -euo pipefail
|
|
apt-get update -qq >/dev/null
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq openssh-server sudo curl ca-certificates >/dev/null 2>&1
|
|
curl -sSL -o /usr/local/bin/goss https://github.com/goss-org/goss/releases/download/v0.4.9/goss-linux-amd64
|
|
chmod +x /usr/local/bin/goss
|
|
mkdir -p /run/sshd /etc/ssh/ca /etc/ssh/auth_principals /etc/rancher/k3s
|
|
ssh-keygen -q -t ed25519 -N '' -f /tmp/ca && cp /tmp/ca.pub /etc/ssh/ca/ca_user.pub
|
|
# Mirror the live drop-ins written by the base and ssh_ca_host roles.
|
|
printf 'PasswordAuthentication no\nPermitRootLogin no\nPubkeyAuthentication yes\nChallengeResponseAuthentication no\n' \
|
|
> /etc/ssh/sshd_config.d/10-hardening.conf
|
|
printf 'TrustedUserCAKeys /etc/ssh/ca/ca_user.pub\nAuthorizedPrincipalsFile /etc/ssh/auth_principals/%%u\n' \
|
|
> /etc/ssh/sshd_config.d/20-ssh-ca.conf
|
|
/usr/sbin/sshd -t -f /in/05-restricted-agents.conf && echo "drop-in validate ok"
|
|
cp /in/05-restricted-agents.conf /etc/ssh/sshd_config.d/
|
|
/usr/sbin/sshd -t && echo "full config ok"
|
|
# Equivalent of the role's account tasks.
|
|
useradd -m -s /bin/bash tegwick
|
|
echo 'tegwick ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/tegwick
|
|
groupadd custodian-agt
|
|
useradd -m -g custodian-agt -s /bin/bash -d /home/custodian-agt custodian-agt
|
|
usermod -p '!' custodian-agt
|
|
# Mirror ssh_principals restricted_account_groups (gated-executor exchange group).
|
|
groupadd --system gexec-review
|
|
usermod -aG gexec-review custodian-agt
|
|
chmod 0700 /home/custodian-agt
|
|
echo agt-custodian > /etc/ssh/auth_principals/custodian-agt
|
|
echo 'apiVersion: v1' > /etc/rancher/k3s/k3s.yaml
|
|
chmod 0600 /etc/rancher/k3s/k3s.yaml
|
|
echo "--- Match scope: operator account keeps its own settings"
|
|
/usr/sbin/sshd -T -C user=tegwick,host=x,addr=192.0.2.1 | grep -E '^(authorizedkeysfile|authenticationmethods|trustedusercakeys) '
|
|
echo "--- goss positive"
|
|
goss -g /in/restricted-agent.yaml validate --format tap > /tmp/pos
|
|
tail -1 /tmp/pos
|
|
expect_fail() {
|
|
if goss -g /in/restricted-agent.yaml validate --format tap > /tmp/neg; then
|
|
echo "UNEXPECTED PASS: $1"; exit 1
|
|
fi
|
|
echo "--- negative ($1) fails as expected:"; grep '^not ok' /tmp/neg | cut -c1-110
|
|
}
|
|
chmod 0644 /etc/rancher/k3s/k3s.yaml; expect_fail "k3s.yaml world-readable"; chmod 0600 /etc/rancher/k3s/k3s.yaml
|
|
usermod -aG sudo custodian-agt; expect_fail "sudo group"; gpasswd -d custodian-agt sudo >/dev/null
|
|
groupadd unlisted-extra; usermod -aG unlisted-extra custodian-agt; expect_fail "unlisted supplementary group"; gpasswd -d custodian-agt unlisted-extra >/dev/null
|
|
echo 'custodian-agt ALL=(ALL) ALL' > /etc/sudoers.d/custodian-agt; expect_fail "sudoers entry"; rm /etc/sudoers.d/custodian-agt
|
|
sed -i 's/X11Forwarding no/X11Forwarding yes/; s/DisableForwarding yes/DisableForwarding no/' /etc/ssh/sshd_config.d/05-restricted-agents.conf
|
|
expect_fail "forwarding re-enabled"
|
|
echo "ALL CONTAINER CHECKS PASSED"
|