Archived
beatzaplentyandClaude Sonnet 4.6
0c15de3329
Secret Scan / Scan for secrets and sensitive config (push) Failing after 3s
- setup-ipa-sudo.sh: grants %admins group NOPASSWD sudo after ipa-client-install; writes admins-proxmox (pvesh/qm/pct) only when those binaries are present, so the same script works on PBS/PDM as well as PVE hosts - create-local-backdoor.sh: creates a local 'pveadmin' account with SSH key and NOPASSWD sudo as an emergency fallback when IPA/SSSD is unavailable; password set via BACKDOOR_PASS env var or prompted interactively - bootstrap.sh: appended post-IPA-enrollment reminder to the final checklist Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
46 lines
1.7 KiB
Bash
Executable File
46 lines
1.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# Grant the IPA 'admins' group passwordless sudo on this host.
|
|
#
|
|
# Writes two files:
|
|
# /etc/sudoers.d/admins-nopasswd -- NOPASSWD: ALL for general shell use
|
|
# /etc/sudoers.d/admins-proxmox -- NOPASSWD for pvesh/qm/pct (PVE only;
|
|
# skipped silently if those binaries
|
|
# aren't present, e.g. on PBS/PDM)
|
|
#
|
|
# Idempotent - safe to re-run. Run as root on the target host after
|
|
# ipa-client-install has been completed and SSSD is active.
|
|
#
|
|
# Usage: ./setup-ipa-sudo.sh
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=lib/common.sh
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
|
require_root
|
|
|
|
if [ ! -f /etc/ipa/default.conf ]; then
|
|
echo "ERROR: /etc/ipa/default.conf not found -- is this host enrolled in FreeIPA?" >&2
|
|
exit 1
|
|
fi
|
|
|
|
write_if_changed /etc/sudoers.d/admins-nopasswd '%admins ALL=(root) NOPASSWD: ALL'
|
|
chmod 0440 /etc/sudoers.d/admins-nopasswd
|
|
|
|
# PVE-specific tools -- pvesh moved from /usr/sbin to /usr/bin in PVE 8.x;
|
|
# resolve at script time so the path in the sudoers rule is always correct.
|
|
PVESH="$(command -v pvesh 2>/dev/null || true)"
|
|
QM="$(command -v qm 2>/dev/null || true)"
|
|
PCT="$(command -v pct 2>/dev/null || true)"
|
|
|
|
if [ -n "$PVESH" ] && [ -n "$QM" ] && [ -n "$PCT" ]; then
|
|
write_if_changed /etc/sudoers.d/admins-proxmox \
|
|
"%admins ALL=(root) NOPASSWD: ${PVESH}, ${QM}, ${PCT}"
|
|
chmod 0440 /etc/sudoers.d/admins-proxmox
|
|
echo "Proxmox tools found -- wrote admins-proxmox."
|
|
else
|
|
echo "pvesh/qm/pct not found -- skipping admins-proxmox (not a PVE host)."
|
|
fi
|
|
|
|
visudo -c >/dev/null
|
|
echo "All sudoers files valid. IPA admins group has sudo on this host."
|