Archived
beatzaplenty
2cca6a7dc0
Splits the repo into Stage 1 (base host config/hardening, applies to any node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC hardware can't support the assumed split-disk/multi-NIC layout). Adds the Stage 1 toolset: firewall deploy, named admin user creation, unattended security upgrades, subscription-nag removal (with an apt hook so the patch survives package updates), and a read-only audit script. Fixes switch-to-no-subscription-repo.sh, which only handled the legacy .list format and silently no-op'd against PVE 9's deb822 .sources files; it now removes enterprise sources outright rather than commenting them out. Shared logic (root check, idempotent file writes, backups) factored into scripts/lib/common.sh. Ran the full sequence against pve1 via scripts/bootstrap.sh + create-admin-user.sh; scripts/audit.sh confirms all checks pass.
44 lines
1.5 KiB
Bash
Executable File
44 lines
1.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# Create a named PVE admin user (Administrator role) so root@pam can be
|
|
# reserved for emergencies. Generates a random initial password, printed
|
|
# once - change it and enable TOTP on first login (Datacenter -> Permissions
|
|
# -> Two Factor, or the user icon menu in the top right).
|
|
#
|
|
# Idempotent - if the user already exists, does nothing (won't reset an
|
|
# existing password). Run as root on the PVE host.
|
|
#
|
|
# Usage: ./create-admin-user.sh <username> (realm is always @pve)
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=lib/common.sh
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
|
require_root
|
|
|
|
USERNAME="${1:-}"
|
|
if [ -z "$USERNAME" ]; then
|
|
echo "Usage: $0 <username>" >&2
|
|
exit 1
|
|
fi
|
|
|
|
USERID="${USERNAME}@pve"
|
|
|
|
if pveum user list --output-format json 2>/dev/null | grep -q "\"${USERID}\""; then
|
|
echo "${USERID} already exists - not touching password or role. Skipping."
|
|
exit 0
|
|
fi
|
|
|
|
PASSWORD="$(openssl rand -base64 24)"
|
|
|
|
pveum user add "$USERID" --password "$PASSWORD" --comment "Named admin account, created by create-admin-user.sh"
|
|
pveum acl modify / --users "$USERID" --roles Administrator
|
|
|
|
echo
|
|
echo "Created ${USERID} with the Administrator role."
|
|
echo "Initial password (shown once - not logged anywhere): ${PASSWORD}"
|
|
echo
|
|
echo "Next steps (do these before relying on this account):"
|
|
echo " 1. Log in as ${USERID} and change the password."
|
|
echo " 2. Enable TOTP/2FA for ${USERID} (and for root@pam)."
|
|
echo " 3. Reserve root@pam for emergencies only from here on."
|