CT-101 Samba: ghost-Key-Rotation und Audit-Fixes (pdbedit-Pfad, passdb-Subset, is-active-Probes)
- ghost-Workstation-Key rotiert (Passphrase nicht mehr erinnerlich): neues Paar id_ed25519_ghostnet_ct101_ghost, samba-ghost.pub aktualisiert und auf CT 101 installiert; GNAI-017 Befund (f) dokumentiert die Rotation 29.10.2026; altes Paar lokal gelöscht - pdbedit-Pfad korrigiert: /usr/sbin/pdbedit -> /usr/bin/pdbedit (Debian), 5 Stellen in audit-production/backup/verify-production/samba_smb - passdb-Subset-Asserts parsen user:uid:gecos jetzt korrekt per regex_replace (audit/verify/samba_smb) - is-active-Leseproben mit failed_when: false, damit die Asserts die klaren Fehlermeldungen liefern (audit/preflight/verify/samba_smb) - samba_lxc_baseline enabled+startet unattended-upgrades.service nach dem Paket-Install (CT-100/102-Konvention), README ergänzt Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
This commit is contained in:
@@ -223,7 +223,15 @@ GNENC-002 Abschnitt 4): `input/`, `jd/`, `queue/`, `work/`, `output/`,
|
||||
außerhalb des Home (UID 1002); die Gruppe `users` enthält es nicht mehr.
|
||||
(f) Der private
|
||||
`ghost`-SSH-Key erhielt am 27.10.2026 eine Passphrase (GNAI-011 Abschnitt
|
||||
3.3); Entsperrung über den lokalen ssh-agent. (g) Mount-Topologie und
|
||||
3.3); Entsperrung über den lokalen ssh-agent. **Key-Rotation 29.10.2026:**
|
||||
Der Betreiber konnte sich die Passphrase nicht merken; das Paar
|
||||
`id_ed25519_ghostnet_ct101_ghost` wurde daher neu erzeugt (neue Passphrase,
|
||||
nur lokal beim Betreiber, nirgends protokolliert), der Public Key in
|
||||
`files/ssh/samba-ghost.pub` aktualisiert und auf CT 101 in
|
||||
`/home/ghost/.ssh/authorized_keys` ausgetauscht (Restrictions beibehalten,
|
||||
alte Zeile entfernt). Das alte Paar liegt bis zur erfolgreichen
|
||||
Audit-Anmeldung lokal als `id_ed25519_ghostnet_ct101_ghost.old` und wird
|
||||
danach gelöscht. (g) Mount-Topologie und
|
||||
Ressourcen-Profil erfasst (27.10.2026, nach dem Reboot): Sechs Medien-Mounts
|
||||
sind produktiv eingehängt — `/media/daten1`, `/media/daten2`,
|
||||
`/media/daten3` (btrfs), `/media/datenhdd1` (ext4, leer, Verzeichnis auf der
|
||||
|
||||
@@ -1 +1 @@
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICBlIsYEO2YSZVsWvLg891kh6JbMyS1eU+ypSVqXOId+ ghost@ghostnet-ct101
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIChqL4SbGGBf0cnGyciE4RMvqpua/GoYcmz++BR2bdqW ghost@ghostnet-ct101
|
||||
|
||||
@@ -93,7 +93,7 @@
|
||||
- name: Read the productive Samba user database
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- /usr/sbin/pdbedit
|
||||
- /usr/bin/pdbedit
|
||||
- -L
|
||||
check_mode: false
|
||||
changed_when: false
|
||||
@@ -105,7 +105,7 @@
|
||||
- samba_audit_pdbedit.rc == 0
|
||||
- >-
|
||||
samba_media_users | map(attribute='name') | list is
|
||||
subset(samba_audit_pdbedit.stdout_lines)
|
||||
subset(samba_audit_pdbedit.stdout_lines | map('regex_replace', '(:.*)$', '') | list)
|
||||
fail_msg: >-
|
||||
The productive SMB users ghost, daidalaw and debugofen
|
||||
are missing from the passdb. Stop the adoption; the passdb must not
|
||||
@@ -268,6 +268,7 @@
|
||||
- "{{ item }}"
|
||||
check_mode: false
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
loop:
|
||||
- ssh.service
|
||||
- smbd.service
|
||||
|
||||
@@ -120,7 +120,7 @@
|
||||
- name: Read the Samba user list
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- /usr/sbin/pdbedit
|
||||
- /usr/bin/pdbedit
|
||||
- -L
|
||||
check_mode: false
|
||||
changed_when: false
|
||||
|
||||
@@ -172,6 +172,7 @@
|
||||
- "{{ item }}"
|
||||
check_mode: false
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
loop:
|
||||
- ssh.service
|
||||
- smbd.service
|
||||
|
||||
@@ -374,7 +374,7 @@
|
||||
- name: Read the Samba user database
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- /usr/sbin/pdbedit
|
||||
- /usr/bin/pdbedit
|
||||
- -L
|
||||
check_mode: false
|
||||
changed_when: false
|
||||
@@ -385,7 +385,7 @@
|
||||
that:
|
||||
- >-
|
||||
samba_media_users | map(attribute='name') | list is
|
||||
subset(samba_production_pdbedit.stdout_lines)
|
||||
subset(samba_production_pdbedit.stdout_lines | map('regex_replace', '(:.*)$', '') | list)
|
||||
fail_msg: >-
|
||||
The productive SMB users ghost, daidalaw and debugofen
|
||||
are missing from the passdb (GNAI-018 R5). On a fresh-state rebuild,
|
||||
@@ -546,6 +546,7 @@
|
||||
- "{{ item }}"
|
||||
check_mode: false
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
loop:
|
||||
- ssh.service
|
||||
- nftables.service
|
||||
|
||||
@@ -2,8 +2,10 @@
|
||||
|
||||
Declaratively manages the CT 101 Samba LXC baseline: guest identity
|
||||
(hostname `Samba`, Debian 13, `10.0.0.9`, LXC guest, systemd), the unprivileged
|
||||
ID-mapping premise, baseline administration packages, the `Europe/Berlin`
|
||||
timezone and the protected Ghostnet configuration/data/backup directories.
|
||||
ID-mapping premise, baseline administration packages (afterwards
|
||||
`unattended-upgrades.service` is enabled and started — CT 100/102 convention),
|
||||
the `Europe/Berlin` timezone and the protected Ghostnet configuration/data/
|
||||
backup directories.
|
||||
It also masks `sys-kernel-config.mount` (configfs is unavailable in
|
||||
unprivileged LXC; CT 100/102/103 convention) and clears a stale failed state,
|
||||
so the no-failed-units gate of `playbooks/preflight.yml` holds.
|
||||
|
||||
@@ -92,6 +92,13 @@
|
||||
cache_valid_time: 3600
|
||||
install_recommends: false
|
||||
|
||||
- name: Enable and start the unattended-upgrades service (CT 100/102 convention)
|
||||
ansible.builtin.systemd_service:
|
||||
name: unattended-upgrades.service
|
||||
enabled: true
|
||||
state: started
|
||||
daemon_reload: true
|
||||
|
||||
- name: Set the local timezone database link
|
||||
ansible.builtin.file:
|
||||
src: "/usr/share/zoneinfo/{{ samba_lxc_baseline_timezone }}"
|
||||
|
||||
@@ -30,7 +30,7 @@
|
||||
- name: Read the Samba user database before convergence
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- /usr/sbin/pdbedit
|
||||
- /usr/bin/pdbedit
|
||||
- -L
|
||||
check_mode: false
|
||||
changed_when: false
|
||||
@@ -96,7 +96,7 @@
|
||||
- name: Read the Samba user database after convergence
|
||||
ansible.builtin.command:
|
||||
argv:
|
||||
- /usr/sbin/pdbedit
|
||||
- /usr/bin/pdbedit
|
||||
- -L
|
||||
check_mode: false
|
||||
changed_when: false
|
||||
@@ -111,7 +111,7 @@
|
||||
samba_smb_passdb_before.stdout_lines | sort
|
||||
- >-
|
||||
samba_media_users | map(attribute='name') | list is
|
||||
subset(samba_smb_passdb_after.stdout_lines)
|
||||
subset(samba_smb_passdb_after.stdout_lines | map('regex_replace', '(:.*)$', '') | list)
|
||||
fail_msg: >-
|
||||
The Samba user database changed during convergence. The productive
|
||||
users ghost, daidalaw and debugofen must be preserved
|
||||
@@ -155,6 +155,7 @@
|
||||
- "{{ item }}"
|
||||
check_mode: false
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
loop: "{{ samba_smb_service_units }}"
|
||||
loop_control:
|
||||
label: "{{ item }}"
|
||||
|
||||
Reference in New Issue
Block a user