CT-101 Samba: dark2devil-Cleanup dokumentiert (erledigt 28.10.2026)
- GNAI-017/GNAI-019: Cleanup als erledigt markiert (smbpasswd -x dark2devil + userdel -r; passdb danach nur noch ghost/daidalaw/debugofen; Konto war gelockt, Shell /bin/false, keine Dateien außerhalb des Home) - Inventar-Kommentare aktualisiert (UID 1002 wieder frei; ansible-deploy-UID 1005 erlaeutert); alle drei Inventare byte-identisch - samba_access-Kommentar angepasst (dark2devil nicht mehr unter den produktiven Accounts) Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
This commit is contained in:
@@ -27,7 +27,7 @@ offenen Punkte fest. Bestehende Shares bleiben unberührt.
|
||||
| Container-ID | CT 101 |
|
||||
| IPv4 | 10.0.0.9 |
|
||||
| Samba-Rolle | standalone server, Workgroup `Ghost.net` (aus `smb.conf`) |
|
||||
| SMB-Benutzer | `ghost`, `daidalaw`, `debugofen` (die passdb enthält zusätzlich den Alt-Eintrag `dark2devil`, UID 1002 — dieselbe Person wie `debugofen`, nicht deklariert; siehe Abschnitt 6.8 (e) und GNAI-019 Entscheidung 11) |
|
||||
| SMB-Benutzer | `ghost`, `daidalaw`, `debugofen` (der Alt-Eintrag `dark2devil`, UID 1002 — dieselbe Person wie `debugofen — wurde am 28.10.2026 per `smbpasswd -x` entfernt; siehe Abschnitt 6.8 (e) und GNAI-019 Entscheidung 11) |
|
||||
| Betriebssystem | Debian 13 (trixie) seit In-Place-Upgrade durch den Betreiber am 21.10.2026 (manuell; nicht via `scripts/upgrade-ct101-to-debian13.sh`) |
|
||||
| Hostname | `Samba` (großgeschrieben; FQDN `Samba.fritz.box`), erfasst am 27.10.2026; Inventory-Platzhalter `samba_expected_hostname` |
|
||||
| Ressourcen-Profil | 1 CPU (cpuset), 2048 MiB RAM, 2048 MiB Swap, 4 GiB Rootfs (lxcfs-/cgroup-Werte im Gast, 27.10.2026) |
|
||||
@@ -214,10 +214,13 @@ GNENC-002 Abschnitt 4): `input/`, `jd/`, `queue/`, `work/`, `output/`,
|
||||
Alt-Account. Die am 27.10.2026 beschlossene Gleichstellung mit `ghost`
|
||||
(GNAI-019 Entscheidung 11) wurde zurückgenommen: `dark2devil` ist nicht in
|
||||
`samba_media_users` deklariert, nicht Mitglied von `gn-media` und in keiner
|
||||
Share-ACL eingetragen (die live `smb.conf` nennt ihn nirgends). Konto und
|
||||
passdb-Eintrag bleiben auf der Adoption unangetastet (keine produktive
|
||||
Account-Löschung ohne ausdrückliche Betreiberentscheidung); optionaler
|
||||
Cleanup, Betreiberentscheidung: `smbpasswd -x dark2devil` auf CT 101.
|
||||
Share-ACL eingetragen (die live `smb.conf` nennt ihn nirgends).
|
||||
**Cleanup erledigt 28.10.2026 (Betreiberfreigabe):** SMB-Login per
|
||||
`smbpasswd -x dark2devil` entfernt (`pdbedit -L` danach nur noch `ghost`,
|
||||
`daidalaw`, `debugofen`), dann Konto, primäre Gruppe, Home und Mail-Spool
|
||||
per `userdel -r dark2devil` gelöscht. Das Konto war seit 2024-03-11 gelockt
|
||||
(`passwd -S`: L), Shell `/bin/false`, ohne `.ssh` und ohne Dateien
|
||||
außerhalb des Home (UID 1002); die Gruppe `users` enthält es nicht mehr.
|
||||
(f) Der private
|
||||
`ghost`-SSH-Key erhielt am 27.10.2026 eine Passphrase (GNAI-011 Abschnitt
|
||||
3.3); Entsperrung über den lokalen ssh-agent. (g) Mount-Topologie und
|
||||
|
||||
@@ -292,8 +292,10 @@ Person sind (Lars Peuser) und `debugofen` der valide Account ist;
|
||||
Share-ACL eingetragen; die passdb-Asserts verlangen nur `ghost`, `daidalaw`
|
||||
und `debugofen`. Konto und passdb-Eintrag bleiben auf der Adoption
|
||||
unangetastet (keine produktive Account-Löschung ohne ausdrückliche
|
||||
Betreiberentscheidung). Optionaler Cleanup (Betreiberentscheidung, nicht Teil
|
||||
der Migration): `smbpasswd -x dark2devil` auf CT 101.
|
||||
Betreiberentscheidung). **Cleanup erledigt 28.10.2026:** `smbpasswd -x
|
||||
dark2devil` (passdb danach nur noch `ghost`, `daidalaw`, `debugofen`) und
|
||||
`userdel -r dark2devil` (Konto, Gruppe, Home; gelockt seit 2024-03-11, Shell
|
||||
`/bin/false`, keine Dateien außerhalb des Home).
|
||||
|
||||
**Begründung:** Die Gleichstellung beruhte auf der Annahme, `dark2devil` sei
|
||||
ein aktiver privater Benutzer. Nach der Betreiberklärung ist die Person über
|
||||
|
||||
@@ -39,10 +39,10 @@ samba_media_group_gid: 970
|
||||
# Media accounts with their productive UIDs (recorded 2026-10-27 from
|
||||
# preflight.yml / audit-production.yml; fresh-state rebuild: missing accounts
|
||||
# are created with exactly these UIDs; existing accounts are only validated on
|
||||
# the UID). The legacy account dark2devil (UID 1002) exists on the productive
|
||||
# CT 101 but is deliberately NOT declared: it belongs to the same person as
|
||||
# debugofen (operator clarification 2026-10-28, GNAI-019 decision 11) and is
|
||||
# not referenced by any share in the live smb.conf.
|
||||
# the UID). The legacy account dark2devil (UID 1002) — same person as
|
||||
# debugofen — was deliberately not declared and was removed from the
|
||||
# productive CT 101 on 2026-10-28 (cleanup, GNAI-019 decision 11); UID 1002 is
|
||||
# free again.
|
||||
samba_media_users:
|
||||
- name: ghost
|
||||
uid: 1000
|
||||
|
||||
@@ -12,7 +12,8 @@ samba_expected_processor_vcpus: 1
|
||||
samba_minimum_memory_mb: 2048
|
||||
# UID of the existing ghost account (audit-production.yml):
|
||||
samba_access_admin_uid: 1000
|
||||
# Recorded UIDs (audit-production.yml): ghost-agent exists with 1004;
|
||||
# ansible-deploy takes the lowest free UID >= 1000:
|
||||
# Recorded UIDs (audit-production.yml, 2026-10-27): ghost-agent exists with
|
||||
# 1004; ansible-deploy was assigned 1005 (lowest free UID >= 1000 at that
|
||||
# time; kept fixed):
|
||||
samba_access_agent_uid: 1004
|
||||
samba_access_deploy_uid: 1005
|
||||
|
||||
@@ -39,10 +39,10 @@ samba_media_group_gid: 970
|
||||
# Media accounts with their productive UIDs (recorded 2026-10-27 from
|
||||
# preflight.yml / audit-production.yml; fresh-state rebuild: missing accounts
|
||||
# are created with exactly these UIDs; existing accounts are only validated on
|
||||
# the UID). The legacy account dark2devil (UID 1002) exists on the productive
|
||||
# CT 101 but is deliberately NOT declared: it belongs to the same person as
|
||||
# debugofen (operator clarification 2026-10-28, GNAI-019 decision 11) and is
|
||||
# not referenced by any share in the live smb.conf.
|
||||
# the UID). The legacy account dark2devil (UID 1002) — same person as
|
||||
# debugofen — was deliberately not declared and was removed from the
|
||||
# productive CT 101 on 2026-10-28 (cleanup, GNAI-019 decision 11); UID 1002 is
|
||||
# free again.
|
||||
samba_media_users:
|
||||
- name: ghost
|
||||
uid: 1000
|
||||
|
||||
@@ -12,7 +12,8 @@ samba_expected_processor_vcpus: 1
|
||||
samba_minimum_memory_mb: 2048
|
||||
# UID of the existing ghost account (audit-production.yml):
|
||||
samba_access_admin_uid: 1000
|
||||
# Recorded UIDs (audit-production.yml): ghost-agent exists with 1004;
|
||||
# ansible-deploy takes the lowest free UID >= 1000:
|
||||
# Recorded UIDs (audit-production.yml, 2026-10-27): ghost-agent exists with
|
||||
# 1004; ansible-deploy was assigned 1005 (lowest free UID >= 1000 at that
|
||||
# time; kept fixed):
|
||||
samba_access_agent_uid: 1004
|
||||
samba_access_deploy_uid: 1005
|
||||
|
||||
@@ -39,10 +39,10 @@ samba_media_group_gid: 970
|
||||
# Media accounts with their productive UIDs (recorded 2026-10-27 from
|
||||
# preflight.yml / audit-production.yml; fresh-state rebuild: missing accounts
|
||||
# are created with exactly these UIDs; existing accounts are only validated on
|
||||
# the UID). The legacy account dark2devil (UID 1002) exists on the productive
|
||||
# CT 101 but is deliberately NOT declared: it belongs to the same person as
|
||||
# debugofen (operator clarification 2026-10-28, GNAI-019 decision 11) and is
|
||||
# not referenced by any share in the live smb.conf.
|
||||
# the UID). The legacy account dark2devil (UID 1002) — same person as
|
||||
# debugofen — was deliberately not declared and was removed from the
|
||||
# productive CT 101 on 2026-10-28 (cleanup, GNAI-019 decision 11); UID 1002 is
|
||||
# free again.
|
||||
samba_media_users:
|
||||
- name: ghost
|
||||
uid: 1000
|
||||
|
||||
@@ -12,7 +12,8 @@ samba_expected_processor_vcpus: 1
|
||||
samba_minimum_memory_mb: 2048
|
||||
# UID of the existing ghost account (audit-production.yml):
|
||||
samba_access_admin_uid: 1000
|
||||
# Recorded UIDs (audit-production.yml): ghost-agent exists with 1004;
|
||||
# ansible-deploy takes the lowest free UID >= 1000:
|
||||
# Recorded UIDs (audit-production.yml, 2026-10-27): ghost-agent exists with
|
||||
# 1004; ansible-deploy was assigned 1005 (lowest free UID >= 1000 at that
|
||||
# time; kept fixed):
|
||||
samba_access_agent_uid: 1004
|
||||
samba_access_deploy_uid: 1005
|
||||
|
||||
@@ -23,6 +23,6 @@ samba_access_sudoers_file: /etc/sudoers.d/90-ghostnet-ansible-deploy
|
||||
# CT 101 is an adopted legacy LXC: the personal administrator account ghost
|
||||
# already exists with its productive UID and is only validated here, never
|
||||
# recreated. ghost-agent (1004) and ansible-deploy (1005) are created with
|
||||
# fixed UIDs because the existing accounts ghost/daidalaw/dark2devil/
|
||||
# debugofen already occupy the low UID range (recorded 2026-10-27; the
|
||||
# fixed UIDs because the productive accounts ghost (1000), daidalaw (1001)
|
||||
# and debugofen (1003) occupy the low UID range (recorded 2026-10-27; the
|
||||
# inventory host_vars carry the same values).
|
||||
|
||||
Reference in New Issue
Block a user