From 6b6e4fce6f12c323b5a2d194d3dd8ddcdd23bf93 Mon Sep 17 00:00:00 2001 From: spektr Date: Thu, 29 Oct 2026 16:57:06 +0100 Subject: [PATCH] CT-101 Samba: dark2devil-Cleanup dokumentiert (erledigt 28.10.2026) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - GNAI-017/GNAI-019: Cleanup als erledigt markiert (smbpasswd -x dark2devil + userdel -r; passdb danach nur noch ghost/daidalaw/debugofen; Konto war gelockt, Shell /bin/false, keine Dateien außerhalb des Home) - Inventar-Kommentare aktualisiert (UID 1002 wieder frei; ansible-deploy-UID 1005 erlaeutert); alle drei Inventare byte-identisch - samba_access-Kommentar angepasst (dark2devil nicht mehr unter den produktiven Accounts) Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .../ct-101-samba/GNAI-017-PLAN_Samba-NFS-Export.md | 13 ++++++++----- .../ct-101-samba/GNAI-019-DEC_Ansible-Migration.md | 6 ++++-- .../inventories/agent/group_vars/samba_hosts.yml | 8 ++++---- .../inventories/agent/host_vars/samba-ct101.yml | 5 +++-- .../bootstrap/group_vars/samba_hosts.yml | 8 ++++---- .../inventories/bootstrap/host_vars/samba-ct101.yml | 5 +++-- .../production/group_vars/samba_hosts.yml | 8 ++++---- .../production/host_vars/samba-ct101.yml | 5 +++-- .../ansible/roles/samba_access/defaults/main.yml | 4 ++-- 9 files changed, 35 insertions(+), 27 deletions(-) diff --git a/docs/platform/proxmox-server/lxc/ct-101-samba/GNAI-017-PLAN_Samba-NFS-Export.md b/docs/platform/proxmox-server/lxc/ct-101-samba/GNAI-017-PLAN_Samba-NFS-Export.md index f4f4e93..0583f9d 100644 --- a/docs/platform/proxmox-server/lxc/ct-101-samba/GNAI-017-PLAN_Samba-NFS-Export.md +++ b/docs/platform/proxmox-server/lxc/ct-101-samba/GNAI-017-PLAN_Samba-NFS-Export.md @@ -27,7 +27,7 @@ offenen Punkte fest. Bestehende Shares bleiben unberührt. | Container-ID | CT 101 | | IPv4 | 10.0.0.9 | | Samba-Rolle | standalone server, Workgroup `Ghost.net` (aus `smb.conf`) | -| SMB-Benutzer | `ghost`, `daidalaw`, `debugofen` (die passdb enthält zusätzlich den Alt-Eintrag `dark2devil`, UID 1002 — dieselbe Person wie `debugofen`, nicht deklariert; siehe Abschnitt 6.8 (e) und GNAI-019 Entscheidung 11) | +| SMB-Benutzer | `ghost`, `daidalaw`, `debugofen` (der Alt-Eintrag `dark2devil`, UID 1002 — dieselbe Person wie `debugofen — wurde am 28.10.2026 per `smbpasswd -x` entfernt; siehe Abschnitt 6.8 (e) und GNAI-019 Entscheidung 11) | | Betriebssystem | Debian 13 (trixie) seit In-Place-Upgrade durch den Betreiber am 21.10.2026 (manuell; nicht via `scripts/upgrade-ct101-to-debian13.sh`) | | Hostname | `Samba` (großgeschrieben; FQDN `Samba.fritz.box`), erfasst am 27.10.2026; Inventory-Platzhalter `samba_expected_hostname` | | Ressourcen-Profil | 1 CPU (cpuset), 2048 MiB RAM, 2048 MiB Swap, 4 GiB Rootfs (lxcfs-/cgroup-Werte im Gast, 27.10.2026) | @@ -214,10 +214,13 @@ GNENC-002 Abschnitt 4): `input/`, `jd/`, `queue/`, `work/`, `output/`, Alt-Account. Die am 27.10.2026 beschlossene Gleichstellung mit `ghost` (GNAI-019 Entscheidung 11) wurde zurückgenommen: `dark2devil` ist nicht in `samba_media_users` deklariert, nicht Mitglied von `gn-media` und in keiner - Share-ACL eingetragen (die live `smb.conf` nennt ihn nirgends). Konto und - passdb-Eintrag bleiben auf der Adoption unangetastet (keine produktive - Account-Löschung ohne ausdrückliche Betreiberentscheidung); optionaler - Cleanup, Betreiberentscheidung: `smbpasswd -x dark2devil` auf CT 101. + Share-ACL eingetragen (die live `smb.conf` nennt ihn nirgends). + **Cleanup erledigt 28.10.2026 (Betreiberfreigabe):** SMB-Login per + `smbpasswd -x dark2devil` entfernt (`pdbedit -L` danach nur noch `ghost`, + `daidalaw`, `debugofen`), dann Konto, primäre Gruppe, Home und Mail-Spool + per `userdel -r dark2devil` gelöscht. Das Konto war seit 2024-03-11 gelockt + (`passwd -S`: L), Shell `/bin/false`, ohne `.ssh` und ohne Dateien + außerhalb des Home (UID 1002); die Gruppe `users` enthält es nicht mehr. (f) Der private `ghost`-SSH-Key erhielt am 27.10.2026 eine Passphrase (GNAI-011 Abschnitt 3.3); Entsperrung über den lokalen ssh-agent. (g) Mount-Topologie und diff --git a/docs/platform/proxmox-server/lxc/ct-101-samba/GNAI-019-DEC_Ansible-Migration.md b/docs/platform/proxmox-server/lxc/ct-101-samba/GNAI-019-DEC_Ansible-Migration.md index 5a07400..c61b296 100644 --- a/docs/platform/proxmox-server/lxc/ct-101-samba/GNAI-019-DEC_Ansible-Migration.md +++ b/docs/platform/proxmox-server/lxc/ct-101-samba/GNAI-019-DEC_Ansible-Migration.md @@ -292,8 +292,10 @@ Person sind (Lars Peuser) und `debugofen` der valide Account ist; Share-ACL eingetragen; die passdb-Asserts verlangen nur `ghost`, `daidalaw` und `debugofen`. Konto und passdb-Eintrag bleiben auf der Adoption unangetastet (keine produktive Account-Löschung ohne ausdrückliche -Betreiberentscheidung). Optionaler Cleanup (Betreiberentscheidung, nicht Teil -der Migration): `smbpasswd -x dark2devil` auf CT 101. +Betreiberentscheidung). **Cleanup erledigt 28.10.2026:** `smbpasswd -x +dark2devil` (passdb danach nur noch `ghost`, `daidalaw`, `debugofen`) und +`userdel -r dark2devil` (Konto, Gruppe, Home; gelockt seit 2024-03-11, Shell +`/bin/false`, keine Dateien außerhalb des Home). **Begründung:** Die Gleichstellung beruhte auf der Annahme, `dark2devil` sei ein aktiver privater Benutzer. Nach der Betreiberklärung ist die Person über diff --git a/proxmox/lxc/ct-101-samba/ansible/inventories/agent/group_vars/samba_hosts.yml b/proxmox/lxc/ct-101-samba/ansible/inventories/agent/group_vars/samba_hosts.yml index 38128d6..f486c16 100644 --- a/proxmox/lxc/ct-101-samba/ansible/inventories/agent/group_vars/samba_hosts.yml +++ b/proxmox/lxc/ct-101-samba/ansible/inventories/agent/group_vars/samba_hosts.yml @@ -39,10 +39,10 @@ samba_media_group_gid: 970 # Media accounts with their productive UIDs (recorded 2026-10-27 from # preflight.yml / audit-production.yml; fresh-state rebuild: missing accounts # are created with exactly these UIDs; existing accounts are only validated on -# the UID). The legacy account dark2devil (UID 1002) exists on the productive -# CT 101 but is deliberately NOT declared: it belongs to the same person as -# debugofen (operator clarification 2026-10-28, GNAI-019 decision 11) and is -# not referenced by any share in the live smb.conf. +# the UID). The legacy account dark2devil (UID 1002) — same person as +# debugofen — was deliberately not declared and was removed from the +# productive CT 101 on 2026-10-28 (cleanup, GNAI-019 decision 11); UID 1002 is +# free again. samba_media_users: - name: ghost uid: 1000 diff --git a/proxmox/lxc/ct-101-samba/ansible/inventories/agent/host_vars/samba-ct101.yml b/proxmox/lxc/ct-101-samba/ansible/inventories/agent/host_vars/samba-ct101.yml index a1693ff..83e0bf7 100644 --- a/proxmox/lxc/ct-101-samba/ansible/inventories/agent/host_vars/samba-ct101.yml +++ b/proxmox/lxc/ct-101-samba/ansible/inventories/agent/host_vars/samba-ct101.yml @@ -12,7 +12,8 @@ samba_expected_processor_vcpus: 1 samba_minimum_memory_mb: 2048 # UID of the existing ghost account (audit-production.yml): samba_access_admin_uid: 1000 -# Recorded UIDs (audit-production.yml): ghost-agent exists with 1004; -# ansible-deploy takes the lowest free UID >= 1000: +# Recorded UIDs (audit-production.yml, 2026-10-27): ghost-agent exists with +# 1004; ansible-deploy was assigned 1005 (lowest free UID >= 1000 at that +# time; kept fixed): samba_access_agent_uid: 1004 samba_access_deploy_uid: 1005 diff --git a/proxmox/lxc/ct-101-samba/ansible/inventories/bootstrap/group_vars/samba_hosts.yml b/proxmox/lxc/ct-101-samba/ansible/inventories/bootstrap/group_vars/samba_hosts.yml index 38128d6..f486c16 100644 --- a/proxmox/lxc/ct-101-samba/ansible/inventories/bootstrap/group_vars/samba_hosts.yml +++ b/proxmox/lxc/ct-101-samba/ansible/inventories/bootstrap/group_vars/samba_hosts.yml @@ -39,10 +39,10 @@ samba_media_group_gid: 970 # Media accounts with their productive UIDs (recorded 2026-10-27 from # preflight.yml / audit-production.yml; fresh-state rebuild: missing accounts # are created with exactly these UIDs; existing accounts are only validated on -# the UID). The legacy account dark2devil (UID 1002) exists on the productive -# CT 101 but is deliberately NOT declared: it belongs to the same person as -# debugofen (operator clarification 2026-10-28, GNAI-019 decision 11) and is -# not referenced by any share in the live smb.conf. +# the UID). The legacy account dark2devil (UID 1002) — same person as +# debugofen — was deliberately not declared and was removed from the +# productive CT 101 on 2026-10-28 (cleanup, GNAI-019 decision 11); UID 1002 is +# free again. samba_media_users: - name: ghost uid: 1000 diff --git a/proxmox/lxc/ct-101-samba/ansible/inventories/bootstrap/host_vars/samba-ct101.yml b/proxmox/lxc/ct-101-samba/ansible/inventories/bootstrap/host_vars/samba-ct101.yml index a1693ff..83e0bf7 100644 --- a/proxmox/lxc/ct-101-samba/ansible/inventories/bootstrap/host_vars/samba-ct101.yml +++ b/proxmox/lxc/ct-101-samba/ansible/inventories/bootstrap/host_vars/samba-ct101.yml @@ -12,7 +12,8 @@ samba_expected_processor_vcpus: 1 samba_minimum_memory_mb: 2048 # UID of the existing ghost account (audit-production.yml): samba_access_admin_uid: 1000 -# Recorded UIDs (audit-production.yml): ghost-agent exists with 1004; -# ansible-deploy takes the lowest free UID >= 1000: +# Recorded UIDs (audit-production.yml, 2026-10-27): ghost-agent exists with +# 1004; ansible-deploy was assigned 1005 (lowest free UID >= 1000 at that +# time; kept fixed): samba_access_agent_uid: 1004 samba_access_deploy_uid: 1005 diff --git a/proxmox/lxc/ct-101-samba/ansible/inventories/production/group_vars/samba_hosts.yml b/proxmox/lxc/ct-101-samba/ansible/inventories/production/group_vars/samba_hosts.yml index 38128d6..f486c16 100644 --- a/proxmox/lxc/ct-101-samba/ansible/inventories/production/group_vars/samba_hosts.yml +++ b/proxmox/lxc/ct-101-samba/ansible/inventories/production/group_vars/samba_hosts.yml @@ -39,10 +39,10 @@ samba_media_group_gid: 970 # Media accounts with their productive UIDs (recorded 2026-10-27 from # preflight.yml / audit-production.yml; fresh-state rebuild: missing accounts # are created with exactly these UIDs; existing accounts are only validated on -# the UID). The legacy account dark2devil (UID 1002) exists on the productive -# CT 101 but is deliberately NOT declared: it belongs to the same person as -# debugofen (operator clarification 2026-10-28, GNAI-019 decision 11) and is -# not referenced by any share in the live smb.conf. +# the UID). The legacy account dark2devil (UID 1002) — same person as +# debugofen — was deliberately not declared and was removed from the +# productive CT 101 on 2026-10-28 (cleanup, GNAI-019 decision 11); UID 1002 is +# free again. samba_media_users: - name: ghost uid: 1000 diff --git a/proxmox/lxc/ct-101-samba/ansible/inventories/production/host_vars/samba-ct101.yml b/proxmox/lxc/ct-101-samba/ansible/inventories/production/host_vars/samba-ct101.yml index a1693ff..83e0bf7 100644 --- a/proxmox/lxc/ct-101-samba/ansible/inventories/production/host_vars/samba-ct101.yml +++ b/proxmox/lxc/ct-101-samba/ansible/inventories/production/host_vars/samba-ct101.yml @@ -12,7 +12,8 @@ samba_expected_processor_vcpus: 1 samba_minimum_memory_mb: 2048 # UID of the existing ghost account (audit-production.yml): samba_access_admin_uid: 1000 -# Recorded UIDs (audit-production.yml): ghost-agent exists with 1004; -# ansible-deploy takes the lowest free UID >= 1000: +# Recorded UIDs (audit-production.yml, 2026-10-27): ghost-agent exists with +# 1004; ansible-deploy was assigned 1005 (lowest free UID >= 1000 at that +# time; kept fixed): samba_access_agent_uid: 1004 samba_access_deploy_uid: 1005 diff --git a/proxmox/lxc/ct-101-samba/ansible/roles/samba_access/defaults/main.yml b/proxmox/lxc/ct-101-samba/ansible/roles/samba_access/defaults/main.yml index 7eda7ab..b31aae1 100644 --- a/proxmox/lxc/ct-101-samba/ansible/roles/samba_access/defaults/main.yml +++ b/proxmox/lxc/ct-101-samba/ansible/roles/samba_access/defaults/main.yml @@ -23,6 +23,6 @@ samba_access_sudoers_file: /etc/sudoers.d/90-ghostnet-ansible-deploy # CT 101 is an adopted legacy LXC: the personal administrator account ghost # already exists with its productive UID and is only validated here, never # recreated. ghost-agent (1004) and ansible-deploy (1005) are created with -# fixed UIDs because the existing accounts ghost/daidalaw/dark2devil/ -# debugofen already occupy the low UID range (recorded 2026-10-27; the +# fixed UIDs because the productive accounts ghost (1000), daidalaw (1001) +# and debugofen (1003) occupy the low UID range (recorded 2026-10-27; the # inventory host_vars carry the same values).