admin
a34aac64d0
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
24 lines
1.2 KiB
Plaintext
24 lines
1.2 KiB
Plaintext
# felhom-op operator sudoers (TASK H1) — install as /etc/sudoers.d/felhom-op (0440 root:root).
|
|
#
|
|
# The DEFAULT operator identity (login via felhom-sshd only; key in /etc/felhom-sshd/authorized_keys/
|
|
# felhom-op, outside ~/.ssh, so the customer's sshd never honours it [SF-3]). felhom-op is a normal
|
|
# login user with NO ambient privilege — it escalates ONLY through these explicit repair verbs, so a
|
|
# leaked operator key's blast radius is this verb set, not the box (locked decision §6). Deep repairs
|
|
# that genuinely need root (pct, deeper systemctl) remain available via `root` as a tunnel-gated
|
|
# break-glass account (PermitRootLogin prohibit-password on felhom-sshd), but the day-to-day identity
|
|
# is felhom-op.
|
|
Cmnd_Alias FELHOM_OP_REPAIR = \
|
|
/usr/bin/mkdir -p /run/sshd, \
|
|
/usr/bin/systemctl reset-failed wg-quick@wg-felhom, \
|
|
/usr/bin/systemctl restart wg-quick@wg-felhom, \
|
|
/usr/bin/systemctl start felhom-agent, \
|
|
/usr/bin/systemctl restart felhom-agent, \
|
|
/usr/bin/systemctl reset-failed felhom-sshd, \
|
|
/usr/bin/systemctl restart felhom-sshd, \
|
|
/usr/sbin/pct list, \
|
|
/usr/sbin/pct start [0-9]*, \
|
|
/usr/sbin/pct stop [0-9]*, \
|
|
/usr/sbin/pct unlock [0-9]*
|
|
|
|
felhom-op ALL=(root) NOPASSWD: FELHOM_OP_REPAIR
|