admin
ac90169a5d
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
26 lines
1.4 KiB
Plaintext
26 lines
1.4 KiB
Plaintext
# felhom-op operator sudoers (TASK H1) — install as /etc/sudoers.d/felhom-op (0440 root:root).
|
|
#
|
|
# The DEFAULT operator identity (login via felhom-sshd only; key in /etc/felhom-sshd/authorized_keys/
|
|
# felhom-op, outside ~/.ssh, so the customer's sshd never honours it [SF-3]). felhom-op is a normal
|
|
# login user with NO ambient privilege — it escalates ONLY through these explicit repair verbs, so a
|
|
# leaked operator key's blast radius is this verb set, not the box (locked decision §6). Deep repairs
|
|
# that genuinely need root (pct, deeper systemctl) remain available via `root` as a tunnel-gated
|
|
# break-glass account (PermitRootLogin prohibit-password on felhom-sshd), but the day-to-day identity
|
|
# is felhom-op.
|
|
Cmnd_Alias FELHOM_OP_REPAIR = \
|
|
/usr/bin/mkdir -p /run/sshd, \
|
|
/usr/bin/systemctl reset-failed wg-quick@wg-felhom, \
|
|
/usr/bin/systemctl restart wg-quick@wg-felhom, \
|
|
/usr/bin/systemctl start felhom-agent, \
|
|
/usr/bin/systemctl restart felhom-agent, \
|
|
/usr/bin/systemctl reset-failed felhom-sshd, \
|
|
/usr/bin/systemctl restart felhom-sshd, \
|
|
/usr/sbin/pct list, \
|
|
/usr/sbin/pct ^start [0-9]+$, \
|
|
/usr/sbin/pct ^stop [0-9]+$, \
|
|
/usr/sbin/pct ^unlock [0-9]+$
|
|
|
|
# R-861 (b) B2 (`09` §3 decision 165, hygiene): one numeric vmid per pct verb, anchored — the old glob `[0-9]*` also
|
|
# matched spaces, so `pct stop 9201 --skiplock 1` passed. Pinned by TestFelhomOpSudoersPctIsExact.
|
|
felhom-op ALL=(root) NOPASSWD: FELHOM_OP_REPAIR
|