79 lines
5.5 KiB
Plaintext
79 lines
5.5 KiB
Plaintext
# Part 2 — agent 0.163.0 (operator go 2026-10-23), read 2026-10-23T07:28:53Z
|
|
|
|
## release (scripts/release-agent.sh at felhom-agent 1109092, CI 2246 green; CHANGELOG b4721ee CI 2249 green)
|
|
[release-agent] built ok: sha256 561b5316cd511de9fa9d8b8be4553da7add684f715d3bea533ca330ff7f3763c
|
|
[release-agent] config bundle built: sha256 3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8
|
|
[publish-agent] upload OK (HTTP 201)
|
|
[publish-agent] round-trip GET verified (sha256 matches)
|
|
[release-agent] config bundle published (HTTP 201)
|
|
sha256 : 561b5316cd511de9fa9d8b8be4553da7add684f715d3bea533ca330ff7f3763c
|
|
bundle : 3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8 (felhom-config-bundle.json — vouch it with the agent)
|
|
* [new tag] v0.163.0 -> v0.163.0
|
|
|
|
## step bundle (R-880: the D4 drop-in is a NEW path; the boxes ran bundle 0.160.0 = 6b06090190ff609af1fe9842447ebf385fd52da4be382bc7ca708b558c8e202f)
|
|
0.163.0-step1 = base 0.160.0 with only /usr/local/sbin/felhom-os-apply replaced; sha256 6cbc066902d5f3294765d5c7dc7113166c1dca25e994dbc36bfc5f139bb61fcf; PUT 201; read back by download: same sha
|
|
|
|
## delivery: three signed jobs per box (felhom-opsign, key felhom-op-1): agent_update 06:48Z, agent_config_update 0.163.0-step1 06:59Z, agent_config_update 0.163.0 07:19Z
|
|
|
|
## hp (192.168.0.104) 2026-10-23T07:26:29Z
|
|
agent: felhom-agent 0.163.0
|
|
bundle: 0.163.0 3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8 2026-10-23T07:19:44Z
|
|
1 BUNDLE DONE agent=0.163.0 written=1 same=30 self-check=ok
|
|
2 BUNDLE DONE agent=0.163.0-step1 written=1 same=29 self-check=ok
|
|
guest 9201: memory: 25898 swap: 25898
|
|
guest 9202: memory: 25898 swap: 512
|
|
guest 9401: memory: 10240 swap: 0
|
|
drop-in: -rw-r--r-- 1 root root 690 Oct 23 09:19 /etc/ssh/sshd_config.d/10-felhom-root-key-only.conf
|
|
drop-in content: PermitRootLogin prohibit-password
|
|
sshd -T: permitrootlogin without-password
|
|
root password set (passwd -S): P
|
|
felhom-sshd: active; its root policy: permitrootlogin without-password
|
|
felhom-sshd listens: 0.0.0.0:8822 [::]:8822 config test: ok; firewall admits only: elements = { 10.77.0.250 }
|
|
main sshd reloaded after the drop-in: Oct 23 09:19:44 demo-hp sshd[1010]: Received SIGHUP; restarting. Oct 23 09:19:44 demo-hp systemd[1]: Reloaded ssh.service - OpenBSD Secure Shell server.
|
|
pveproxy: active
|
|
main sshd banner from DooPlex (:22): SSH-2.0-OpenSSH_10.0p2 Debian-7+deb13u4
|
|
key login: ok
|
|
root password attempt rc=255 (non-zero = refused)
|
|
Oct 23 09:26:37 demo-hp sshd-session[3026730]: Failed password for root from 192.168.0.180 port 34150 ssh2
|
|
## root@192.168.0.154 (192.168.0.154) 2026-10-23T07:28:00Z
|
|
agent: felhom-agent 0.163.0
|
|
bundle: 0.163.0 3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8 2026-10-23T07:27:38Z
|
|
2 BUNDLE DONE agent=0.163.0 written=1 same=30 self-check=ok
|
|
2 BUNDLE DONE agent=0.163.0-step1 written=1 same=29 self-check=ok
|
|
guest 9201: memory: 4096 swap: 4096
|
|
guest 990000: memory: 4096 swap: 512
|
|
drop-in: -rw-r--r-- 1 root root 690 Oct 23 09:27 /etc/ssh/sshd_config.d/10-felhom-root-key-only.conf
|
|
drop-in content: PermitRootLogin prohibit-password
|
|
sshd -T: permitrootlogin without-password
|
|
root password set (passwd -S): P
|
|
felhom-sshd: active; its root policy: permitrootlogin without-password
|
|
felhom-sshd listens: 0.0.0.0:8822 [::]:8822 config test: ok; firewall admits only: elements = { 10.77.0.250 }
|
|
main sshd reloaded after the drop-in: Oct 23 09:27:38 felhom sshd[890]: Received SIGHUP; restarting. Oct 23 09:27:38 felhom systemd[1]: Reloaded ssh.service - OpenBSD Secure Shell server.
|
|
pveproxy: active
|
|
main sshd banner from DooPlex (:22): SSH-2.0-OpenSSH_10.0p2 Debian-7+deb13u4
|
|
key login: ok
|
|
root password attempt rc=255 (non-zero = refused)
|
|
Oct 23 09:28:08 felhom sshd-session[4184378]: Failed password for root from 192.168.0.180 port 33442 ssh2
|
|
## felhom-pve (192.168.0.162) 2026-10-23T07:28:11Z
|
|
agent: felhom-agent 0.163.0
|
|
bundle: 0.163.0 3afb88d9fbbc4adc16083fa52a98cd4974583c6378a77a1a6e0ed8ae6d1b80c8 2026-10-23T07:24:43Z
|
|
2 BUNDLE DONE agent=0.163.0 written=1 same=30 self-check=ok
|
|
2 BUNDLE DONE agent=0.163.0-step1 written=1 same=29 self-check=ok
|
|
guest 9201: memory: 12288 swap: 12288
|
|
drop-in: -rw-r--r-- 1 root root 690 Oct 23 09:24 /etc/ssh/sshd_config.d/10-felhom-root-key-only.conf
|
|
drop-in content: PermitRootLogin prohibit-password
|
|
sshd -T: permitrootlogin without-password
|
|
root password set (passwd -S): P
|
|
felhom-sshd: active; its root policy: permitrootlogin without-password
|
|
felhom-sshd listens: 0.0.0.0:8822 [::]:8822 config test: ok; firewall admits only: elements = { 10.77.0.250 }
|
|
main sshd reloaded after the drop-in: Oct 23 09:24:42 demo-felhom sshd[1011]: Received SIGHUP; restarting. Oct 23 09:24:42 demo-felhom systemd[1]: Reloaded ssh.service - OpenBSD Secure Shell server
|
|
pveproxy: active
|
|
main sshd banner from DooPlex (:22): SSH-2.0-OpenSSH_10.0p2 Debian-7+deb13u4
|
|
key login: ok
|
|
root password attempt rc=255 (non-zero = refused)
|
|
|
|
## notes
|
|
- felhom-sshd :8822 admits only the operator peer 10.77.0.250 over wg-felhom (H1); a connection test from DooPlex times out BY DESIGN — proven: active, listening, sshd -t ok, firewall set.
|
|
- a dummy root password is logged as 'Failed password' (OpenSSH refuses a root password silently under prohibit-password); the policy proof is sshd -T + the SIGHUP reload after the drop-in. The real root password was not tried (CC does not hold it).
|
|
- guests 9202, 9401 (demo-hp) and the transient 990000 (Tester 1, gone a minute later) are outside the felhom pool; swap = RAM applies to pool guests (9201 on all three: swap = memory).
|