Files
felhom.eu/documentation/audits/security-app-updates-2026-10-27/part5/tools/r1281probe.sh
T

13 lines
1.2 KiB
Bash
Executable File

#!/bin/bash
# r1281probe.sh — run INSIDE a guest (pct exec <vmid> -- bash -s < r1281probe.sh). R-1281: an app container on
# traefik-public must NOT reach the file manager; the control (same image, same network, same wget) reaches traefik.
# The throwaway client is the box's own traefik image (busybox wget), `--rm`, on traefik-public. Prints codes only.
img=$(docker inspect -f '{{.Config.Image}}' traefik)
fbip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}' filebrowser | awk '{print $1}')
echo "images: traefik=$img filebrowser=$(docker inspect -f '{{.Config.Image}}' filebrowser) cloudflared=$(docker inspect -f '{{.Config.Image}}' cloudflared 2>/dev/null || echo none)"
echo "filebrowser networks: $(docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} {{end}}' filebrowser)"
t() { docker run --rm --network traefik-public --entrypoint sh "$img" -c "wget -q -T 5 -O /dev/null -S '$1' 2>&1 | head -1 | tr -d '\r' ; echo rc=\$?" 2>&1 | tr '\n' ' '; }
echo "from traefik-public -> filebrowser:80 (by name): $(t http://filebrowser:80/)"
echo "from traefik-public -> filebrowser by IP $fbip: $(t http://$fbip:80/)"
echo "CONTROL from traefik-public -> traefik:80: $(t http://traefik:80/)"