wmantly
d47d08ecab
Implements protocol v1.2.0. verifySignature() returned true when no public_key was configured, logging "skipping signature verification". The SSO installer never wrote a public_key, so a default install executed reboot, service_restart, configure_ldap, arbitrary_bash and update_binary UNVERIFIED from anything that could reach its socket. An agent that cannot verify now refuses. Canonicalization also disagreed with the server. Go's encoding/json escapes <, > and & by default; JSON.stringify does not. Any payload containing them hashed differently on each side and failed verification -- for arbitrary_bash that is most real scripts (`>` redirection, `&&`). Now uses json.Encoder with SetEscapeHTML(false), trailing newline trimmed. The SSO now rejects tokens it did not issue. Handles its close codes (4001/4002/4003/4004) and backs off 5 minutes on an enrollment failure instead of retrying every 5s forever. The connect log no longer prints the URL, which carried ?token=. install.sh gains --public-key and warns when none is configured. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
48 lines
1.9 KiB
Plaintext
48 lines
1.9 KiB
Plaintext
# theta-agent configuration file
|
|
# Default location: /etc/theta42/agent.yml
|
|
|
|
server_url: "https://sso.example.com"
|
|
|
|
# Issued by the SSO when you enroll this host (Directory -> Install Agent, or
|
|
# POST /api/agent/enroll). The server records only its hash and rejects any
|
|
# token it did not issue, so a value invented locally will not connect.
|
|
auth_token: "REPLACE_WITH_ISSUED_AGENT_TOKEN"
|
|
|
|
# Base64 of the SSO's RAW 32-byte Ed25519 public key -- the `publicKey` value
|
|
# from enrollment or GET /api/agent/nodes. This is NOT a PEM body.
|
|
#
|
|
# Required for any high-risk command. Without it the agent still reports
|
|
# telemetry, but REFUSES reboot / service_restart / configure_ldap /
|
|
# arbitrary_bash / update_binary, because it has no way to verify them.
|
|
public_key: "REPLACE_WITH_SSO_PUBLIC_KEY"
|
|
|
|
location: "default" # Location identifier (e.g., site, datacenter) for naming
|
|
|
|
capabilities:
|
|
# ---------------------------------------------------------
|
|
# Basic Capabilities (Safe, read-only or infrastructure management)
|
|
# ---------------------------------------------------------
|
|
|
|
# Push CPU, RAM, GPU, and ZFS metrics to the SSO Manager
|
|
telemetry: true
|
|
|
|
# Allow the SSO Manager to push down SSSD and SSH keys configuration
|
|
configure_ldap: true
|
|
|
|
# ---------------------------------------------------------
|
|
# Advanced Capabilities (High risk, remote operations)
|
|
# ---------------------------------------------------------
|
|
|
|
# Allow remote system reboots via the SSO Manager
|
|
reboot: false
|
|
|
|
# Allow restarting, starting, or stopping specific systemd services.
|
|
# Must be an explicit list of allowed service names.
|
|
# Example: ["gitea", "nginx", "docker"]
|
|
# Setting to true or [] denies all.
|
|
service_control: []
|
|
|
|
# CRITICAL: Allow the execution of raw bash scripts sent from the SSO Manager.
|
|
# Useful for GitOps deployments, but allows remote code execution.
|
|
arbitrary_bash: false
|