Cyrene
ae50acfe40
Passwords failed on 10/16 challenges while state.json looked correct:
- only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported
XVI/XVII image does 'echo root:${PASSWORD} | chpasswd' and logs in as root.
set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password on an
account nobody uses -> 'Permission denied' everywhere.
Registry gains a per-challenge 'ssh_user'; chpasswd now targets the real
login (and ctfuser/ctf when present) and reports failures loudly.
- phew checker: chall.py block-buffers stdout through the docker exec pipe
(PYTHONUNBUFFERED now set) and leaks chall.py inside the container on
timeout (26 orphans, container saturated) -> reaps the whole exec process
group. Startup does a fresh Pailier keygen (~12 s) so crypto reads need
_CRYPTO_TIMEOUT, not the 5 s prompt default.
Adds panel/verify_ssh_creds.py (proves the state->container binding from
inside via a real login), audit_ssh_users.sh, reset_runtime.sh.
17 lines
782 B
Bash
17 lines
782 B
Bash
#!/usr/bin/env bash
|
|
# Which SSH user does each challenge's image actually provision?
|
|
# The imported XVI/XVII challenges do NOT all use `ctfuser`: art uses `root`,
|
|
# anti-alchemy uses `ctf`. set_ssh_passwords() only does
|
|
# `echo 'ctfuser:<pw>' | chpasswd`, so for those images it either fails or sets
|
|
# a password on an account nobody logs in as -> "Permission denied" for every
|
|
# team, while state.json looks perfectly correct.
|
|
set -uo pipefail
|
|
cd /opt/gemastik18-final
|
|
printf "%-18s %s\n" CHALLENGE "Dockerfile user provisioning"
|
|
for d in services/*/; do
|
|
name=$(basename "$d")
|
|
[ -f "$d/Dockerfile" ] || continue
|
|
line=$(grep -hE 'chpasswd|useradd|adduser' "$d/Dockerfile" 2>/dev/null | head -2 | tr '\n' ';' | cut -c1-110)
|
|
printf "%-18s %s\n" "$name" "${line:-<none>}"
|
|
done
|