From 3a186d29df88779ee75a519cbcc024fc25a0047b Mon Sep 17 00:00:00 2001
From: Julian Cuni <julian.cuni@microservices.al>
Date: Tue, 7 Jul 2026 08:55:51 +0200
Subject: [PATCH] =?UTF-8?q?docs(wiki):=20runbook=20=C2=A75c=20uses=20gpass?=
 =?UTF-8?q?wd=20-d=20=E2=80=94=20deluser=20rejects=20hyphenated=20users?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Demoting the operator on park-buzi failed with "sanitize_string: invalid
characters in 'park-operator'" — Ubuntu's perl adduser/deluser tooling
rejects the hyphenated username. §5c now prescribes gpasswd -d for
sudo/lxd/lpadmin (shadow-suite, no perl sanitize) and documents that
group removal lands at NEXT login: the auto-login operator session keeps
its old memberships until reboot/relog, so verify `groups` from inside
the session afterwards.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
---
 wiki/decisions/appliance-provisioning.md | 15 +++++++++++----
 wiki/log.md                              |  8 ++++++++
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/wiki/decisions/appliance-provisioning.md b/wiki/decisions/appliance-provisioning.md
index 16d2c09..fe1ebec 100644
--- a/wiki/decisions/appliance-provisioning.md
+++ b/wiki/decisions/appliance-provisioning.md
@@ -216,17 +216,24 @@ adversary). Create a dedicated **admin** (real password, sudo, NO auto-login) an
 ```bash
 sudo adduser admin && sudo usermod -aG sudo admin
 # VERIFY in a second session: log in as admin → `sudo whoami` prints root — BEFORE the next step:
-sudo deluser <operator> sudo            # demote the auto-login operator
+sudo gpasswd -d <operator> sudo          # demote the auto-login operator
 groups <operator>                        # confirm: no 'sudo'
 ```
 
+> Use **`gpasswd -d`**, not `deluser <user> <group>`: on this Ubuntu the perl adduser tooling
+> rejects hyphenated usernames (`sanitize_string: invalid characters in 'park-operator'` —
+> VERIFIED on park-buzi 2026-07-06). And group removal applies at **next login** — the auto-login
+> operator session keeps its old memberships until the box reboots (or the session relogs);
+> re-verify `groups` from inside the operator session afterwards.
+
 ⚠ Order matters: confirm the new admin's sudo works **before** demoting the operator, or you lock
 yourself out. Keep auto-login on the OPERATOR, not admin. **Leave root password disabled** (Ubuntu
 default) — `admin`+sudo IS the root path; enabling root adds risk, no gain.
 
-> Strip latent escalation groups from the operator: **`sudo deluser <operator> lxd`** (lxd group =
-> launch a privileged container that mounts host `/` as root — undoes the no-sudo hardening) and
-> `lpadmin` (printer admin, unneeded). And NEVER add the operator to `docker` (also root-equivalent).
+> Strip latent escalation groups from the operator: **`sudo gpasswd -d <operator> lxd`** (lxd group
+> = launch a privileged container that mounts host `/` as root — undoes the no-sudo hardening) and
+> `sudo gpasswd -d <operator> lpadmin` (printer admin, unneeded). And NEVER add the operator to
+> `docker` (also root-equivalent).
 
 ## 5b. Further hardening (TODO — not yet done)
 
diff --git a/wiki/log.md b/wiki/log.md
index 438a5cb..7c644b0 100644
--- a/wiki/log.md
+++ b/wiki/log.md
@@ -2459,3 +2459,11 @@ stays attributable in the chain. Best-effort: no build/key → loud warning, see
 (verified both paths on a scratch DB). [[appliance-provisioning]] gained §7e: FORCE=1 reset
 commands (interactive preferred — keeps the password out of shell history), sessions-not-revoked
 caveat + JWT_SECRET rotation for suspected theft, role-row self-heal note added to §7d.
+
+## [2026-07-06] update | Runbook §5c: gpasswd -d, not deluser (hyphenated-username perl bug)
+
+Demoting the operator on park-buzi hit `sanitize_string: invalid characters in 'park-operator'` —
+Ubuntu's perl adduser/deluser tooling rejects the hyphenated username. [[appliance-provisioning]]
+§5c now uses `gpasswd -d <operator> sudo|lxd|lpadmin` (shadow-suite, no perl sanitize) and notes
+that group removal applies at NEXT login — the auto-login operator session keeps old memberships
+until reboot/relog, so verify `groups` from inside the session afterwards.