mca/parking_solution
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

docs(wiki): runbook §5c uses gpasswd -d — deluser rejects hyphenated users
Build & push images / images (push) Successful in 3m14s
Details
CI / check (push) Successful in 43s
Details

Browse Source 
Demoting the operator on park-buzi failed with "sanitize_string: invalid
characters in 'park-operator'" — Ubuntu's perl adduser/deluser tooling
rejects the hyphenated username. §5c now prescribes gpasswd -d for
sudo/lxd/lpadmin (shadow-suite, no perl sanitize) and documents that
group removal lands at NEXT login: the auto-login operator session keeps
its old memberships until reboot/relog, so verify `groups` from inside
the session afterwards.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
This commit is contained in:
Julian Çuni
2026-07-07 08:55:51 +02:00
parent 827445d514
commit 3a186d29df
2 changed files with 19 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wiki/decisions/appliance-provisioning.md
+11 -4
View File
@@ -216,17 +216,24 @@ adversary). Create a dedicated **admin** (real password, sudo, NO auto-login) an
```bash
sudo adduser admin && sudo usermod -aG sudo admin
# VERIFY in a second session: log in as admin → `sudo whoami` prints root — BEFORE the next step:
sudo deluser <operator> sudo # demote the auto-login operator
sudo gpasswd -d <operator> sudo # demote the auto-login operator
groups <operator> # confirm: no 'sudo'
```
> Use **`gpasswd -d`**, not `deluser <user> <group>`: on this Ubuntu the perl adduser tooling
> rejects hyphenated usernames (`sanitize_string: invalid characters in 'park-operator'` —
> VERIFIED on park-buzi 2026-07-06). And group removal applies at **next login** — the auto-login
> operator session keeps its old memberships until the box reboots (or the session relogs);
> re-verify `groups` from inside the operator session afterwards.
⚠ Order matters: confirm the new admin's sudo works **before** demoting the operator, or you lock
yourself out. Keep auto-login on the OPERATOR, not admin. **Leave root password disabled** (Ubuntu
default) — `admin`+sudo IS the root path; enabling root adds risk, no gain.
> Strip latent escalation groups from the operator: **`sudo deluser <operator> lxd`** (lxd group =
> launch a privileged container that mounts host `/` as root — undoes the no-sudo hardening) and
> `lpadmin` (printer admin, unneeded). And NEVER add the operator to `docker` (also root-equivalent).
> Strip latent escalation groups from the operator: **`sudo gpasswd -d <operator> lxd`** (lxd group
> = launch a privileged container that mounts host `/` as root — undoes the no-sudo hardening) and
> `sudo gpasswd -d <operator> lpadmin` (printer admin, unneeded). And NEVER add the operator to
> `docker` (also root-equivalent).
## 5b. Further hardening (TODO — not yet done)