logan/node-26
1
0
Fork 0
Code Issues 14 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

install.sh: enrollment token via header file too — it was on curl argv despite the comment
CI / lint (push) Successful in 6s
Details
CI / lint (pull_request) Successful in 4s
Details
CI / test (push) Successful in 42s
Details
CI / test (pull_request) Successful in 40s
Details

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Logan Cusano
2026-10-04 01:10:21 -04:00
co-authored by Claude Opus 5.5
parent f22caf6259
commit 32692030fb
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install.sh
+7 -3
View File
@@ -442,12 +442,15 @@ do_fresh_enroll() {
BODY="$(jq -nc --arg id "$NODE_ID" --arg n "${NODE_NAME:-$NODE_ID}" \ BODY="$(jq -nc --arg id "$NODE_ID" --arg n "${NODE_NAME:-$NODE_ID}" \
--argjson lat "${NODE_LAT:-0}" --argjson lon "${NODE_LON:-0}" \ --argjson lat "${NODE_LAT:-0}" --argjson lon "${NODE_LON:-0}" \
'{node_id:$id,name:$n,lat:$lat,lon:$lon}')" '{node_id:$id,name:$n,lat:$lat,lon:$lon}')"
# Token goes in a header from a shell variable — never on a process command # Token goes in a 0600 header file — never on a process command line (curl's
# line, never echoed. # argv is visible in `ps`; CISO condition, server-26#61), never echoed.
local _ehdr; _ehdr="$(mktemp)"; chmod 600 "$_ehdr"
printf 'X-Enrollment-Token: %s\n' "$ENROLLMENT_TOKEN" > "$_ehdr"
if ! RESP="$(curl -fsS -X POST "$C2_URL/nodes/enroll" \ if ! RESP="$(curl -fsS -X POST "$C2_URL/nodes/enroll" \
-H "Content-Type: application/json" \ -H "Content-Type: application/json" \
-H "X-Enrollment-Token: $ENROLLMENT_TOKEN" \ -H "@$_ehdr" \
--data "$BODY" 2>&1)"; then --data "$BODY" 2>&1)"; then
rm -f "$_ehdr"
case "$RESP" in case "$RESP" in
*403*) die "enroll refused (403): node '$NODE_ID' is already approved on C2, and *403*) die "enroll refused (403): node '$NODE_ID' is already approved on C2, and
this machine has no configs/pickup_secret to collect its key with. A token this machine has no configs/pickup_secret to collect its key with. A token
@@ -461,6 +464,7 @@ do_fresh_enroll() {
*) die "enroll failed: $RESP" ;; *) die "enroll failed: $RESP" ;;
esac esac
fi fi
rm -f "$_ehdr"
PICKUP="$(printf '%s' "$RESP" | jq -r '.pickup_secret')" PICKUP="$(printf '%s' "$RESP" | jq -r '.pickup_secret')"
STATUS="$(printf '%s' "$RESP" | jq -r '.approval_status')" STATUS="$(printf '%s' "$RESP" | jq -r '.approval_status')"
[ -n "$PICKUP" ] && [ "$PICKUP" != null ] || die "enroll returned no pickup_secret: $RESP" [ -n "$PICKUP" ] && [ "$PICKUP" != null ] || die "enroll returned no pickup_secret: $RESP"