Cyrene
ae50acfe40
Passwords failed on 10/16 challenges while state.json looked correct:
- only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported
XVI/XVII image does 'echo root:${PASSWORD} | chpasswd' and logs in as root.
set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password on an
account nobody uses -> 'Permission denied' everywhere.
Registry gains a per-challenge 'ssh_user'; chpasswd now targets the real
login (and ctfuser/ctf when present) and reports failures loudly.
- phew checker: chall.py block-buffers stdout through the docker exec pipe
(PYTHONUNBUFFERED now set) and leaks chall.py inside the container on
timeout (26 orphans, container saturated) -> reaps the whole exec process
group. Startup does a fresh Pailier keygen (~12 s) so crypto reads need
_CRYPTO_TIMEOUT, not the 5 s prompt default.
Adds panel/verify_ssh_creds.py (proves the state->container binding from
inside via a real login), audit_ssh_users.sh, reset_runtime.sh.
34 lines
1.1 KiB
Bash
34 lines
1.1 KiB
Bash
#!/usr/bin/env bash
|
|
# Bring every team's containers in line with the registry's enabled set.
|
|
#
|
|
# For each team: re-render the compose from the registry, then `up -d`. Because
|
|
# the shared `services-<name>` images already exist, this is a start, not a
|
|
# rebuild, so it is fast. Containers of challenges that are no longer enabled are
|
|
# removed by `up --remove-orphans`.
|
|
set -uo pipefail
|
|
cd /opt/gemastik18-final/panel
|
|
python3 - <<'PY'
|
|
import json, sys
|
|
sys.path.insert(0, '.')
|
|
import teams as orch, compose_gen
|
|
orch.reconcile_team_state()
|
|
for d in sorted(orch.TEAMS_DIR.glob("team*")):
|
|
sf = d / "state.json"
|
|
if not sf.exists():
|
|
continue
|
|
st = json.loads(sf.read_text())
|
|
(d / "services" / "docker-compose.yml").write_text(
|
|
compose_gen.render_team_compose(st["index"], st))
|
|
print(f"team{st['index']} compose rendered")
|
|
PY
|
|
|
|
for i in 1 2 3 4; do
|
|
cd "/opt/gemastik18-final/teams/team$i/services"
|
|
echo "--- team$i ---"
|
|
docker compose -p "team$i" up -d --remove-orphans 2>&1 | tail -2
|
|
done
|
|
|
|
echo "=== result ==="
|
|
docker ps --format '{{.Names}}' | grep -c '_container_team'
|
|
df -h / | tail -1
|