peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-07-22 01:13:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

bin: add optional support for encrypting the support tarball

Browse Source 
This commit adds optional support for encrypting the tarball before it
leaves the target system.  Documentation and usage text updated.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit is contained in:
Joachim Wiberg
2025-12-02 13:38:42 +01:00
parent 0650e16810
commit 9ce47017d8
2 changed files with 128 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/system.md
+41
View File
@@ -357,6 +357,47 @@ The collection process may take up to a minute depending on system load
and the amount of logging data. Progress messages are shown during the
collection process.
### Encrypted Collection
For secure transmission of support data, the archive can be encrypted
with GPG using a password:
```bash
admin@host:~$ support collect -p mypassword > support-data.tar.gz.gpg
Starting support data collection from host...
This may take up to a minute. Please wait...
...
Collection complete. Creating archive...
Encrypting with GPG...
```
The `support collect` command even supports omitting `mypassword` and
will then prompt interactively for the password. This works over SSH too,
but the local ssh client may then echo the password.
> [!TIP]
> To hide the encryption password for an SSH session, the script supports reading from stdin:
> `echo "$MYSECRET" | ssh user@device support collect -p > file.tar.gz.gpg`
After transferring the resulting file to your workstation, decrypt it
with the password:
```bash
$ gpg -d support-data.tar.gz.gpg > support-data.tar.gz
$ tar xzf support-data.tar.gz
```
or
```bash
$ gpg -d support-data.tar.gz.gpg | tar xz
```
> [!IMPORTANT]
> Make sure to share `mypassword` out-of-band from the encrypted data
> with the recipient of the data. I.e., avoid sending both in the same
> plain-text email for example.
### What is Collected
The support archive includes:
src/bin/support
+87 -30
View File
@@ -1,34 +1,41 @@
#!/bin/sh
# Support utilities for troubleshooting Infix systems
#
# Usage: support <command> [options]
# The following text is primarily intended for users of older Infix
# systems that do not yet have this script in the root fileystems.
#
# Commands:
# collect [--log-sec N] Collect system information for support/troubleshooting
# clean [--dry-run] [--days N] Remove old support collection directories
#
# Options for collect:
# --log-sec N Tail /var/log/messages for N seconds (default: 30)
#
# Examples:
# support collect > support-data.tar.gz
# support collect --log-sec 5 > support-data.tar.gz
# ssh user@device support collect > support-data.tar.gz
# support clean --dry-run
# support clean --days 30
#
# Installation (for older Infix versions without this script):
# 1. Copy this script to the target device's home directory:
# scp support user@device:~/
# scp support user@device:
#
# 2. SSH to the device and make it executable:
# ssh user@device
# chmod +x ~/support
#
# 3. Run the script from your home directory:
# ~/support collect > support-data.tar.gz
# # Or directly via SSH from your workstation:
# ssh user@device '~/support collect' > support-data.tar.gz
#
# ~/support collect > support-data.tar.gz
#
# Or directly via SSH from your workstation:
#
# ssh user@device '~/support collect' > support-data.tar.gz
#
# Optionally, the output can be encrypted with GPG using a password for
# secure transmission to support personnel, see below.
#
# Examples:
# support collect > support-data.tar.gz
# support collect -s 5 > support-data.tar.gz
# support collect -p > support-data.tar.gz.gpg
# support collect -p mypass > support-data.tar.gz.gpg
#
# ssh user@device support collect > support-data.tar.gz
# ssh user@device support collect -p mypass > support-data.tar.gz.gpg
#
# Note, interactive password prompt (-p without argument) may echo characters
# over SSH due to local terminal echo. Use -p PASSWORD for remote execution,
# or pipe the password: echo "password" | ssh user@device support collect -p
# meaning you can even: echo "$SECRET_VARIABLE" | ... which in some cases can
# come in handy.
#
# TODO:
# Add more commands, e.g., verify (run health checks), upload <file>,
@@ -39,11 +46,12 @@ cmd_collect()
{
# Default values
LOG_TAIL_SEC=30
PASSWORD=""
# Parse options
while [ $# -gt 0 ]; do
case "$1" in
--log-sec)
--log-sec|-s)
if [ -z "$2" ] || [ "$2" -le 0 ] 2>/dev/null; then
echo "Error: --log-sec requires a positive number" >&2
exit 1
@@ -51,9 +59,35 @@ cmd_collect()
LOG_TAIL_SEC="$2"
shift 2
;;
--password|-p)
# If next arg exists and doesn't start with -, use it as password
if [ -n "$2" ] && [ "${2#-}" = "$2" ]; then
PASSWORD="$2"
shift 2
else
# Prompt for password interactively from stdin, no echo!
# Disable echo BEFORE printing the prompt
old_stty=$(stty -g 2>/dev/null)
stty -echo 2>/dev/null || true
printf "Enter encryption password: " >&2
read -r PASSWORD
echo "" >&2
# Restore terminal settings
if [ -n "$old_stty" ]; then
stty "$old_stty" 2>/dev/null || true
else
stty echo 2>/dev/null || true
fi
if [ -z "$PASSWORD" ]; then
echo "Error: Empty password not allowed" >&2
exit 1
fi
shift
fi
;;
*)
echo "Error: Unknown option '$1'" >&2
echo "Usage: support collect [--log-sec N]" >&2
echo "Usage: support collect [--log-sec|-s N] [--password|-p PASSWORD]" >&2
exit 1
;;
esac
@@ -328,7 +362,22 @@ cmd_collect()
# Create final tar.gz and output to stdout
# Use -C to change to parent directory so paths in archive don't include full home path
cd "${HOME}"
tar czf - "$(basename "${COLLECT_DIR}")" 2>> "${EXEC_LOG}"
# Check if password encryption is requested
if [ -n "$PASSWORD" ]; then
if ! command -v gpg >/dev/null 2>&1; then
echo "Error: --password specified but gpg is not available" >&2
exit 1
fi
echo "Encrypting with GPG..." >&2
tar czf - "$(basename "${COLLECT_DIR}")" 2>> "${EXEC_LOG}" | \
gpg --batch --yes --passphrase "$PASSWORD" --pinentry-mode loopback -c 2>> "${EXEC_LOG}"
echo "" >&2
echo "WARNING: Remember to share the encryption password out-of-band!" >&2
echo " Do not send it in the same email as the encrypted file." >&2
else
tar czf - "$(basename "${COLLECT_DIR}")" 2>> "${EXEC_LOG}"
fi
}
cmd_clean()
@@ -408,17 +457,25 @@ usage()
echo "Usage: support <command> [options]"
echo ""
echo "Commands:"
echo " collect Collect system information for support/troubleshooting"
echo " NOTE: may take up to a minute to finish, please wait!"
echo " clean [options] Remove old support collection directories"
echo " collect [options] Collect system information for support/troubleshooting"
echo " NOTE: may take up to a minute to finish, please wait!"
echo " clean [options] Remove old support collection directories"
echo ""
echo "Options for collect:"
echo " -s, --log-sec SEC Tail /var/log/messages for SEC seconds (default: 30)"
echo " -p, --password [PASS] Encrypt output with GPG. If PASS is omitted, prompts"
echo " interactively or reads from stdin, so possible to do"
echo " echo "\$MYSECRET" | ... (recommended for security)"
echo ""
echo "Options for clean:"
echo " --dry-run, -n Show what would be deleted without deleting"
echo " --days N, -d N Remove directories older than N days (default: 7)"
echo " -n, --dry-run Show what would be deleted without deleting"
echo " -d, --days N Remove directories older than N days (default: 7)"
echo ""
echo "Examples:"
echo " support collect > support-data.tar.gz"
echo " ssh user@device support collect > support-data.tar.gz"
echo " support collect > support-data.tar.gz"
echo " support collect -p > support-data.tar.gz.gpg"
echo " support collect --password mypass > support-data.tar.gz.gpg"
echo " ssh user@device support collect > support-data.tar.gz"
echo " support clean --dry-run"
echo " support clean --days 30"
exit 1